cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
385
Views
0
Helpful
2
Replies

ISE logging and Reports

Eman.Bakri
Beginner
Beginner

Hi all,

How to download complete log for long period (eg: 30 days) for all endpoints activities in Cisco ISE, as in Active log only 24 hours log is appear?

 

Thanks.

 

1 Accepted Solution

Accepted Solutions

Greg Gibbs
Cisco Employee
Cisco Employee

You can gather some historical data using ISE Reports but there is limited customisation depending on what information you are looking for. ISE is not itself ideal for historical log retention and reporting so it is recommended to send event and health logs to an external syslog server (like Splunk) to provide log retention and historical reporting.

View solution in original post

2 Replies 2

Greg Gibbs
Cisco Employee
Cisco Employee

You can gather some historical data using ISE Reports but there is limited customisation depending on what information you are looking for. ISE is not itself ideal for historical log retention and reporting so it is recommended to send event and health logs to an external syslog server (like Splunk) to provide log retention and historical reporting.

ammahend
VIP Engager VIP Engager
VIP Engager

Agree with Greg, if you want to give it a shot, configure a repository on ISE and map it to server of your choice.

then go operations>reports>reports>Endpoints and Users>Radius Authentication>logged at (select last 30 days), it will give you a warning (The report may take a long time to run. Would you like to run it in the background instead?) click Yes and point it to your repository on ISE.

-hope this helps-
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers