LicenseTypes Essential license consumed or Advantage license consumed

[adamscottmaster2013]

Environment is ISE 3.2 patch-4.  If I click on the "details" in the livelog page, I can see the type of license is being consumed like "LicenseTypes Essential license consumed." or "LicenseTypes Advantage license consumed."  I set my syslog message maximum size to 8192 but I am not seeing this information in syslog.  Is that expected?  TIA

[Arne Bier · Accepted solution]

Hi @adamscottmaster2013 

If you selected the Logging Categories of "AAA Audit > Passed Authentications" and then send that to your remote SYSLOG server, you'll see that with passed Authentications, there is a LicenseType for each successful authentication:

SYSLOG ending in:

LicenseTypes=1; }    - Essentials License

LicenseTypes=1027; } - Advantage License

[adamscottmaster2013]

Hi @Arne Bier:  Yes, I do have the Logging Categories of "AAA Audit > Passed Authentications" and then send that to remote SYSLOG server.  From there, I performed tcpdump on the ISE node(s) and while I am seeing a lot of syslog messages to the syslog server, none of those messages contains LicenceTypes.  Perhaps I am doing something wrong here.  Any advise?  TIA

Correction:  I did see the "LicenseType=1".  I was looking for Essential and Advantage.  

Thanks again.

Edit again:  In my case, whenever it uses "Advantage License", I see the code 515 instead of 1027.  See below:

21 20:11:20.224377 192.168.12.28 192.168.71.6 Syslog 357 LOCAL6.NOTICE: Nov 27 01:11:20 iseqc002 CISE_Passed_Authentications 0000000076 4 3 Response={UserName=48:25:67:0D:F2:07; User-Name=48-25-67-0D-F2-07; Class=CACS:967B47F9000010776BBA70B2:iseqc002/490106486/95; cisco-av-pair=device-traffic-class=voice; cisco-av-pair=profile-name=Polycom-Device; LicenseTypes=515; },