Is it possible that ISE can filter logs, on basis of any particular parameters and send to three to four different syslog servers?

[fkaleem]

Hi All,

Can some let me know if Is it possible that ISE can filter logs, on basis of any particular parameters and send to three to four different syslog servers? Purpose is to send only relevant logs to each different department of the customer using a shared ISE Taacacs+ infrastructure.  Thanks

[hslai · Accepted solution]

ISE can send syslog to different targets based on logging categories. See Configure Remote Syslog Collection Locations

However, ISE can't send syslog based on criteria such as network devices. I would suggest to have ISE send to a centralized syslog server first, and then some app or script(s) on that syslog server to parse and to forward to a desired syslog target.

[fkaleem]

Many thanks Hslai for your excellent assistance. Faheem