topic Re: AAA Accounting report not showing commands issued. in Network Access Control

AAA Accounting report not showing commands issued.

paulhowlett_2 — Sun, 10 Mar 2019 21:54:24 GMT

Hello all, I am having trouble with AAA accounting on my ACS appliance 4.0. When I view the accounting log it lists connections, protocols and IP addresses but not the commands that have been run on the particular switch. When I do debug AAA accounting I do see ouput but when I debug Tacacs accounting I don't see anything. An exammple of my config is:

aaa new-model

aaa group server tacacs+ ACS

server [ip addresss here]

aaa accounting exec default start-stop group ACS

aaa accounting commands 0 start-stop group ACS

aaa accounting commands 15 start-stop group ACS

tacacs-server key [key here].

I've left out the authentication part of the config (on the above example) as this is working fine.

Anyone any ideas why the actual commands are not being captured on the ACS?

Thanks in advance.

Re: AAA Accounting report not showing commands issued.

royalblues — Fri, 05 Jan 2007 18:01:42 GMT

Hi Paul,

Make sure you have the following commands under the vty interfaces of the devices

line vty 0 4

accounting connection

accounting commands 1

accounting commands 15

accounting exec

HTH, rate if it does

Narayan

Re: AAA Accounting report not showing commands issued.

network.king — Sat, 06 Jan 2007 13:30:58 GMT

Can u include the default under the accounting commands and check

aaa accounting commands 15 default start-stop group ACS

Hope this helps

regards

vanesh k

Re: AAA Accounting report not showing commands issued.

paulhowlett_2 — Mon, 08 Jan 2007 14:43:45 GMT

Hi, I've entered the commands (on a Catalyst 4948)but they [commands] don't show in the config.

I have also entered the 'default' command as suggested too. Still nothing under the 'cmd', 'cmd-arg'or 'event' in the ACS appliance Accounting log.

Thanks.

Re: AAA Accounting report not showing commands issued.

mstannard — Tue, 09 Jan 2007 11:05:36 GMT

In ACS, the Command Accounting is logged to the TACACS+ Administration log not the TACACS+ Accounting log! Don't ask me why, it just is. At least it is on mine and took me a while to discover as well.

Hope this helps

Regards

Mike

Re: AAA Accounting report not showing commands issued.

mstannard — Tue, 09 Jan 2007 11:18:42 GMT

Hope this helps

Regards

Mike

Re: AAA Accounting report not showing commands issued.

paulhowlett_2 — Tue, 09 Jan 2007 15:53:04 GMT

You are spot on! I expected it to be in the accounting log but - the obvious place I would have thought. Thank you.