Delete old logs displayed in ISE CLI

[hurricane05]

I'm currently running ISE version 2.6 and when I do a show logging from ISE CLI, I see logs dated back from over a year ago. In the GUI under Administration \ System \ Logging the Local Log Storage period is set to 90 days. I also clicked on the button to Delete Local Logs Now. Is there another area where I set to the amount of logs to keep?

Thx in advance for any assistance provided.

[balaji.bandi]

Can you post the output of show logging what files you referrring ?

[Marcelo Morais · Accepted solution]

Hi @hurricane05 ,

 please take a look at:

ise/admin# show logging ?
>           Output Redirection.
application List application log files
container   Show container logging information
internal    Show syslog configuration internal
system      List system log files
|           Output modifiers.
<cr>        Carriage return.

if you have logs dated from over an year from the:

show logging <cr> ... it's weird

show logging application | show logging system ... possible

Hope this helps !!!

[hurricane05]

Thx for the feedback. See attached log file. Seems most are from the Application.

[Arne Bier]

Regarding the option in the ISE Admin GUI to clear local logs: 

Administration > System > Logging > Log Settings "Delete Local Logs Now"

When comparing the before and after (I compared the "show logging application" with WinMerge for side by side comparison) I noticed that it only cleanses the localStore/iseLocalStore.log.* files - e.g. it wiped only these files

    5243041 Jul 22 2021 05:06:00  localStore/iseLocalStore.log.2021-07-22-00-00-01-377
    5243031 Jul 22 2021 09:53:38  localStore/iseLocalStore.log.2021-07-22-05-06-00-816
    5242937 Jul 22 2021 13:32:29  localStore/iseLocalStore.log.2021-07-22-09-53-38-970
    5243074 Jul 22 2021 17:19:40  localStore/iseLocalStore.log.2021-07-22-13-32-29-828
    5243032 Jul 22 2021 21:54:49  localStore/iseLocalStore.log.2021-07-22-17-19-40-660

ISE does rotate its logs and the regular Linux log rotation stuff happens - it means older stuff might hang around if the newer data is insufficient to overwrite it. But the number of log files stays constant.

[Arne Bier]

I don't think it's possible to prune all ISE logs - local application logs can be purged I think - but I have a customer whose config backup contains logs from 2014! 

ISE drags a lot of junk around. And sadly, the config backup contains all that junk. It pains me every time I see it. I would expect this in a debug bundle - but not in a config backup.

[Ethan Grinnell]

If this is a VM you can mount the disks in another VM (Just plain Linux) and delete files as needed. There have been some bugs that left huge log files that I cleaned up this way.

Be careful though! This is also a great way to break things if you're unsure of what you're doing.