topic configure aaa accounting in Network Access Control

configure aaa accounting

Thomas Schmitt — Mon, 11 Mar 2019 06:30:33 GMT

Please explain these two commands aaa accounting exec default start-stop group SERVER1 aaa accounting commands 15 default start-stop group SERVER1

"Exec accounting” will

Jatin Katyal — Sat, 20 Feb 2016 07:18:13 GMT

"Exec accounting” will capture details about user accessing the shell prompt where you run all the commands & “command accounting” keep track of what commands users execute on a Cisco device. Exec terminal session where you have priv 15. The network server mentioned in EXEC scope when user login and logoff.

AAA resource accounting for start-stop records supports the ability to send a “start” record at each connection setup, followed by a corresponding “stop” record at the connection disconnect. This functionality can be used to manage and monitor wholesale customers from one source of data reporting, such as accounting records

yes that's true aaa accounting commands 15 default start-stop group SERVER1" does accounting only for privilege Level 15 commands. Basically we use 3 commands 0,1 & 15 that covers most of the command accounting. However sometimes if we use custom command accounting then you need to have that level of accounting command configured.

In order to cover all the commands please make sure you have all 3 commands:

aaa accounting commands 0 default start-stop group SERVER1"

aaa accounting commands 1 default start-stop group SERVER1"

aaa accounting commands 15 default start-stop group SERVER1"

Regards,

Jatin

Hello ans thank you very much

Thomas Schmitt — Sat, 20 Feb 2016 18:22:10 GMT

Hello ans thank you very much for exploration

i'm still not sure about EXEC in accounting. -is it just a message, that user XYZ started started/closed exec console?

I have configured "aaa accounting exec", so the entries in "audit s session key" ware created by EXEC accounting?

you can see in first post a screenshot from AAA accounting report on my ACS. -which entries I wouldn't be able to see, if I say "no aaa accounting exec" in order?

thank you

Thomas,

Javier Henderson — Fri, 26 Feb 2016 15:05:22 GMT

Thomas,

"exec accounting" indicates when an exec session starts and stops. If you eliminate exec accounting then ACS won't show the related start and stop events.

Javier Henderson

Cisco Systems