Hello,
for our project we use session information feed from pxGrid. Everythink is ok except session information content.
For some messages, mostly DISCONNECTED status, we receive the same information several times:
We receive this feed from ISE-PIC, 2.4.0.357, patch 9. ISE-PIC is fed by syslog from production ISE.
username and domain details are changed but I can privately provide full logs.
Interestingly all record contain the same timestamp but they are sent at different times. These are kind of "bulk updates" that contain more session objects in one shot.
Also I have observed that the duplicates are sent in 5 minutes interval and I have seen it in other few debugged cases as well:
2020-03-09 15:20:16.1997
delta 1:30 min (if this interval is always 1:30, I cannot prove)
2020-03-09 15:21:36.2273
delta 5 min
2020-03-09 15:26:36.3338
delta 5 min
2020-03-09 15:31:36.4542
I have also confirmed from ISE logs that the objects are for sure sent by ISE.
2020-03-09 15:20:16.1997->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX", "providers": ["Syslog"], "endpointCheckResult": "none", "endpointCheckTime": "2020-03-09T15:20:15.082+01:00", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}]}
2020-03-09 15:21:36.2273->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX, "providers": ["Syslog"], "endpointCheckResult": "none", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}
2020-03-09 15:26:36.3338->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX, "providers": ["Syslog"], "endpointCheckResult": "none", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}
2020-03-09 15:31:36.4542->{"timestamp": "2020-03-09T15:20:15.082+01:00", "state": "DISCONNECTED", "userName": "ppxxx", "callingStationId": "172.17.90.141", "ipAddresses": ["172.17.90.141"], "macAddress": "a0-a4-c5-b1-44-b9", "adNormalizedUser": "ppxxx", "adUserDomainName": "alxx.com", "adUserNetBiosName": "ALXX", "providers": ["Syslog"], "endpointCheckResult": "none", "identitySourcePortStart": 0, "identitySourcePortEnd": 0, "identitySourcePortFirst": 0, "mdmRegistered": false, "mdmCompliant": false, "mdmDiskEncrypted": false, "mdmJailBroken": false, "mdmPinLocked": false}
Is this ISE bug? Or something that we should count with and which has its reason?
Thank you for your help, Martin
