ISE live logs not logging after patch

[terry.johnson2]

Hello

   On ISE 2.3 VM and after installing patch 1 the live logs tacac or radius are no longer updating.  all authentications still works but no logs, also system summery dashboard show No Data Available for all nodes.  Did the patch break something or should I have to reset something.

[Mohammed al Baqari]

What happens if you rollback? Is it still the same.

[terry.johnson2]

Yes we rolled it back and the issue remained. We then reinstalled the patch same issue.

[ciscoworlds]

I had this problem on ISE 2.2 and upgraded to patch 5 and it worked again. But interestingly enough, prior to this upgrade, I had changed the Radius Live Log Refresh interval to something else and installing patch at the first place did not resolve that issue! Then I accidentally changed another refresh interval and it started to work again! I know this seems so strange but it is what it is!!

[craiglebutt]

Hi

Did you get this sorted?

Have the same issue, wasn't working on 2.2, applied patch 7 still not working.

Have tried the refresh which someone said, but that is only showing 2 devices, when there is over 9k of devices on here.

I've spun up another vm of same version for test, that works, compared settings, all the same.

Just wondered if and how you sorted?

Cheers

[ciscoworlds]

Hi;
As I said, I changed the Refresh Interval and it started to show the entries again! That's strange but you can try it.

[craiglebutt]

Hi

I've tried that several times, but no look

cheers

[joshuabuelayap]

We have the same issue on ISE 2.3 VM but on our case we didn't do any upgrade but suddenly TACACs live logs also failed to update as well as the system summary dashlet. We tried to restart application services and it worked for a while then the problem showed again. Any update on this issue?

[craiglebutt · Accepted solution]

HI,

I've still waiting for TAC to come back, sent screen shots.

What they asked me to do was reset the M&T Database on both monitor node and let them rebuild as shown corruption.  but I'm still not receiving logs from PSN.

[pn2020]

Hi,

Are there ERS logs (deleting, update, post operations, for example, via API) on the ISE?  

I can't see them on ISE's operations tab.

Thanks,

Peter

[Greg Gibbs · Accepted solution]

The Live Logs mainly include RADIUS or TACACS+ session information. The logs you are looking for would be found in the Operations > Reports > Audit section (e.g. Change Configuration Audit).

[pn2020]

I saw the logs. Thanks so much Greg!

[Monica Rev]

We are also experiencing the same issue on ISE 2.7 when we installed patch 9. Any news on the solution for this?

[Charlie Moreton]

Resurrecting a 2-year old + thread that has an accepted solution limits the number of people that will take a look at it. The best thing to do is to start a new thread.

[ahollifield]

https://www.adamhollifield.com/2022/09/fix-cisco-ise-messaging-service.html