topic Tacacs audit logs legacy in Network Access Control

Tacacs audit logs legacy

acapit — Sat, 30 Dec 2023 17:17:38 GMT

Hello,
I'm trying to enable audit logs on my network device and when I configure the following command I get a warning message
1. aaa accounting commands
2. aaa accounting exec
I get a message that says "Hidden command. Use of this command is not recommended/supported will be removed in the future" (message code "PARSER-5-HIDDEN")
What should I use instead?

Any thoughts?

Re: Tacacs audit logs legacy

M02@rt37 — Sat, 30 Dec 2023 19:57:12 GMT

Hello @acapit

For aaa accounting in cisco devices, the recommended and supported commands are associated with specific accounting methods (e.g., "start-stop," "stop-only") and accounting lists. The exact syntax may vary based on your specific device and IOS version...

Basic example using "aaa accounting" with the "start-stop" method for command accounting:

aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

First command, log the start and stop of EXEC session to the device. When the user logged in and when the user logged out. Total time spent.

The second command, log all the commands executed by the user, that are at privilege level 15.

Re: Tacacs audit logs legacy

MHM Cisco World — Sat, 30 Dec 2023 20:01:37 GMT

Can I see all aaa config

MHM

Re: Tacacs audit logs legacy

acapit — Sat, 30 Dec 2023 20:36:14 GMT

I know that as I said when I configure the following commands I get a warning

"Hidden command. Use of this command is not recommended/supported will be removed in the future" (message code "PARSER-5-HIDDEN"),

Do you have any other solution?

Re: Tacacs audit logs legacy

M02@rt37 — Sat, 30 Dec 2023 20:40:30 GMT

Please share your aaa configuration

Re: Tacacs audit logs legacy

MHM Cisco World — Sat, 30 Dec 2023 20:56:12 GMT

aaa accounting commands visible-keys

try this

Re: Tacacs audit logs legacy

acapit — Sat, 30 Dec 2023 21:18:43 GMT

Sadly I cannot share with you my configuration due to my company policy.

Re: Tacacs audit logs legacy

acapit — Sat, 30 Dec 2023 21:18:56 GMT

Sadly I cannot share with you my configuration due to my company policy.

Re: Tacacs audit logs legacy

MHM Cisco World — Sat, 30 Dec 2023 21:26:31 GMT

aaa accounting commands visible-keys

Try using this command to see command without mask

Re: Tacacs audit logs legacy

balaji.bandi — Sat, 30 Dec 2023 21:34:50 GMT

we see same message when we using Cat 9300 its bug - CSCuc32663

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-3/configuration_guide/sec/b_173_sec_9300_cg/configuring_authorization.html