cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

334
Views
0
Helpful
2
Replies
Highlighted
Beginner

ISE Logging to a syslog (user login 802.1x)

Dear community,

I trying to figure out how I can ensure the messages I get in the section Operations > Authentications goes to a syslog.

I tried several severity and messages from Admin > Logging > Logging Categories

But I'm not able to get when someone auth with his IP / MAC and the associated details...same goes when he is not able to auth...

In ISE I can clearly see that coming with full details but no way to have that redirected to a syslog...

I someone able to help me out with this?

thanks a million

Everyone's tags (5)
2 REPLIES 2
Highlighted
Beginner

ISE Logging to a syslog (user login 802.1x)

I found the solution,

It was under :

Failed Attempts

Passed Authentications

And a bit of patience :-)

Highlighted
Participant

ISE Logging to a syslog (user login 802.1x)

closing the loop on this for the rest of the list.  a few relevant bugs have been posted on this subject against 1.2.  first one is mine:

[FEATURE REQUEST] normalize and distill syslog export feeds for SIEMs

http://cdetsweb-prd.cisco.com/apps/dumpcr?identifier=CSCum23641

ISE syslog messages should be consistent

http://cdetsweb-prd.cisco.com/apps/dumpcr?identifier=CSCul99532


  doc Local Store and Syslog Message Format

http://cdetsweb-prd.cisco.com/apps/dumpcr?identifier=CSCui61280