How to extract Radius Accounting data/log from Cisco ISE 3.3

[tw2079]

Hello. We are using a Cisco ISE running 3.3. We normally set it up for radius authentication but this latest project, the PM wants to simply test Radius Accounting for Start/Stop/Interim without authentication from devices. I have set it up as such and I can go into Reports, Log Analytics and look at the Radius Accounting Summary to see the Radius Accounting data. The table shows the data by device but summarize it by a whole day, how many Start and Stop in the count column in total for that day. We were hoping to extract each transaction by the exact time for each Radius Start and Radius Stop and not just a total sum. Looks like the graph above may show the timing but it's hard to extract the start and stop time from the graph. Is there a way to extract separate Radius Accounting detail from the logs and not just the summary? I also went to Troubleshoot and Download Logs and download all the local logs but I don't see Radius Accounting info. Any insight would be appreciated. Thanks

[Arne Bier · Accepted solution]

Your best bet would be to use the Data Connect interface in ISE. It's an ODBC connection to one of the MNT nodes, to allow you to query (using SQL) many tables, including RADIUS Accounting. I use it a lot for forensic analysis. In the past I would load an ODBC database query tool like DBeaver, MySQL, or Microsoft's SQL tools - but if you have a linux environment, I recommend the pysql script that Thomas Howard from Cisco has written. You can simply enter your SQL "select" queries on the CLI.

I recommend watching Thomas in action in one of his excellent YouTube videos on Data Connect - you will also get link to his github to download the pysql python script.

If you need some examples of SQL queries to run to extract Accounting data, let me know.

[tw2079]

I will look into this. Thanks Arne!