Queue link error reported

[dgaikwad]

Hi experts,

Last week, we were able to resolve the Queue link error by following steps provided in one of the Communities article.
But, now while investigating logs from syslog servers not able to find the exact error as its mentioned in the alarms settings on ISE.
Is there any specific error code assigned to this message, so that we can capture such alerts in future.

[balaji.bandi]

can you be more explanation what kind of error you looking : is this related ISE device or router or switch ?

ISE Logs below can help with code :

its based on the config :

https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_IntrotoSyslogs.html

https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_SyslogsList.html

[dgaikwad]

This error is reported on ISE nodes. And specifically on the alarms dashboard.
I need to track this down in syslogs so that a certain alarms could be setup for it.
I have gone through the above suggested documentation and there is no information for this error there as well.

Is there any specific way to track alarms that are generated from Alarms settings under Administration -> System -> Settings -> Alarm Settings.

[balaji.bandi]

just to make it clear "Is there any specific way to track alarms that are generated from Alarms "  - you want to send this to syslog ?

what is the version of ISE you running  andf ISE 2.X look at below how you can send logs to syslog server :

https://community.cisco.com/t5/network-access-control/ise-1-3-and-sending-alarms-as-syslog-messages/td-p/3456202

[dgaikwad]

All the alarms from the Alarm settings are logged to syslog.
Is there a way find out what the specific alarm looks like in syslogs? In this case it's the queue link error.

Post investigation through all the logs, I was unable to find such message in syslogs.
So, is the queue link error reported with some different error code?

[balaji.bandi]

what syslog server you using :

if you are sending logs to syslog server byu device.

go to syslog log folder

more ise.log |  grep queue (see what you get )

[dgaikwad]

The logs are being sent to QRadar, and is there a way to find out what format of this error would be on syslog?

[Arne Bier]

Maybe run a tcpdump on the Admin node (and decode the syslog in Wireshark) while provoking/reproducing the alarm - tricky thing is how to reproduce the issue. Perhaps someone on the forum can recommend a trick?

[dgaikwad]

Initially I had thought of capturing using Wireshark, but then was not able to, now since the error has stopped.
I was looking for a way to find it in the syslog server, to investigate what kind of information was sent in the payload.
Thus using that information to create a new alert based on this issue.

[Marcelo Morais]

Hi @dgaikwad ,

 beyond what @balaji.bandi said ...

 You are able to check the Queue Link Error Alarm Settings at Administration > System > Settings > Alarm Settings:

 and also double check if it will Send Syslog Message:

Hope this helps !!!

[dgaikwad]

I am able to see them and verify what alarms are configured from this settings page, my query is, with what format is the above alarm reported in syslogs?
Is there is a specific code that I could refer to so that I could configure an alarm on the syslog server's end.

[thomas · Accepted solution]

Please ask your very specific and detailed question with specific errors and examples when you ask your question to prevent so much back-and-forth from so many people.

See How to Ask The Community for Help for your future questions.

All ISE Syslog Messages may be seen, listed, viewed, filtered and exported from the Message Catalog right next to your Syslog Server settings.

Also on Cisco.com: https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_IntrotoSyslogs.html