How to stop Cisco Prime from spamming ISE TACACS logs?

[enzo80]

Cisco Prime keeps spamming TACACS logs with user Authorization every 2 seconds

type: Authorization  message: Device-Administration: Command Authorization succeeded 

[balaji.bandi · Accepted solution]

you do not like that change the audit logs :

https://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-7/admin/guide/bk_CiscoPrimeInfrastructure_3_7_AdminGuide/bk_CiscoPrimeInfrastructure_3_7_AdminGuide_chapter_01000.html

[Rob Ingram]

@enzo80 you could either amend the prime configuration. From ISE itself, you can also configure a collection filter on ISE to suppress messages from certain device ip address, username, mac address or nas ip address. In your instance you'd configure the prime server IP address.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_maintain_monitor.html#ID162