Cisco Ise 13 User Guide

CHAPTER 25
Monitoring and Troubleshooting
•MonitoringandTroubleshootingServiceinCiscoISE,page625
•DeviceConfigurationforMonitoring,page627
•NetworkProcessStatus,page627
•NetworkAuthentications,page628
•ProfilerActivityandProfiledEndpoints,page628
•TroubleshootingtheProfilerFeed,page629
•PostureCompliance,page629
•CiscoISEAlarms,page630
•LogCollection,page641
•LiveAuthentications,page641
•GlobalSearchforEndpoints,page643
•SessionTraceforanEndpoint,page644
•AuthenticationSummaryReport,page646...

•Troubleshooting—Providescontextualguidanceforresolvingaccessissuesonnetworks.Youcanthen
addressuserconcernsandprovidearesolutioninatimelymanner.
•Reporting—Providesacatalogofstandardreportsthatyoucanusetoanalyzetrendsandmonitorsystem
performanceandnetworkactivities.Youcancustomizereportsinvariouswaysandsavethemforfuture
use.
Cisco ISE Dashboard
TheCiscoISEdashboard,orhomepage(Home>Summary),isthelandingpagethatappearsafteryoulog...

DescriptionProcess Stage
NADperformsanauthorizationorflexauthorization.1
Anunknownagentlessidentityisprofiledwithwebauthorization.2
RADIUSserverauthenticatesandauthorizestheidentity.3
Authorizationisprovisionedfortheidentityattheport.4
Unauthorizedendpointtrafficisdropped.5
User Roles and Permissions for Monitoring and Troubleshooting Capabilities
Monitoringandtroubleshootingcapabilitiesareassociatedwithdefaultuserroles.Thetasksyouareallowed
toperformaredirectlyrelatedtoyourassigneduserrole.
Data Stored...

Monitor Network Process Status
Procedure
Step 1GototheCiscoISEDashboard.
Step 2ExpandtheSystemSummarydashlet.Adetailedreal-timereportappears.
Step 3Reviewthefollowinginformationfortheprocessesthatarerunningonthenetwork:
•Nameoftheprocess
•CPUandmemoryutilization
•Timesinceprocessstartedrunning
Network Authentications
YoucanviewthepassedandfailednetworkauthenticationsfromtheAuthenticationsdashlet.Itprovidesdata...

currentlyactiveonthenetwork.Sparklinemetricsatthetopofthedashletshowtimespecificvaluesforthe
last24hoursand60minutes.
Determine Profiler Activity and Profiled Endpoints
Procedure
Step 1GototheCiscoISEDashboard.
Step 2IntheProfilerActivitydashlet,hoveryourcursoroverastackbarorsparkline.
Atooltipprovidesdetailedinformation.
Step 3Expandthedatacategoriesformoreinformation.
Step 4ExpandtheProfilerActivitydashlet.
Adetailedreal-timereportappears.
Troubleshooting the Profiler Feed...

Check Posture Compliance
Procedure
Step 1GototheCiscoISEDashboard.
Step 2InthePostureCompliancedashlet,hoveryourcursoroverastackbarorsparkline.
Atooltipprovidesdetailedinformation.
Step 3Expandthedatacategoriesformoreinformation.
Step 4ExpandthePostureCompliancedashlet.
Adetailedreal-timereportappears.
Cisco ISE Alarms
AlarmsnotifyyouofcriticalconditionsonanetworkandaredisplayedintheAlarmsdashlet.Theyalso
provideinformationonsystemactivities,suchasdatapurgeevents.Youcanconfigurehowyouwanttobe...

Alarm ResolutionAlarm DescriptionAlarm Name
Checkthenetworkconnectivity
betweenCiscoISEandtherepository.
Ensurethat:
•Thecredentialsusedforthe
repositoryiscorrect.
•Thereissufficientdiskspacein
therepository.
•Therepositoryuserhaswrite
privileges.
TheISEbackupoperationfailed.BackupFailed
ChecktomakesurethattheCA
servicesareupandrunningontheCA
server.
CAserverisdown.CAServerisdown
Anotificationtoinformthe
administratorthattheCAserverisup.
CAserverisup.CAServerisUp
Replacethecertificate.Foratrust...

Alarm ResolutionAlarm DescriptionAlarm Name
Thecertificateisnotvalidonthe
secondarynode,orthereissomeother
permanenterrorcondition.Checkthe
secondarynodeforapre-existing,
conflictingcertificate.Iffound,delete
thepre-existingcertificateonthe
secondarynode,andexportthenew
certificateontheprimary,deleteit,and
importitinordertoreattempt
replication.
Certificatereplicationtosecondarynode
failed
CertificateReplication
Failed
Thecertificatewasnotreplicatedtoa
secondarynodeduetoatemporary...

Alarm ResolutionAlarm DescriptionAlarm Name
ContactCiscoTechnicalAssistance
Centertoobtainfirmwareupdate
Afirmwareupdateisrequiredonthis
host.
FirmwareUpdate
Required
Ensurethataminimumrequirements
fortheVMhost,asspecifiedinthe
CiscoISEHardwareInstallationGuide.
VirtualMachine(VM)resourcessuch
asCPU,RAM,DiskSpace,orIOPSare
insufficientonthishost.
InsufficientVirtual
MachineResources
Thiscouldbebecausethereisalarge
timedifferencebetweenNTPserver
andCiscoISEnode(morethan1000s)....

Alarm ResolutionAlarm DescriptionAlarm Name
Ensurethenetworkconnectivity
betweenCiscoISEandtherepository.
Ensurethatthecredentialsusedforthe
repositoryiscorrect.Ensurethatthe
backupfileisnotcorrupted.Execute
thereset-configcommandfromthe
CLIandrestorethelastknowngood
backup.
CiscoISErestoreoperationfailed.RestoreFailed
Re-installthepatchprocessonthe
server.
Apatchprocesshasfailedontheserver.PatchFailure
-Apatchprocesshassucceededonthe
server.
PatchSuccess
EnsurethattheMDMserverAPI...