Cisco Ise 13 User Guide

DescriptionField
Priorityvalueofthemessage;a
combinationofthefacilityvalueand
theseverityvalueofthemessage.
Priorityvalue=(facilityvalue*8)+
severityvalue.SeeSetSeverityLevels
forMessageCodesforsecuritylevels.
Thefacilitycodevalidoptionsare:
•LOCAL0(Code=16)
•LOCAL1(Code=17)
•LOCAL2(Code=18)
•LOCAL3(Code=19)
•LOCAL4(Code=20)
•LOCAL5(Code=21)
•LOCAL6(Code=22;default)
•LOCAL7(Code=23)
pri_num
Cisco Identity Services Engine Administrator Guide, Release 1.3    
205
Cisco ISE System Logs 

DescriptionField
Dateofthemessagegeneration,
accordingtothelocalclockofthe
originatingCiscoISEserver,inthe
formatYYYYMmmDDhh:mm:ss.
Possiblevaluesare:
•YYYY=Numericrepresentation
oftheyear.
•Mmm=Representationofthe
month—Jan,Feb,Mar,Apr,
May,Jun,Jul,Aug,Sep,Oct,
Nov,Dec.
•DD=Numericrepresentationof
thedayofthemonth.For
single-digitdays(1to9),aspace
precedesthenumber.
•hh=Thehouroftheday—00to
23.
•mm=Theminuteofthe
hour—00to59.
•ss=Thesecondofthe
minute—00to59.
Somedevicesendmessagesthat...

DescriptionField
UniquemessageID;1to4294967295.
ThemessageIDincreasesby1with
eachnewmessage.MessageIDs
restartat1eachtimetheapplication
isrestarted.
msg_id
Totalnumberofsegmentsinalog
message.Longmessagesaredivided
intomorethanonesegment.
Thetotal_segdependsonthe
MaximumLengthsettingin
theremoteloggingtargets
page.SeeRemoteLogging
TargetSettings.
Note
total_seg
Segmentsequencenumberwithina
message.Usethisnumbertodetermine
whatsegmentofthemessageyouare
viewing.
seg_num...

•Accounting
•ExternalMDM
•PassiveID
•PostureandClientProvisioningAudit
•PostureandClientProvisioningDiagnostics
•Profiler
Logsofthefollowingcategoriesaresentbyallnodesinthedeploymenttotheloggingtargets:
•AdministrativeandOperationalAudit
•SystemDiagnostics
•SystemStatistics
Cisco ISE Message Codes
Aloggingcategoryisabundleofmessagecodesthatdescribeafunction,aflow,orausecase.InCiscoISE,
eachlogisassociatedwithamessagecodethatisbundledwiththeloggingcategoriesaccordingtothelog...

Cisco ISE Message Catalogs
YoucanusetheMessageCatalogpagetoviewallpossiblelogmessagesandthedescriptions.Choose
Administration>System>Logging>MessageCatalog.
TheLogMessageCatalogpageappears,fromwhichyoucanviewallpossiblelogmessagesthatcanappear
inyourlogfiles.Thedataavailableinthispagearefordisplayonly.
Debug Logs
Debuglogscapturebootstrap,applicationconfiguration,runtime,deployment,monitoring,reporting,and
publickeyinfrastructure(PKI)information.Criticalandwarningalarmsforthepast30daysandinfoalarms...

TheDebugLogConfigurationpagedisplaysalistofcomponentsbasedontheservicesthatarerunningin
theselectednodeandthecurrentloglevelthatissetfortheindividualcomponents.
Step 3Selectthecomponentforwhichyouwanttoconfigurethelogseveritylevel,andthenclickEdit.Choosethe
desiredlogseveritylevelfromtheLogLeveldrop-downlist,andclickSave.
Changingthelogseverityleveloftheruntime-AAAcomponentchangestheloglevelofits
subcomponentprrt-JNIaswell.Achangeinsubcomponentlogleveldoesnotaffectitsparent
component.
Note
Endpoint Debug...

Collection Filters
YoucanconfiguretheCollectionFilterstosuppressthesyslogmessagesbeingsenttothemonitoringand
externalservers.ThesuppressioncanbeperformedatthePolicyServicesNodelevelsbasedondifferent
attributetypes.Youcandefinemultiplefilterswithspecificattributetypeandacorrespondingvalue.
Beforesendingthesyslogmessagestomonitoringnodeorexternalserver,CiscoISEcomparesthesevalues
withfieldsinsyslogmessagestobesent.Ifanymatchisfound,thenthecorrespondingmessageisnotsent.
Configure Collection Filters...

CiscoISEcapturestheseconfigurationchangesintheChangeConfigurationAuditReport.Thisreportprovides
informationonwhoconfiguredaneventsuppressionorabypasssuppressionandthedurationoftimefor
whichtheeventwassuppressedorthesuppressionbypassed.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
212
Collection Filters 

CHAPTER 12
Backup and Restore Operations
•BackupDataType,page213
•BackupandRestoreRepositories,page213
•On-DemandandScheduledBackups,page215
•CiscoISERestoreOperation,page220
•ExportAuthenticationandAuthorizationPolicyConfiguration,page226
•SynchronizePrimaryandSecondaryNodesinaDistributedEnvironment,page226
•RecoveryofLostNodesinStandaloneandDistributedDeployments,page226
Backup Data Type
CiscoISEallowsyoutobackupdatafromthePrimaryPANandfromtheMonitoringnode.Backupcanbe
donefromtheCLIoruserinterface....

•SFTP
•NFS
•CD-ROM
•HTTP
•HTTPS
Repositoriesarelocaltoeachdevice.Note
Werecommendthatyouhavearepositorysizeof10GBforsmalldeployments(100endpointsorless),
100GBformediumdeployments,and200GBforlargedeployments.
Note
Create Repositories
YoucanusetheCLIandGUItocreaterepositories.WerecommendthatyouusetheGUIduetothefollowing
reasons:
•RepositoriesthatarecreatedthroughtheCLIaresavedlocallyanddonotgetreplicatedtotheother
deploymentnodes.TheserepositoriesdonotgetlistedintheGUI’srepositorypage....