ISE 3.1 - Configuration Changed: Admin=internal-feed-user;

[jvujcich]

Hi all,

Several weeks ago, we upgraded from ISE 2.6 to 3.1p4.

Over the weekend (Sunday and Monday at approx. 1:10am) we got hundreds of emailed alerts like this:

Configuration Changed: Admin=internal-feed-user; Object Type=OUI; Object Name=00:01:C8

Description :

ISE configuration is updated

Severity :

Info

Suggested Actions :

Check if the configuration change is expected

*** This message is generated by Cisco Identity Services Engine (ISE) ***

Sent By Host : nzvaxxxxxx

What is this "internal-feed-user" (It's not a user that I know of) and what is it configuring?

[Greg Gibbs · Accepted solution]

That would be related to the Profiler Feed Service.

[jvujcich]

Thanks Greg.

[kaihyu]

this log is the notification , not the error .

and it means your ISE enable the Feed service automatically update. 

Cisco ISE downloads policies and OUI database updates every day at 1:00 A.M of the local Cisco ISE server time zone. Cisco ISE automatically applies these downloaded feed server policies.

You can verify whether this feature is enabled by navigating to ISE Work Centers > Profiler > Feeds.
checkbox : Enable Online Subscription Update

Here you can check this internal user audi , Operations > Reports > Audit > Change configuration audit.