ISE logging and Reports

[Eman.Bakri]

Hi all,

How to download complete log for long period (eg: 30 days) for all endpoints activities in Cisco ISE, as in Active log only 24 hours log is appear?

Thanks.

[Greg Gibbs · Accepted solution]

You can gather some historical data using ISE Reports but there is limited customisation depending on what information you are looking for. ISE is not itself ideal for historical log retention and reporting so it is recommended to send event and health logs to an external syslog server (like Splunk) to provide log retention and historical reporting.

[ammahend]

Agree with Greg, if you want to give it a shot, configure a repository on ISE and map it to server of your choice.

then go operations>reports>reports>Endpoints and Users>Radius Authentication>logged at (select last 30 days), it will give you a warning (The report may take a long time to run. Would you like to run it in the background instead?) click Yes and point it to your repository on ISE.