Is it possible to manage data purge in the ise by the percentage of us

[CCC3]

tacacs are being operated through ise.

However, there are a lot of equipment with tacacs linked (about 1,000 units) and live logs are also accumulating that much.

I want to manage the data purge, but I want to classify it by usage, not by period

Is it possible?

[Arne Bier]

Nope - unlike Endpoint Purge, you can only tell ISE how many days of TACACS+ logs you want to retain. Alternative solutions would be to not keep data in ISE for too long, and forward the SYSLOGS events to an external collector (e.g. Graylog/Splunk) that has more control over what to keep.