dc recent :: Domus Digitalis

Synopsis

netapi ise dc recent [OPTIONS]

Description

Query recent RADIUS authentication events from the live log. Shows individual authentication attempts with timestamps, MACs, results, and NAS devices. Perfect for real-time monitoring and troubleshooting.

Options

Option Default Description

Option	Default	Description
`--hours`, `-h`	`1`	Hours to look back
`--limit`, `-l`	`50`	Maximum records to return
`--status`, `-s`	`all`	Filter: `all`, `passed`, `failed`
`--mac`, `-m`	(none)	Filter by specific MAC address

--hours, -h

1

Hours to look back

--limit, -l

50

Maximum records to return

--status, -s

all

Filter: all, passed, failed

--mac, -m

(none)

Filter by specific MAC address

Need to filter by username/identity? Not yet supported. Workaround:

netapi ise dc recent --hours 4 | grep "username"
netapi ise dc users --hours 24 | grep "username"

Future enhancement: --user filter.

Use the global --format flag at the dc level:

netapi ise dc --format json recent

Usage

# Last hour, all authentications
netapi ise dc recent

# Last 4 hours
netapi ise dc recent --hours 4

# Only successful authentications
netapi ise dc recent --status passed

# Only failures
netapi ise dc recent --status failed

# Filter by specific MAC
netapi ise dc recent --mac 3C:EC:EF:43:50:42

# Combine filters
netapi ise dc recent --hours 8 --status failed --limit 20

Sample Output

Recent Authentications (Last 1 Hour)
────────────────────────────────────────────────────────────────────────
Time                 MAC                Status   Username         NAS
────────────────────────────────────────────────────────────────────────
2026-01-23 10:45:12  00:50:C2:39:F0:F7  PASS     jsmith@corp.com  10.50.1.10
2026-01-23 10:44:33  70:15:FB:F8:47:EC  PASS     workstation$     10.50.1.40
2026-01-23 10:43:21  14:F6:D8:7B:31:80  FAIL     14:F6:D8:7B:...  10.50.1.10
2026-01-23 10:42:15  3C:EC:EF:43:50:42  PASS     drshahab@chla    10.50.1.10

Use Cases

Real-Time Monitoring

# Watch authentications as they happen (refresh every 30s)
watch -n 30 'netapi ise dc recent --hours 0.5 --limit 10'

Troubleshooting a Device

# All auth attempts for a specific MAC
netapi ise dc recent --mac 3C:EC:EF:43:50:42 --hours 24

# Just failures for that MAC
netapi ise dc recent --mac 3C:EC:EF:43:50:42 --status failed

Quick Failure Check

# Any failures in the last hour?
netapi ise dc recent --status failed

Exporting for Analysis

# Export to JSON for processing
netapi ise dc --format json recent --limit 500 > auths.json