Showing results for 
Search instead for 
Did you mean: 

External Syslog in ISE

Neelesh Marathe
Cisco Employee
Cisco Employee

Hello Team,


I am working with India's largest bank for ISE Implementation. Bank has total 18 nodes installed across two locations. We have configured IBM QRADAR as external syslog server. Syslog team is receiving logs from all the PSNs however they are not seeing any logs from Monitoring and Admin node. Based on their observation, bank has raised following queries


1. Does Admin and MnT node sends log to external server? if yes, which types of logs are being sent by MnT and Admin node?

2. Is it possible to send logs only from monitoring node to external syslog server instead of all PSN sending logs to server?



Neelesh Marathe

1 Reply 1

Timothy Abbott
Cisco Employee
Cisco Employee

Admin and MnT nodes can send syslog data to a remote target but only for logs that apply to their specific function in a deployment.  You will see the bulk of logging events being sent from the PSNs because they handle endpoint authentications.  If you want health data or operational information from the Admin and MnT nodes, you will want to include the remote target for those particular categories.  Just keep in mind that you will also get the same information from the PSNs since logging is a global setting in a deployment.  To my knowledge, you can't have the MnT send logs on behalf of the PSNs.  Hope this helps.




Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers