cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1821
Views
15
Helpful
1
Replies

ISE Profiler & Passed Authentications Logs

Dolevha
Level 1
Level 1

Hey,

I want to understand when each of the ISE logs categories Profiler & Passed Authentication occur.

I assume the Passed Authentications occur every new authentication of an endpoint, but I don't quite understand how ISE decides whether to write a Profiler log for an authentication.

I looked into it and Passed Authentications has much more records, while the Profiler has very few records, and is written once every 10 minutes. I do see the same device getting the same attributes in the profiler log over and over again, without getting a new profile.

 

Can anyone help me with that?

Thanks in advance,

Dolev

1 Accepted Solution

Accepted Solutions

thomas
Cisco Employee
Cisco Employee

A "passed authentication" happens when a user or endpoint successfully authenticate.
I don't understand exactly which logs you are referring - Maybe you are viewing logs from the CLI? Please specify which ones. Provide examples.

Unclear what your profiled endpoint types are and how they may be different from what you are expecting.

See How to Ask The Community for Help  for the next post.

 

View solution in original post

1 Reply 1

thomas
Cisco Employee
Cisco Employee

A "passed authentication" happens when a user or endpoint successfully authenticate.
I don't understand exactly which logs you are referring - Maybe you are viewing logs from the CLI? Please specify which ones. Provide examples.

Unclear what your profiled endpoint types are and how they may be different from what you are expecting.

See How to Ask The Community for Help  for the next post.