Questions about logs and API

[ckli]

Hi Experts,

   Our customer has asking some questions about the ISE as below:

1. How can the customer run the accounting report(per IP address) over 30days? For example, the customer just can get "last 30 days" data of RADIUS accounting from report. 

2. Does our API support policy deployment? The customer need some tasks automatically.

[Arne Bier · Accepted solution]

Good question.  I never thought about this - also makes me wonder how that impacts the Data Retention Period settings below.  I always thought that this was set to the maximum number of days that you would run a report on. But if reports are only up to 30 days, then one might want to purge anything older than 30 days too, and not 90?

I know the answer to question 2: No support for Policy Set configuration via REST API.  Others have also asked for this. Seems like a reasonable request.  Cisco will tell you to speak to your account team or to submit a Feedback request via the ISE GUI

[ckli]

Hi Arne，

   Thanks for your prompt response! For question 1, I tried to change the Data Retention Period to 90 days. 

The max time range of the report is still "last 30 days". Is there a way to have a custom time range of the report?

[Arne Bier]

Let's see if any of the ISE TME's can comment on that.  You can try reaching out internally to Jason Kunst (ISE TME) and then reply on this forum

[Damien Miller]

I've forgot what the reporting GUI looks like now pre 2.4, but you can run custom date range reports greater than 30 days from the reporting section in 2.4, it would just depend on the radius retention policy you included a screen shot of.  The drop down gives the canned longest option for last 30 days, but custom is there. 

If there was a hard requirement for data like this I would build a SQL server to store the information.  Export it daily from ISE on a schedule and automatically import it in to a SQL DB.  You could build a web app on top of it much easier.

[Arne Bier]

@Damien Miller

I increased my retention from the default 30 days to 60 days, but I still don't see an option for custom.

Do you have that option in ISE 2.4 ?  I am on patch 3

My system was originally built with 2.2 and upgraded to 2.3 and now 2.4.  Sometimes upgrades cause corruption.

[Damien Miller · Accepted solution]

It's not very intuitive, hit the advanced filter.

[Arne Bier]

ISE is clearly not idiot proof :-(

thanks for the tip!