12-21-2020 02:29 AM
hi
we want to check ise old logs (logs which are 2 weeks older). but under rasius live logs it shows logs of last 24 hours only.
basically we want to filter 1 incident occured 2 weeks ago from particular NAD AP.
Thanks
Solved! Go to Solution.
12-21-2020 07:31 AM
Hi,
You should go under Operations -> Reports and select Endpoints and Users.
Then you can probably use RADIUS Authentications ans RADIUS Accounting to extract the info that you need.
Keep in mind that by default ISE keeps 30 days worth of RADIUS logs, if you need to change that you have to go under Administration -> Maintenance -> Operational data purging.
Hope that helped you.
12-21-2020 02:36 AM - edited 12-21-2020 02:38 AM
Hi
In cisco ISE you can see just live log for 24h
you should configure SIEM for saving log
12-21-2020 07:08 AM
depends log retention policy you have setup.
12-21-2020 07:31 AM
Hi,
You should go under Operations -> Reports and select Endpoints and Users.
Then you can probably use RADIUS Authentications ans RADIUS Accounting to extract the info that you need.
Keep in mind that by default ISE keeps 30 days worth of RADIUS logs, if you need to change that you have to go under Administration -> Maintenance -> Operational data purging.
Hope that helped you.
10-17-2022 05:34 AM
Hello ,
I found out that you should also check in administration->logging->log settings and verify the "local log storage period " .
Regards ,
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide