Difference on "Filter All, Filter Passed, Filter Failed"

[Ping Zhou]

Experts,

Trying to figure out the differences between "Filter All, Filter Passed, Filter Failed" with Collection Filter settings. Admin guide says they have the same function..."In the first three Filter Types, Cisco ISE compares specified values with fields in the syslog message. If any match is found, then the corresponding message is not sent. In other words, only records that do not match the specified value are displayed in the monitoring syslogs."

Cisco Identity Services Engine User Guide, Release 1.2 - Logging [Cisco Identity Services Engine] - Cisco

[hslai · Accepted solution]

Filter All -- Both Passed and Failed are filtered

Filter Passed -- only Passed are filtered

Filter Failed -- only Failed are filtered

We use Filter Passed/Failed when one or the other is normal.

[Charlie Moreton]

Filter All - Shows no logs from the specified Attribute with the specified Value

Filter Passed - Shows only failure logs from the specified Attribute with the specified Value

Filter Failed - Shows only successful logs from the specified Attribute with the specified Value