Hi,
I would like to clarify with a behavior related to the local logs purge settings, as from following link:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01010.html#task_45D4F2EFA1D9486093DFD2F3B44AC165
We are using the “local Log Storage Period” and “Delete Logs Now” settings, but the logs are not removed. Based on several trials into the GUI, we are observing that the logs are deleted only if the storage is full. Otherwise the logs are not deleted.
Based on that, the question is: Using the above local logs settings, is it true that local log is not removed until the log space reach the threshold?
From the admin guide I understand that when you set a purge time, or especially if you use the setting “Delete Logs Now”, it should delete the logs, independently from the storage space.
The concern come from the need to delete all the Guest information from ISE every X days. We know this is possible thanks to the "Schedule purge of expired guest accounts”, but in the following admin guide (https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01110.html#ID1242) is well explained that "When expired guest accounts are purged, the associated endpoints and reporting and logging information are retained”.
This is the reason why we are looking for the local logs purge settings, because of the need to automatically delete ALL the Guest info in ISE, also the reporting and logging Guest information.
Thanks in advance for your support.
