Cisco ISE App/Add-On

[plao]

Looking at the Cisco ISE App/Add_On

The logging level is by default set to debug

I cannot find a file which shows me debug logs for this TA?

/var/log/splunk does not have any specific file for ISE and in /splunk/etc/apps/Splunk_TA as well, there is no file for logs?

Thanks!

[livehybrid · Accepted solution]

Hi @plao 

The config you've shown shows that it uses a UDP input, therefore I would not expect to see any ISE specific log sources in your logs.

Is there any issue that you are experiencing that you need additional debug logs for?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[plao]

Hi

We are working on a Cisco Sec+Splunk course, using the new Cisco Security Cloud App as well as coverage for the old apps like the Cisco ISE App/Add-on. In this course, we have a troubleshooting section, so for ISE, just checking if there are any ISE logs in Splunk for troubleshooting the App/Add-On

Thanks!

[plao]

Thanks .. I only see from SNA app 

[plao]

[plao]

[plao]

Hi 

https://splunkbase.splunk.com/app/1589

https://splunkbase.splunk.com/app/1915

The app and add-on .. thanks

[Cievo]

Have look at this DOCUMENTATION PAGE. Debugging logs should be send into _internal index. Look at that index.

[Cievo]

Are you talking about this APP?

If so, I don't think is application has it's own debugging log file.