cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
configure & troubleshoot anyconnect

ACS 5.3 reports only 100 pages of authentication logs and user is unable to see the complete logs

2811
Views
5
Helpful
0
Comments

 

 

Problem

ACS 5.2 shows only 100 pages of logs and so only the logs for few hours is seen and unable to see the log for the entire day. How can we see the log for the entire day without missing them?

Resolution

The ACS 5.x was designed to keep only 100 pages of logs. This unit  generates a lot of information that will saturate the server if  everything is stored in the internal hd, so there is an option to send  these logs to an external Syslog server, this option is located under  System Administration/Log Configuration.

 

Configuring Per-Instance Remote Syslog Targets:

 

Step 1:

Select System Administration > Configuration > Log Configuration > Logging Categories > Per-Instance, then click Configure.

 

Step 2: Perform any one of the following:

 

  • Click the name of the logging category you want to configure.
  • Select the radio button associated with the name of the logging category you want to configure, and click Edit.

 

 

Step 3: Click the Remote Syslog Target tab.

 

  • Available targets: List of available targets. You can select a target from this list and move it to the Selected Targets list.
  • Selected targets: List of selected targets. You can select a target from this list and move it to the Available Targets list to remove it from your configuration.

 

Displaying Logging Categories

 

Step 1

Select System Administration > Configuration > Log Configuration > Logging Categories > Per-Instance, and click Configure.

 

Step 2: After clicking on Configure you need to complete the following enteries.

 

  • Name Expandable tree structure of AAA services logging categories.
  • Edit  Click to display a selected Logging Categories > Edit: "lc_name" page, where lc_name is the name of the logging category

 

 

 

There are two changes related to this logging functionality in ACS 5.4:

  1. Even though report generated can still only be of 100 pages, there is an  option for the user to export the report to CSV file and include records more than the content of 100 pages.
  2. User can generate the report based on timestamp as well. So can reduce the  granularity of each set of data and retrieve / view the data in smaller  chunks.

Refer to Exporting Report Data for more information about the ability to export report data to an Excel  spreadsheet as a comma-separated values (.csv) file, pipe-separated  values (.psv) file, or a tab-separated values (.tsv) file.

 

Refrence

Source:https://supportforums.cisco.com/thread/2182193?tstart=0

Configuring Per-Instance Remote Syslog Targets