cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2809
Views
0
Helpful
1
Replies

Cisco ISE and external syslog server

Kashish_Patel
Level 2
Level 2

Hi Security Experts,

We are starting with deploying cisco ISE (Identity Services Engine) in our network. We have allocated 250GB space for (Admin+Monitor) ISE node.

I want to know if we can send the logs from monitoring node to external syslog server after a defined time interval.

For example, logs which are more than 10 days old should be sent to external syslog server. So basically our monitoring node will have logs which are at the max 9 days old. Is it possible? Could you point me to some doc which explains configuration of the same?

Thanks,

Kashish

1 Accepted Solution

Accepted Solutions

Tarik Admani
VIP Alumni
VIP Alumni

No this isnt possible via syslog. What you are looking for is database purging, so that the monitoring database is purged after a specific time interval. Here is a guide that will help shed some light on this:

http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_mnt.html#wp1054328

Tarik Admani
*Please rate helpful posts*

View solution in original post

1 Reply 1

Tarik Admani
VIP Alumni
VIP Alumni

No this isnt possible via syslog. What you are looking for is database purging, so that the monitoring database is purged after a specific time interval. Here is a guide that will help shed some light on this:

http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_mnt.html#wp1054328

Tarik Admani
*Please rate helpful posts*

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: