Empty RADIUS and TACACS LiveLogs after restoring ISE from backup...

[rezaalikhani]

Hi all;

Yesterday, due to a power outage in our environment, my ISE 3.2 patch 4 crashed and I restored it with the latest backup successfully (only the configuration backup, not the operational backup)... Everything works well except that the RADIUS and TACACS LiveLogs are empty, as you can see below:

The steps that I have taken so far:

1. Disabling the " Use "ISE Messaging Service" for UDP Syslogs delivery to MnT" option.

2. Regenerating a new certificate for "ISE Messaging Service"

3. Regenerating a new certificate for ISE Root CA.

Any ideas?

Thanks

[Aref Alsouqi]

How many nodes do you have in your deployment? and where the MnT personas are enabled?

[rezaalikhani]

@Aref Alsouqi  I have implemented ISE in Standalone mode...

[ahollifield]

Do you have queue link alarms?  Why did you disable the ISE Messaging Service? https://www.adamhollifield.com/2022/09/fix-cisco-ise-messaging-service.html

[rezaalikhani]

@ahollifield I do not have any Queue Links error. I disabled that option because many threads in technical communities suggested that disabling it resolved their problems.

[Arne Bier]

I had a case yesterday where an ISE 2.7 system just stopped producing any Live Logs. The M&T process had died due to a disk space issue. Somewhere deep in an Oracle database, that TAC engineer found a table that had metastasized well beyond its normal size. The /opt was 80% full. The solution was to Reset the M&T Database. 

application configure ise

 Option 4.

That reduced the /opt to 20% and all was well again.  I have never had to use this option in earnest. But it's a good one to keep in mind. Bear in mind it will restart the application services though.

In ISE 3.2 patch 4 the regen of Messaging CA and Internal CA should resolve any Queue Link errors ... at least in my experience.

[rezaalikhani]

@Arne Bier  I used Option 4 as you suggested but it did not resolve the problem...

[Arne Bier]

What does show application status ise show you?  Is M&T process running?

Tried rebooting the node?

Are your ISE DNS records still same as before?  A and PTR records?

[rezaalikhani · Accepted solution]

@Arne Bier  Some interesting things happened. Honestly, I decided to build my ISE deployment from scratch and so, blindly attempted other options beside your recommended option. Fortunately, the Option 1 --> Reset M&T Session Database did the trick.

Thanks anyway