Configure Grafana Monitoring for Cisco ISE Syslog Traffic
Available Languages
Monitoring dashboard in Cisco ISE
Create Grafana dashboard variables
Route alerts to a contact point
Appendix A: Alert configuration file
Monitoring dashboard in Cisco ISE
Use this guide to configure a rolling 24-hour syslog volume gauge, a daily count and capacity panel, a 30-day trend, and warning alerts within Grafana. Once these components are configured, you can view the resulting insights directly on the Cisco ISE Monitoring dashboard (Operations > System 360 > Monitoring > Grafana). This configuration allows Cisco ISE administrators to monitor Grafana-related syslog traffic on a daily basis.
This dashboard allows a Cisco ISE user to select Cisco SNS hardware and a Large, Medium, or Small deployment. The daily capacity equals 24 times the value in the supplied hardware table.
Grafana alert rules cannot read the Monitoring dashboard dropdown selections.
The 21 supplied rules therefore check every supported hardware and deployment limit for every Cisco Cisco ISE node. A warning may appear for a lower-capacity combination even when the dashboard is set to different hardware. To alert only against the hardware installed on each node, configure a host-to-hardware mapping or use a data source that includes that information.
The source table gives a supported syslog count for each hardware and deployment pair. Multiply each supported number by 24 to get the daily limit used by the gauge and alerts.
Table 1. Daily syslog limits by Cisco SNS hardware and deployment size
| Hardware type |
Large per day |
Medium per day |
Small per day |
| Cisco SNS 3595 |
12,000,000 |
480,000 |
480,000 |
| Cisco SNS 3615 |
Unsupported |
300,000 |
300,000 |
| Cisco SNS 3715 |
Unsupported |
1,800,000 |
600,000 |
| Cisco SNS 3815 |
Unsupported |
1,800,000 |
600,000 |
| Cisco SNS 3655 |
12,000,000 |
600,000 |
600,000 |
| Cisco SNS 3755 / 3855 |
18,000,000 |
3,600,000 |
1,200,000 |
| Cisco SNS 3695 |
48,000,000 |
1,200,000 |
1,200,000 |
| Cisco SNS 3795 / 3895 |
48,000,000 |
3,600,000 |
1,200,000 |
Example: Cisco SNS 3595 Large is 500,000 × 24 = 12,000,000 syslogs per day. Cisco SNS 3615 Large, SNS 3715 Large, and SNS 3815 Large are unsupported.
Ensure that these prerequisites are met to successfully set up the Grafana dashboard.
· Grafana 12.4.x or a compatible Grafana release. Menu labels below follow the format of Grafana 12.4.4.
· A Prometheus data source that provides the syslog-count metric shown in the copy or paste queries. The dashboard uses the job label to identify each Cisco ISE node. The Host dropdown also uses ise_uname_info if available; otherwise use the fallback query below. The metric name is a required Grafana identifier and must be copied exactly.
· Edit permissions for the Monitoring dashboard so that you can install the alert file.
· Administrator access to the Grafana server and permission to restart or reload Grafana.
· A contact point already configured if you want notifications delivered. Contact point integrations and credentials are environment-specific.
Create Grafana dashboard variables
Open the Grafana dashboard to edit, select Dashboard settings > Variables. Add the three variables from Table 2. If the dashboard already has a Host variable named job, keep it as is, and skip the third row.
Table 2. Grafana dashboard variable settings
| Dashboard variable |
Type and settings |
Options or query |
| Hardware Type |
Custom |
Cisco SNS 3595 : 1, Cisco SNS 3615 : 2, Cisco SNS 3715 : 3, Cisco SNS 3815 : 4, Cisco SNS 3655 : 5, Cisco SNS 3755 / 3855 : 6, Cisco SNS 3695 : 7, Cisco SNS 3795 / 3895 : 8 |
| Deployment |
Custom |
Large : 1, Medium : 2, Small : 3 |
| Host |
Query |
label_values(ise_mnt_collector_syslog_stats,job) |
For each Custom variable, paste the full options string exactly as shown. Keep the numeric values because the daily maximum query uses them. For the Host query variable, use the Prometheus query editor and set the variable name to job. If the syslog-count metric does not provide the host list in your environment, use this fallback query:
label_values(ise_uname_info,job)
Add a row named Daily Syslog Volume. Place the gauge and stat panel beside each other, then add the trend panel in the same row. Use the same Prometheus data source for every Prometheus query.
Paste this expression into the Prometheus query editor wherever the selected daily maximum is required. It returns the selected hardware/deployment limit in syslogs per day. Unsupported combinations return 0.
sum((vector($hardware_code) == bool 1) * (vector($deployment_code) == bool 1) * 12000000 +
(vector($hardware_code) == bool 1) * (vector($deployment_code) == bool 2) * 480000 +
(vector($hardware_code) == bool 1) * (vector($deployment_code) == bool 3) * 480000 +
(vector($hardware_code) == bool 2) * (vector($deployment_code) == bool 2) * 300000 +
(vector($hardware_code) == bool 2) * (vector($deployment_code) == bool 3) * 300000 +
(vector($hardware_code) == bool 3) * (vector($deployment_code) == bool 2) * 1800000 +
(vector($hardware_code) == bool 3) * (vector($deployment_code) == bool 3) * 600000 +
(vector($hardware_code) == bool 4) * (vector($deployment_code) == bool 2) * 1800000 +
(vector($hardware_code) == bool 4) * (vector($deployment_code) == bool 3) * 600000 +
(vector($hardware_code) == bool 5) * (vector($deployment_code) == bool 1) * 12000000 +
(vector($hardware_code) == bool 5) * (vector($deployment_code) == bool 2) * 600000 +
(vector($hardware_code) == bool 5) * (vector($deployment_code) == bool 3) * 600000 +
(vector($hardware_code) == bool 6) * (vector($deployment_code) == bool 1) * 18000000 +
(vector($hardware_code) == bool 6) * (vector($deployment_code) == bool 2) * 3600000 +
(vector($hardware_code) == bool 6) * (vector($deployment_code) == bool 3) * 1200000 +
(vector($hardware_code) == bool 7) * (vector($deployment_code) == bool 1) * 48000000 +
(vector($hardware_code) == bool 7) * (vector($deployment_code) == bool 2) * 1200000 +
(vector($hardware_code) == bool 7) * (vector($deployment_code) == bool 3) * 1200000 +
(vector($hardware_code) == bool 8) * (vector($deployment_code) == bool 1) * 48000000 +
(vector($hardware_code) == bool 8) * (vector($deployment_code) == bool 2) * 3600000 +
(vector($hardware_code) == bool 8) * (vector($deployment_code) == bool 3) * 1200000)
1. Add a gauge visualization titled Daily Traffic (% of Hardware Capacity). Set the query editor to Code mode.
2. Query A is the received count. Turn Instant on.
sum(sum_over_time(ise_mnt_collector_syslog_stats{job="$job"}[1d]))
3. Add Query B. Paste the daily maximum query above and append ` > 0` after the closing parenthesis. Turn Instant on. The comparison filters out unsupported combinations, so the gauge shows no data instead of a misleading percentage.
4. Add an Expression query of type Math with Ref ID C and expression:
$A / $B * 100
5. Choose C as the displayed field. Set Unit to Percent (0-100), Min to 0, Max to 100, and Decimals to 1. Set Gauge thresholds to Absolute with these steps: green at 0, yellow at 90, and red at 95. The gauge turns yellow at 90% and red at 95%. Traffic can exceed 100% of the selected capacity.
1. Add a stat visualization titled Daily Count and Maximum Syslogs per day. Add two Instant Prometheus queries using the expressions below. Set each query legend to the stated name.
Query A — Legend: Received (last 24h)
sum(sum_over_time(ise_mnt_collector_syslog_stats{job="$job"}[1d]))
Query B — Legend: Maximum Syslogs Per day. Paste the daily maximum query above exactly as shown.
2. Set Unit to Short and Decimals to 0. Add a Value mapping so value 0 displays Unsupported. This makes unsupported combinations visible while the gauge remains empty.
1. Add a time series visualization titled Daily Received Traffic (rolling 24 hours). Use a range query, not Instant, and set the panel time range to 30d with a minimum interval of 1d.
sum(sum_over_time(ise_mnt_collector_syslog_stats{job="$job"}[1d]))
2. Set Unit to Short, Decimals to 0, and the legend to Received syslogs (rolling 24h). Each point is the sum over the preceding 24 hours, evaluated once per day.
The alert configuration file in Appendix A creates 21 Grafana warning rules. Each rule is named for one supported hardware/deployment pair and compares the rolling 24-hour total against that pair’s daily capacity. The query groups by job so each Cisco ISE node is evaluated separately.
1. In Grafana, open Connections > Data sources.
2. Open the Prometheus data source used by this dashboard. Copy its UID from the data source page URL, which ends in /datasources/edit/<UID>.
3. Copy the full Appendix A block into a UTF-8 file named ise-daily-syslog-alerts.yaml. Replace every occurrence of PROMETHEUS_DATASOURCE_UID with the UID from step 1. Do not include angle brackets around the UID.
4. Install the file in Grafana’s alert configuration directory. For a standard Linux package, use /etc/grafana/provisioning/alerting. For Docker, mount the file or its parent directory at /etc/grafana/provisioning/alerting inside the Grafana container.
sudo install -d -m 0755 /etc/grafana/provisioning/alerting
sudo install -m 0644 ise-daily-syslog-alerts.yaml /etc/grafana/provisioning/alerting/ise-daily-syslog-alerts.yaml
sudo systemctl restart grafana-server
For Docker, restart the Grafana container after the file is mounted.
Use the container name and restart command used by your installation. Grafana creates the folder ISE Daily Syslog Volume Alerts and evaluates the rule group every minute.
The rules warn only when received syslogs are greater than the daily maximum. This setup has no 25 percent critical threshold. All rules are independent of the dashboard variables.
Route alerts to a contact point
Create or choose the destination first under Alerting > Contact points.
To route only this dashboard’s alerts, open Alerting > Notification policies and create a child policy under Default policy with the following matcher. Select the desired contact point and save.
Table 3. Notification policy matcher
| Matcher field |
Operator |
Value |
| grafana_folder |
= |
ISE Daily Syslog Volume Alerts |
This folder match keeps the route scoped to these rules. A matcher of grafana_folder =~ .+ routes every Grafana alert with a folder label to the contact point; use that only when you intend broader routing. Rules created directly in a data source may be routed by a separate Alertmanager and are not changed by this policy.
Use this section to verify th Grafana dashboard alerts.
Table 4. Dashboard and alert checks
| Check |
Expected result |
| Dashboard controls |
Hardware Type, Deployment, and Host appear above the panels. |
| Capacity math |
SNS 3795 / 3895 Large shows a maximum of 48,000,000 per day. SNS 3595 Medium shows 480,000. |
| Unsupported choice |
SNS 3615 Large, SNS 3715 Large, and SNS 3815 Large show Unsupported and no gauge value. |
| Alert rules |
Alerting, Alert rules shows 21 alert rules in the ISE Daily Syslog Volume Alerts folder. |
| Notification route |
The child policy lists grafana_folder = ISE Daily Syslog Volume Alerts and the selected contact point. |
Use this section to troubleshoot some common issues while working with Grafana.
Table 5. Common symptoms and checks
| Symptom |
Check |
| Every panel shows no data |
Confirm the selected Host matches the node name shown in the Prometheus data, and that the selected time range includes samples. |
| Maximum shows 0 or Unsupported |
Check both numeric variable values. Confirm the deployment and hardware codes match the option strings. |
| Alert rules show datasource errors |
Replace PROMETHEUS_DATASOURCE_UID everywhere, verify that UID belongs to the Prometheus source, and check Grafana logs. |
| Several hardware warnings fire for one host |
This is expected because the 21 alert rules check every supported hardware/deployment limit for each node. The syslog data does not identify the installed hardware. Use a host-to-hardware mapping if only the installed hardware should trigger warnings. |
Appendix A: Alert configuration file
This is a complete alert configuration file for a new installation.
Replace PROMETHEUS_DATASOURCE_UID before installing.
It adds these rules and does not remove existing rules.
apiVersion: 1
groups:
- orgId: 1
name: ise-daily-syslog-volume
folder: ISE Daily Syslog Volume Alerts
interval: 1m
rules:
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 12,000,000 maximum syslogs per day for Cisco SNS 3595,
Large deployment.
summary: Cisco SNS 3595 Large daily syslog volume is above 12,000,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 12000000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3595
deployment: Large
severity: warning
noDataState: OK
title: Cisco SNS 3595 Large daily syslog volume warning
uid: ise_sns3595_large_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 480,000 maximum syslogs per day for Cisco SNS 3595, Medium
deployment.
summary: Cisco SNS 3595 Medium daily syslog volume is above 480,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 480000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3595
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3595 Medium daily syslog volume warning
uid: ise_sns3595_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 480,000 maximum syslogs per day for Cisco SNS 3595, Small
deployment.
summary: Cisco SNS 3595 Small daily syslog volume is above 480,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 480000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3595
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3595 Small daily syslog volume warning
uid: ise_sns3595_small_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 300,000 maximum syslogs per day for Cisco SNS 3615, Medium
deployment.
summary: Cisco SNS 3615 Medium daily syslog volume is above 300,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 300000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3615
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3615 Medium daily syslog volume warning
uid: ise_sns3615_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 300,000 maximum syslogs per day for Cisco SNS 3615, Small
deployment.
summary: Cisco SNS 3615 Small daily syslog volume is above 300,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 300000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3615
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3615 Small daily syslog volume warning
uid: ise_sns3615_small_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 1,800,000 maximum syslogs per day for Cisco SNS 3715,
Medium deployment.
summary: Cisco SNS 3715 Medium daily syslog volume is above 1,800,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 1800000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3715
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3715 Medium daily syslog volume warning
uid: ise_sns3715_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 600,000 maximum syslogs per day for Cisco SNS 3715, Small
deployment.
summary: Cisco SNS 3715 Small daily syslog volume is above 600,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 600000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3715
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3715 Small daily syslog volume warning
uid: ise_sns3715_small_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 1,800,000 maximum syslogs per day for Cisco SNS 3815,
Medium deployment.
summary: Cisco SNS 3815 Medium daily syslog volume is above 1,800,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 1800000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3815
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3815 Medium daily syslog volume warning
uid: ise_sns3815_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 600,000 maximum syslogs per day for Cisco SNS 3815, Small
deployment.
summary: Cisco SNS 3815 Small daily syslog volume is above 600,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 600000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3815
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3815 Small daily syslog volume warning
uid: ise_sns3815_small_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 12,000,000 maximum syslogs per day for Cisco SNS 3655,
Large deployment.
summary: Cisco SNS 3655 Large daily syslog volume is above 12,000,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 12000000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3655
deployment: Large
severity: warning
noDataState: OK
title: Cisco SNS 3655 Large daily syslog volume warning
uid: ise_sns3655_large_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 600,000 maximum syslogs per day for Cisco SNS 3655, Medium
deployment.
summary: Cisco SNS 3655 Medium daily syslog volume is above 600,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 600000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3655
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3655 Medium daily syslog volume warning
uid: ise_sns3655_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 600,000 maximum syslogs per day for Cisco SNS 3655, Small
deployment.
summary: Cisco SNS 3655 Small daily syslog volume is above 600,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 600000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3655
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3655 Small daily syslog volume warning
uid: ise_sns3655_small_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 18,000,000 maximum syslogs per day for Cisco SNS 3755
/ 3855, Large deployment.
summary: Cisco SNS 3755 / 3855 Large daily syslog volume is above 18,000,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 18000000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3755 / 3855
deployment: Large
severity: warning
noDataState: OK
title: Cisco SNS 3755 / 3855 Large daily syslog volume warning
uid: ise_sns3755_3855_large_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 3,600,000 maximum syslogs per day for Cisco SNS 3755 /
3855, Medium deployment.
summary: Cisco SNS 3755 / 3855 Medium daily syslog volume is above 3,600,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 3600000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3755 / 3855
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3755 / 3855 Medium daily syslog volume warning
uid: ise_sns3755_3855_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 1,200,000 maximum syslogs per day for Cisco SNS 3755 /
3855, Small deployment.
summary: Cisco SNS 3755 / 3855 Small daily syslog volume is above 1,200,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 1200000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3755 / 3855
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3755 / 3855 Small daily syslog volume warning
uid: ise_sns3755_3855_small_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 48,000,000 maximum syslogs per day for Cisco SNS 3695,
Large deployment.
summary: Cisco SNS 3695 Large daily syslog volume is above 48,000,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 48000000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3695
deployment: Large
severity: warning
noDataState: OK
title: Cisco SNS 3695 Large daily syslog volume warning
uid: ise_sns3695_large_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 1,200,000 maximum syslogs per day for Cisco SNS 3695,
Medium deployment.
summary: Cisco SNS 3695 Medium daily syslog volume is above 1,200,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 1200000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3695
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3695 Medium daily syslog volume warning
uid: ise_sns3695_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 1,200,000 maximum syslogs per day for Cisco SNS 3695,
Small deployment.
summary: Cisco SNS 3695 Small daily syslog volume is above 1,200,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 1200000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3695
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3695 Small daily syslog volume warning
uid: ise_sns3695_small_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 48,000,000 maximum syslogs per day for Cisco SNS 3795
/ 3895, Large deployment.
summary: Cisco SNS 3795 / 3895 Large daily syslog volume is above 48,000,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 48000000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3795 / 3895
deployment: Large
severity: warning
noDataState: OK
title: Cisco SNS 3795 / 3895 Large daily syslog volume warning
uid: ise_sns3795_3895_large_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 3,600,000 maximum syslogs per day for Cisco SNS 3795 /
3895, Medium deployment.
summary: Cisco SNS 3795 / 3895 Medium daily syslog volume is above 3,600,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 3600000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3795 / 3895
deployment: Medium
severity: warning
noDataState: OK
title: Cisco SNS 3795 / 3895 Medium daily syslog volume warning
uid: ise_sns3795_3895_medium_daily
- annotations:
description: Daily traffic for {{ $labels.job }} is above the 1,200,000 maximum syslogs per day for Cisco SNS 3795 /
3895, Small deployment.
summary: Cisco SNS 3795 / 3895 Small daily syslog volume is above 1,200,000 syslogs.
condition: A
data:
- datasourceUid: PROMETHEUS_DATASOURCE_UID
model:
datasource:
type: prometheus
uid: PROMETHEUS_DATASOURCE_UID
editorMode: code
expr: sum by (job) (sum_over_time(ise_mnt_collector_syslog_stats[1d])) > 1200000
instant: true
intervalMs: 1000
maxDataPoints: 43200
refId: A
refId: A
relativeTimeRange:
from: 86400
to: 0
execErrState: Error
for: 1m
labels:
hardware_type: Cisco SNS 3795 / 3895
deployment: Small
severity: warning
noDataState: OK
title: Cisco SNS 3795 / 3895 Small daily syslog volume warning
uid: ise_sns3795_3895_small_daily
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)