After many tests, the result ...
There are 3 Events that triggers at a certain threshold level when messages for a specific Node has queued up beyond a safe level. They are triggered based on the Pending Messages and how long an ISE Node is not consuming replicated messages:
. INFO greater than 15K totalPendingMsgCount & greater than 15 min totalTimeDiffInMinutes
. WARNING greater than 20K totalPendingMsgCount & greater than 15 min totalTimeDiffInMinutes
. ERROR greater than 40K totalPendingMsgCount & greater than 15 min totalTimeDiffInMinutes
You are able to check this info at PAN CLI using the following command:
ise/admin# show logging application deployment.log
...
2022-09-22 10:49:37,031 INFO [Deployment-RegistrationPoller][] cpm.infrastructure.deployment.notifier.NodeChangeLogger -::::- Sequence details for host <PSN HOSTNAME> replicationStatus[SYNC COMPLETED] primarySequenceCount[784116890] primaryTimeInMins[27730909] currentTimeInMins[27730909] firstUnconsumedPrimarySeqTime[ 27730874] secondarySequenceCount[784064628] secondaryTimeInMins[27730909] totalPendingMsgCount[52262] totalTimeDiffInMinutes [35]
...
2022-09-22 10:49:37,115 INFO [Deployment-RegistrationPoller][] cpm.infrastructure.deployment.notifier.NodeChangeLogger -::::- Slow replication Critical level alarm will be generated for host <PSN Hostname>
message : Node <PSN Hostname> has slow replication since this node is not consuming messages for past 35 minutes. The number of pending messages are 52262
...
Note: you are able to check the INFO, WARNING and ERROR at ISE GUI Alarms, but at ISE CLI the reference are INFO, WARN and CRITICAL, for ex.:
...
Inside logAuditMessages to raise slow replication alarm with level [CRITICAL] for node [<PSN Hostname>]
...
Inside logAuditMessages to raise slow replication alarm with level [WARN] for node [<PSN Hostname>]
...
Inside logAuditMessages to raise slow replication alarm with level [INFO] for node [<PSN Hostname>]
...
Hope this helps !!!
