Cisco ISE Syslog Target Capture

[Lucas Borza]

Is there a way to troubleshoot or validate that Cisco ISE is sending syslogs to a "Remote Logging Target"?
I'm trying to set this up with QRadar however its showing that its not receieving any logs from ISE. I've confirmed that IBM has ISE packages to support it but I'm concerned because it says it supports versions 1.1 to 2.2 (seems very dated). Im running 3.1P3 at the moment. I've setup the logging categories to include the new target but still no luck. There is no firewalls between ISE and QRadar. 

[Rob Ingram]

@Lucas Borza run tcpdump on ISE and filter on the syslog IP address to determine whether ISE attempts to communicate.

[Lucas Borza]

This might sound silly, but I've tried that and its empty. The syslogs are sending in UDP. Would the TCP dump cover that?

[Rob Ingram]

@Lucas Borza have you assigned the remote logging server as a target under the required logging categories?

[PRANetworkTeam]

Yes. It turns out the team that manages QRadar had an error in their setup, and they resolved it. I would hope that the TCPDUMP would cover the UDP traffic to at least prove that I am sending the logs.  

[thomas]

Covered in one of our ISE Webinars. Now available in the CiscoISE YouTube Channel.

▶ ISE Initial Setup and Operations

12:00 Syslogs and Remote Logging Targets
15:09 Logging Categories and Example Syslogs
17:05 Authentication Syslogs from Meraki Dashboard
19:33 Syslog Message Catalog and Export
20:37 Syslog Collection Filters

[Lucas Borza]

I'm thinking something is up with QRadar not showing the "Notice" syslogs. I have my logging categories setup correctly but I'm looking to see the authentication/authorization logs from every attempt. The goal is to have it so I can trigger an alert if a device is Anomalous or if it hits an Authorization Policy I set for quarantine. I saw in the documentation with QRadar they support versions 1.1 to 2.2 which I find it pretty dated. Maybe they don't accept all syslogs from ISE since I'm running 3.1P3.