The policy administration nodes (PANs) and monitoring and troubleshooting nodes (MnTs) have a concept of primary and secondary nodes, but they operate very differently.
Let’s start with the easiest one first, the MnT. As you know, the MnT node is responsible for the logging and reporting functions of ISE. All PSNs send their logging data to the MnT as Syslog messages (UDP/20514).
When two monitoring nodes exist in an ISE deployment, all ISE nodes send their audit data to both MnTs at the same time. The logging flows between the ISE nodes is illustrated in Figure 21-8.