Cisco ACS Appliance and Passed Authentication Logs

john.snock · ‎07-25-2008

I'm seeing something on our ACS appliance logs that looks kind of odd (but it is working fine).

When I look at the "Passed Authentication" logs, the users seem to show up about 3 time a minute (each). Maybe I am missing something, but this seems like some type of over-reporting.

Any ideas why this would be happening? I'm probably missing something obvious, but since I'm new to this I can't find the problem.

Thanks for any suggestions!

slapham · ‎07-30-2008

What version of CSACS are you running? Has this just started happening, or was the problem just identified? It could be a performance issue if in fact everything was reauthenticating every 20 sec. Are all your devices showing up, or just wired or wireless? It could be a slight misconfiguration that could be hard to find. If you have the capability, you might want to capture the traffic going to your CSACS server to see if the authentications are actually happening, or like you mentioned...just reporting issues. I ope this helps.

john.snock · ‎07-31-2008

Hi slapham,

Thanks for your reply!

We are running version4.1(1), Build 23, Patch 5, and this has always been happening.

This ACS box is strictly dedicated to the wireless infrastucture, and is not used for wired users.

I'll take a look at the traffic going to the ACS box. Hopefully, it is just a reporting problem.