Cisco ISE "ActiveSessionCount" statistic - meaning. What are the maximum threshold values.

[jb-123]

Hello - I am curious about the "ActiveSessionCount" statistic meaning provided in the "Msg:CISE_System_Statistic"  70000 NOTICE System-Stats: ISE Utilization syslog.   

In our ISE 2.2 (patch 13) distributed deployment model - this figure is increasing significantly over time. 

It also has a negative value?  See below syslog message:

Rcvd:2019-03-10T18:57:03.184985+11:00 From:ise-xxxx.net.au Time:2019-03-10T18:57:03

Host:ise-xxxx Pri:local6.notice Msg:CISE_System_Statistics 0020577096 1 0 2019-03-10 18:57:03.181 +11:00 0665928396 70000 NOTICE System-Stats: ISE Utilization, ConfigVersionId=424, SysStatsUtilizationCpu=3.12%, SysStatsUtilizationNetwork=eth0: rcvd = 3904635\; sent = 17567402 \;rcvd_dropped = 0\; sent_dropped = 0, SysStatsUtilizationMemory=31.03%, SysStatsUtilizationDiskIO=0.44%, SysStatsUtilizationDiskSpace=20% /, SysStatsUtilizationDiskSpace=2% /storedconfig, SysStatsUtilizationDiskSpace=23% /boot, SysStatsUtilizationDiskSpace=1% /tmp, SysStatsUtilizationDiskSpace=46% /opt, SysStatsUtilizationDiskSpace=8% /localdisk, AverageRadiusRequestLatency=175, AverageTacacsRequestLatency=0, DeltaRadiusRequestCount=730, DeltaTacacsRequestCount=0, SysStatsUtilizationLoadAvg=0.35, SysStatsCpuCount=8, SysStatsProcessMemoryMB=30730, ActiveSessionCount=-447419

Is someone able to explain what this value means and why it is a negative value?

Thanks

[hslai]

Each ISE PSN keeps this stats for the sessions processed on it. When negative, it means more Accounting STOPs received than Accounting STARTs. This number is not accurately reflecting to the actual utilization of session cache on the PSN.

The threshold of session cache is determined by the deployed platform and can differ by ISE releases. Here are the number for ISE 2.6:

sessioncache.maxSessions=15000
<ucsLarge>.sessioncache.maxSessions=20000
<sns3515>.sessioncache.maxSessions=15000
<sns3595>.sessioncache.maxSessions=40000
<sns3615>.sessioncache.maxSessions=20000
<sns3655>.sessioncache.maxSessions=50000
<sns3695>.sessioncache.maxSessions=100000

[hslai]

This is related to CSCvh15384, which might need another day or two to be visible externally.

[hslai]

If possible, please check RADIUS accounting reports, see which network devices doing such, and investigate further.