topic Re: User accounting in IPS in Network Security https://community.cisco.com/t5/network-security/user-accounting-in-ips/m-p/785946#M85805 <HTML><HEAD></HEAD><BODY><P>From the CLI:</P><P># show event status past 23:59 | include loginAction</P><P></P><P>I'm not sure how you'd go back farther without using the IDM (in the IDM you can tell it to show entire log buffer).</P></BODY></HTML> Fri, 07 Sep 2007 21:30:17 GMT mhellman 2007-09-07T21:30:17Z User accounting in IPS https://community.cisco.com/t5/network-security/user-accounting-in-ips/m-p/785944#M85803 <P>Hello,</P><P></P><P>Is there a way that one can see who and when has logged into the IPS device for a given period of time?</P> Sun, 10 Mar 2019 10:46:39 GMT https://community.cisco.com/t5/network-security/user-accounting-in-ips/m-p/785944#M85803 rnaydenov 2019-03-10T10:46:39Z Re: User accounting in IPS https://community.cisco.com/t5/network-security/user-accounting-in-ips/m-p/785945#M85804 <HTML><HEAD></HEAD><BODY><P>The IPS device maintains a log of all events (including who has logged). However if there are lot of events happening the entries in the log gets replaced fast. You can see this log using command "show log" on the IPS device. The IPS cannot be used with Radius or TACACS for authentication or authorization.</P></BODY></HTML> Fri, 07 Sep 2007 17:08:45 GMT https://community.cisco.com/t5/network-security/user-accounting-in-ips/m-p/785945#M85804 amritpatek 2007-09-07T17:08:45Z Re: User accounting in IPS https://community.cisco.com/t5/network-security/user-accounting-in-ips/m-p/785946#M85805 <HTML><HEAD></HEAD><BODY><P>From the CLI:</P><P># show event status past 23:59 | include loginAction</P><P></P><P>I'm not sure how you'd go back farther without using the IDM (in the IDM you can tell it to show entire log buffer).</P></BODY></HTML> Fri, 07 Sep 2007 21:30:17 GMT https://community.cisco.com/t5/network-security/user-accounting-in-ips/m-p/785946#M85805 mhellman 2007-09-07T21:30:17Z