ISE not retrieving radius live logs

[MaErre21325]

Hi all,

i'm running a phisycal SNS-3655-K9 with version 3.1 and patch5.
Randomly when i go under radius live logs tab no logs are shown, the page is blank and only showing "fetching records" and keeps stuck in this status (sometimes i've to wait 20 min to see logs other time nothing is shown).
Other times instead the page is working quiet correctly.
I don't have any "Queue Link Error" on the dashboard and the checkbox "ISE Messaging Service" for UDP Syslogs delivery to MnT" is enabled.
If i disabled it logs are shown, may i open a tac to understand this behaviour?
What is the consequence of unchecking this box?

Thank you
Regards

[balaji.bandi]

is this issue after any patch or just started working one not getting logs ?

on the dashboard and the checkbox "ISE Messaging Service" for UDP Syslogs delivery to MnT" is enabled. - If i disabled it logs are shown - Looks that is fix offered

i am running 3.X and enable and works as expected :

check this post :

https://community.cisco.com/t5/network-access-control/ise-2-6-alarm-quot-queue-link-error-quot/td-p/3846992/page/2

[Rodrigo Diaz]

by disabling the checkbox you are not longer going to be sending the syslog to the MNT nodes through TCP 8671 and the ISE messaging certificates but you are going to be sending logs through UDP 20514, the problem that you mention could be a problem of communication, review this video to check some points of the ISE messaging service https://www.youtube.com/watch?v=Ty46Wpzvwv8

let me know if that helped you. 

[MaErre21325]

Hi @Rodrigo Diaz,

the video was very useful, i don't have any Queue Link Errors so ise messages service and internal CA certificates should be ok.
what it's strange is that some times its work and some times not, i expected it shouldn't work at all.
However by unchecking the "ISE Messaging Service" for UDP Syslogs delivery to MnT" seems to work properly at the moment.

[Arne Bier]

Yes. It’s sad that Cisco wanted to improve the message delivery by implementing this feature but the actual way they implemented it is nothing short of terrible. It’s something the average user should not have to worry about but this breaks all the time. 
I would still consider giving it a go - regent internal CA. 

[Arne Bier]

Usually regenerating the ISE Messaging Certificate fixes this. It's not service affecting. And if that doesn't do it, then I regenerate the entire internal ISE CA - also not service affecting, UNLESS, you have already issued certs using the internal CA - check first!

[MaErre21325]

Hi @Arne Bier ,

i'm using an external CA to sign my certificates, i'll try what you suggested