cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4333
Views
5
Helpful
6
Replies

Delete old logs displayed in ISE CLI

hurricane05
Level 1
Level 1

I'm currently running ISE version 2.6 and when I do a show logging from ISE CLI, I see logs dated back from over a year ago. In the GUI under Administration \ System \ Logging the Local Log Storage period is set to 90 days. I also clicked on the button to Delete Local Logs Now. Is there another area where I set to the amount of logs to keep?

 

Thx in advance for any assistance provided.

1 Accepted Solution

Accepted Solutions

Hi @hurricane05 ,

 please take a look at:

ise/admin# show logging ?
> Output Redirection.
application List application log files
container Show container logging information
internal Show syslog configuration internal
system List system log files
| Output modifiers.
<cr> Carriage return.

if you have logs dated from over an year from the:

show logging <cr> ... it's weird

show logging application | show logging system ... possible

 

Hope this helps !!!

 

View solution in original post

6 Replies 6

balaji.bandi
Hall of Fame
Hall of Fame

Can you post the output of show logging what files you referrring ?

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Hi @hurricane05 ,

 please take a look at:

ise/admin# show logging ?
> Output Redirection.
application List application log files
container Show container logging information
internal Show syslog configuration internal
system List system log files
| Output modifiers.
<cr> Carriage return.

if you have logs dated from over an year from the:

show logging <cr> ... it's weird

show logging application | show logging system ... possible

 

Hope this helps !!!

 

Thx for the feedback. See attached log file. Seems most are from the Application.

 

Regarding the option in the ISE Admin GUI to clear local logs: 

Administration > System > Logging > Log Settings "Delete Local Logs Now"

 

When comparing the before and after (I compared the "show logging application" with WinMerge for side by side comparison) I noticed that it only cleanses the localStore/iseLocalStore.log.* files - e.g. it wiped only these files

 

    5243041 Jul 22 2021 05:06:00  localStore/iseLocalStore.log.2021-07-22-00-00-01-377
    5243031 Jul 22 2021 09:53:38  localStore/iseLocalStore.log.2021-07-22-05-06-00-816
    5242937 Jul 22 2021 13:32:29  localStore/iseLocalStore.log.2021-07-22-09-53-38-970
    5243074 Jul 22 2021 17:19:40  localStore/iseLocalStore.log.2021-07-22-13-32-29-828
    5243032 Jul 22 2021 21:54:49  localStore/iseLocalStore.log.2021-07-22-17-19-40-660

ISE does rotate its logs and the regular Linux log rotation stuff happens - it means older stuff might hang around if the newer data is insufficient to overwrite it. But the number of log files stays constant.

Arne Bier
VIP
VIP

I don't think it's possible to prune all ISE logs - local application logs can be purged I think - but I have a customer whose config backup contains logs from 2014! 

 

ISE drags a lot of junk around. And sadly, the config backup contains all that junk. It pains me every time I see it. I would expect this in a debug bundle - but not in a config backup.

Ethan Grinnell
Level 1
Level 1

If this is a VM you can mount the disks in another VM (Just plain Linux) and delete files as needed. There have been some bugs that left huge log files that I cleaned up this way.

Be careful though! This is also a great way to break things if you're unsure of what you're doing.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: