Cisco ACS - determine who was in a particular device

Steve Coady — Mon, 11 Mar 2019 04:47:32 GMT

Hello

How can I determine who was in a particular device at a specific day/time?

Hi Steve,You can use "query

Jatin Katyal — Fri, 13 Jun 2014 04:30:24 GMT

Hi Steve,

You can use "query and run" inside the tacacs or radius accounting section on ACS 5. The exec accounting provides information about user EXEC terminal sessions (user shells) on the network access server, including username, date, start and stop times, the access server IP address.

If you want to see what changes were made by a specific user then that can only be checked if command accounting is enabled on the Network Access Device. Command accounting provides information about the EXEC shell commands for a specified privilege level that are being executed on a network access server. Each command accounting record includes a list of the commands executed for that privilege level, as well as the date and time each command was executed, and the user who executed it. Remember command accounting is only supported by tacacs+.

Regards,

Jatin Katyal

**Do rate helpful posts**

Jatin Thank you for the reply

Steve Coady — Thu, 19 Jun 2014 17:52:21 GMT

Jatin

Thank you for the reply. My apologies for the delay in providing points!

topic Hi Steve,You can use "query in Network Access Control

Cisco ACS - determine who was in a particular device

Hi Steve,You can use "query

Jatin Thank you for the reply