Security

Hello I have few questions and doubts about logging in ClearPass.

Is it normal that we have logs only from 7 days (14 max)? What we have to do to have longer history about RADIUS logs??

Is anybody know how to decrease logs size? Is there any best practice for that? In chatty envoirment I notice that logs takes something about 50GB per day. Is it normal?

I will be very appreciated for your answers.

 

7 days is the default. Insight can be used for reporting, but if you need
long term logs, it's recommended to export to a SIEM.



In terms of log size, that seems very high. Do you have debugs enabled?

No I don't. All logs levels are set on default (mostly INFO)

Is there any formula or example value showing what logs size is normal.

For example for 100k daily request it will be xxGB?? If you have any example I will be very grateful. 

I would work with TAC first to see why your logs are so high then work with local SE and Clearpass SE and partner to make sure your system is designed correctly for logging.