ANNOUNCEMENT - The community will be down for maintenace this Thursday August 13 from 12:00 AM PT to 02:00 AM PT. As a precaution save your work.
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

896
Views
0
Helpful
4
Replies
Highlighted
Beginner

Log Management

Running ACS 4.2 Solution Engine with a primary/secondary in two different geographical locations. Have a question revolving around log management (or lack of). We have decided to use CSV logging for Failed Attempts. When I configure that report I do not see the log management options under the select columns section. Looking through the configuration guides I found a small blurb stating that it was only available on Windows and remote agent logging. So how does the Solution Engine logging work then? All entries just go into one big file? Does that file at some point over write itself? With CSV logging on the solution engine is there any way to control the logs and frequency of generation? I realize a syslog server would be the better option but do not have the alternative available currently.

Thanks,

Tom

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Contributor

Re: Log Management

Im afraid the SE has a hard coded 10MB rollover limit.

You cant do daily rollover.

Take a look at extraxi aaa-reports! Our csvsync http client can pull down the active (unrolled) log as often as you like and aaa-reports! itself has duplication detection so the same row never gets imported twice.

With that in place it then doesnt matter about lack of management on the ACS server.

Also, as logs eventually do roll they get downloaded by csvsync so you have have backup copies of everything that got logged ready for archiving. This is all easily automated so you can stop thinking about it!

View solution in original post

4 REPLIES 4
Highlighted
Contributor

Re: Log Management

Im afraid the SE has a hard coded 10MB rollover limit.

You cant do daily rollover.

Take a look at extraxi aaa-reports! Our csvsync http client can pull down the active (unrolled) log as often as you like and aaa-reports! itself has duplication detection so the same row never gets imported twice.

With that in place it then doesnt matter about lack of management on the ACS server.

Also, as logs eventually do roll they get downloaded by csvsync so you have have backup copies of everything that got logged ready for archiving. This is all easily automated so you can stop thinking about it!

View solution in original post

Highlighted
Beginner

Re: Log Management

Thank you for your reply. You confirmed what I had suspected.

Tom

Highlighted
Beginner

Re: Log Management

I got the same problem in SE 4.2.

All data are stored in one file and we have to download the file and separate it by date.

Is there any way to achieve the same function as ACS for windows(Generate new file every day)?

Highlighted
Contributor

Re: Log Management

Unfortunately not.

The original ACS appliance had a smallish HDD and I think the choice to hard code log file management came from that which was a shame. extraxi csvsync can be used to grab a daily snapshot of the active logs (in case they are taking days or weeks to rollover) and pull down any new rolled logs.

If you import into extraxi aaa-reports! we offer full de-duping so the same active csv can be imported multiple times with only the newest rows being imported each time.

60 day working trial from http://www.extraxi.com