ISE live logs no MAB events

[PERI_Admin]

We updated our ISE from 2.1 to 2.6. Update went fine but now we don't see any MAB events in RADIUS live logs anymore.

MAB itself is working fine.

Does someone have an idea what the problem could be?

[Damien Miller]

One of the post upgrade tasks is related to regenerating the ISE root CA. It has been known to prevent logs from working. Do you have no radius live logs, or just mab is missing?

"In case of the following events, you must regenarate the root CA chain:

Changing the domain name or hostname of your PAN or PSN.
Restoring a backup on a new deployment.
Promoting the old Primary PAN to new Primary PAN post upgrade.

To regenerate the root CA chain, choose Administration > System > Certificates > Certificate Management > Certificate Signing Request. Click on Generate Certificate Signing Request (CSR). Select the ISE Root CA in the Certificate(s) will be used for drop-down list. Click on Replace ISE root CA Certificate Chain."

[PERI_Admin]

---

@Damien Miller wrote:
One of the post upgrade tasks is related to regenerating the ISE root CA. It has been known to prevent logs from working. Do you have no radius live logs, or just mab is missing?

---

Thanks for your reply. I did all postupgrade tasks including regenerating the ISE root CA.

The strange thing is that only mab is missing.

[hslai · Accepted solution]

You may "tail" the local logs on PSN by CLI as below and ctrl-C when done.

term len 0
show logging app localStore/iseLocalStore.log tail

By default, Passed Authentications are NOT logged locally. So, we will see Failed Attempts and others. We may enable local logging temporarily at ISE Admin Web UI > Administration > Logging > Logging Categories > Passed Authentications.

Check any collection filters at ISE Admin Web UI > Administration > Logging > Collection Filters.

Also, we may check on the MNT for collector.log and see any obvious errors.

Anything more would need you to engage Cisco TAC to help debugging and analyze.

[PERI_Admin]

Thanks for your help. Enabling "Passed Authentications" logging did the job :-))