ISE Profiler & Passed Authentications Logs

[Dolevha]

Hey,

I want to understand when each of the ISE logs categories Profiler & Passed Authentication occur.

I assume the Passed Authentications occur every new authentication of an endpoint, but I don't quite understand how ISE decides whether to write a Profiler log for an authentication.

I looked into it and Passed Authentications has much more records, while the Profiler has very few records, and is written once every 10 minutes. I do see the same device getting the same attributes in the profiler log over and over again, without getting a new profile.

Can anyone help me with that?

Thanks in advance,

Dolev

[thomas · Accepted solution]

A "passed authentication" happens when a user or endpoint successfully authenticate.
I don't understand exactly which logs you are referring - Maybe you are viewing logs from the CLI? Please specify which ones. Provide examples.

Unclear what your profiled endpoint types are and how they may be different from what you are expecting.

See How to Ask The Community for Help  for the next post.