ISE 5238 Endpoint authentication problem was fixed

[MichelB]

Is there a way to suppress the ISE messages " 5238 Endpoint authentication problem was fixed" as the message itself is misleading?  Most common this message from ISE in the live log is letting you know that the Endpoint is removed from the automatic ISE suppression log as it failed for some reason multiple authentication attempts. 

thanks in advance

Michel

[balaji.bandi]

what ISE version ? what end device ?

have you checked below thread may help you :

https://community.cisco.com/t5/network-access-control/5238-endpoint-authentication-problem-was-fixed/td-p/3461702

[MichelB]

I Adjust the Anomalous Client Suppression on ISE timers ( https://community.cisco.com/t5/security-knowledge-base/configuring-anomalous-client-suppression-on-ise/ta p/3161437#:~:text=same%20failure%20reason.-,Configuration,be%20reported%20every%20Reporting%20Interval )

This in order to dampen the false postitives that something was fixed whiled it was not broken in the first place.

[adamscottmaster2013]

I can confirm that the problem was fixed in ISE version 3.0 patch-3 on my system but it comes back in my ISE 3.2 patch-4 system.