05-02-2014 02:41 PM - edited 03-10-2019 09:41 PM
Suppose I'm troubleshooting an issue and only want to display Radius authentication logs related to a certain user or mac-address. How do I do it? When I launch the interactive viewer, all of the handy search buttons are grayed out.
So I thought maybe I was using an unsupported browser. But the ACS 5.5 release notes have a CRAZY list of supported browsers. By CRAZY I mean they list nothing under Windows 7. And very old versions of Firefox for the Mac.
Anyhow, I tried various browsers on both Windows and my Mac and the buttons are always grayed out. Any ideas?
// ACS 5.5 release notes. Here are the supported browsers!
05-03-2014 06:09 PM
You can create collection filters that allow you to filter and drop syslog events that are not used for monitoring or troubleshooting purposes. When you configure collection filters, the Monitoring and Report Viewer does not record these events in the database and thus saves much needed disk space.
For more detail you can see the below link
http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-5/user/guide/acsuserguide/viewer_sys_ops.html#pgfId-1072344
05-05-2014 07:37 AM
Thanks for the response ravsingh!
I think collection filters are an overkill for what I want. I don't want to prevent anything from being recorded in the database. I just want a "display filter" to limit what I see while I'm troubleshooting.
For example, if I want to view all logs related to a particular user or mac address. It seems like something someone would do on a daily basis on ACS. Currently when troubleshooting I have someone try connecting and hit "reload" over and over again and hope I see the corresponding log entries at the top. Of course, with more and more users authenticating against ACS this becomes less likely to work.
There has to be a better way. But all of the filter buttons are grayed out.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: