topic Re: Exclude specific user from ACS logging ? in Network Access Control

Exclude specific user from ACS logging ?

yvon_delgrange — Sun, 10 Mar 2019 23:59:23 GMT

Hi,

My customer and I are looking for a way to exclude actions/commands logging on AAA servers (ACS) for a single specific user, though logging still goes on for other users as AAA clients on networks devices have been configured with:

aaa accounting commands start-stop tacacs+

I have not found any solution up to now, either on the ACS side, either on the IOS side and aaa commands.

(Though it looks like a potential security issue), can anyone advise?

Thanks for your cooperation.

Yvon.

Re: Exclude specific user from ACS logging ?

jedubois — Thu, 04 Mar 2010 18:50:14 GMT

Yvon,

No you can not exclude a single user from logging. Accounting is a global command.

I take it you probably have a script that is generating a large amount of logging data?

--Jesse

Re: Exclude specific user from ACS logging ?

yvon_delgrange — Fri, 05 Mar 2010 16:38:08 GMT

Jesse,

Thanks for the confirmation.

I do not really know what is behind this request, but I'll try to understand.

I guess for for this time, we'll live with this situation.

Thanks again. Yvon.

Re: Exclude specific user from ACS logging ?

jrabinow — Sun, 07 Mar 2010 07:43:46 GMT

ACS 5.1 has the concept of collection filters which I think can do what you are looking for

See: http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/viewer_sys_ops.html#wp1072344

Re: Exclude specific user from ACS logging ?

yvon_delgrange — Thu, 11 Mar 2010 08:43:05 GMT

Thanks for pointing that out to me. I will have a closer look at this feature.