Symptom

Live logs are not seen on ISE and after restart of services, work for 10-15 mins before failing again.The Primary MNT node is SNS-3595, and the problem appears to be due to MNT unable to handle to tacacs authentication and accounting load. Following TACACS Log collection alarms are seen repeatedly - 5196:2018-10-31 13:47:23,702 ERROR [AcsSyslog store] cisco.mnt.collection.syslog.AcsSyslogCollectionFailure: SQLException sent to the Collection Failure Alarm by Collector : Log collection error : Server=ISE; Log Type=TacacsAccounting 5213:2018-10-31 13:47:23,702 ERROR [AcsSyslog store] cisco.mnt.collection.syslog.AcsSyslogCollectionFailure: SQLException sent to the Collection Failure Alarm by Collector : Log collection error : Server=ISE; Log Type=TacacsAccounting

Conditions

Using predominantly tacacs authentication and accounting

Workaround

Disable tacacs accounting logging category to log into logcollector (MNT) - this resolves the issue Restart of services or clearing MNT buffers only helps for sometime.

Further Problem Description