topic Re: Administrator Command Accounting Pix 515 in Network Security https://community.cisco.com/t5/network-security/administrator-command-accounting-pix-515/m-p/520336#M498834 <HTML><HEAD></HEAD><BODY><P>Hi Hermondoz, Thank you for that speedy response. Helps me a lot! </P></BODY></HTML> Fri, 28 Jul 2006 06:02:16 GMT nojpt 2006-07-28T06:02:16Z Administrator Command Accounting Pix 515 https://community.cisco.com/t5/network-security/administrator-command-accounting-pix-515/m-p/520334#M498832 <P>Hi,</P><P></P><P>Is there a way to log firewall admin commands being issued at the firewall? Like for example, sending it to a TACACS+ server?</P><P></P><P>Thanks for the help.</P> Fri, 21 Feb 2020 09:04:39 GMT https://community.cisco.com/t5/network-security/administrator-command-accounting-pix-515/m-p/520334#M498832 nojpt 2020-02-21T09:04:39Z Re: Administrator Command Accounting Pix 515 https://community.cisco.com/t5/network-security/administrator-command-accounting-pix-515/m-p/520335#M498833 <HTML><HEAD></HEAD><BODY><P>Hello noipt,</P><P></P><P>Command accounting can be configured ONLY in PIX v7.x. Also, it looks like that only non-show commands will be sent. </P><P></P><P>Per the command reference </P><P>To send accounting messages to the TACACS+ accounting server when you enter any command other than show commands at the CLI, use the aaa accounting command command in global configuration mode. </P><P>aaa accounting command </P><P><A class="jive-link-custom" href="http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/cmd_ref/a1_711.htm#wp1428200" target="_blank">http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/cmd_ref/a1_711.htm#wp1428200</A> </P><P></P><P>For version 6.x, </P><P>Authentication and Command Authorization for PIX 6.2 </P><P><A class="jive-link-custom" href="http://www.cisco.com/warp/public/110/pix_command.shtml#accounting" target="_blank">http://www.cisco.com/warp/public/110/pix_command.shtml#accounting</A> </P><P></P><P>There is no actual command accounting available, but by having syslog activated on the PIX, you can see what actions were performed, as shown in this example: </P><P></P><P>307002: Permitted Telnet login session from 172.18.124.111 </P><P>111006: Console Login from pixtest at console </P><P>611103: User logged out: Uname: pixtest </P><P>307002: Permitted Telnet login session from 172.18.124.111 </P><P>111006: Console Login from pixtest at console </P><P>502103: User priv level changed: Uname: pixtest From: 1 To: 15 </P><P>111008: User 'pixtest' executed the 'enable' command. </P><P>111007: Begin configuration: 172.18.124.111 reading from terminal </P><P>111008: User 'pixtest' executed the 'configure t' command. </P><P>111008: User 'pixtest' executed the 'write t' command. </P><P></P><P></P><P>Hope this helps! If so, please rate. </P><P></P><P>Thanks </P><P></P><P></P></BODY></HTML> Fri, 28 Jul 2006 03:29:28 GMT https://community.cisco.com/t5/network-security/administrator-command-accounting-pix-515/m-p/520335#M498833 hemendoz 2006-07-28T03:29:28Z Re: Administrator Command Accounting Pix 515 https://community.cisco.com/t5/network-security/administrator-command-accounting-pix-515/m-p/520336#M498834 <HTML><HEAD></HEAD><BODY><P>Hi Hermondoz, Thank you for that speedy response. Helps me a lot! </P></BODY></HTML> Fri, 28 Jul 2006 06:02:16 GMT https://community.cisco.com/t5/network-security/administrator-command-accounting-pix-515/m-p/520336#M498834 nojpt 2006-07-28T06:02:16Z