cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1005
Views
0
Helpful
1
Replies

%WAAS-UNKNOWN-6-899999

sameer.shah
Level 1
Level 1

Hi

In WAE log we found below messages

config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting after command is executed (logging host 10.11.4.20 priority information)

07-17-2011          16:15:08          User.Info          10.10.170.71          2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.

07-17-2011          16:15:08          User.Info          10.10.170.71          2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting before command is executed (exit)

07-17-2011          16:15:08          User.Info          10.10.170.71          2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.

07-17-2011          16:15:09          User.Info          10.10.170.71          2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Reported an accounting to a remote server

07-17-2011          16:15:09          User.Info          10.10.170.71          2011 Jul 17 16: config: %WAAS-PARSER-6-350232: CLI_LOG log_cli_command: exit

07-17-2011          16:15:09          User.Info          10.10.170.71          2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting after command is executed (exit)

07-17-2011          16:15:09          User.Info          10.10.170.71          2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.

07-17-2011          16:15:09          User.Info          10.10.170.71          2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting after command is executed (conf  t)

07-17-2011          16:15:09          User.Info          10.10.170.71          2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.

07-17-2011          16:15:10          User.Info          10.10.170.71          2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting before command is executed (wr)

07-17-2011          16:15:10          User.Info          10.10.170.71          2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.

07-17-2011          16:15:10          User.Info          10.10.170.71          2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Reported an accounting to a remote server

07-17-2011          16:15:10          User.Info          10.10.170.71          2011 Jul 17 16: -exec: %WAAS-PARSER-6-350232: CLI_LOG log_cli_command: wr

07-17-2011          16:15:10          User.Info          10.10.170.71          2011 Jul 17 16: sshd: %WAAS-UNKNOWN-6-899999: ReportExecAccounting

07-17-2011          16:15:10          User.Info          10.10.170.71          2011 Jul 17 16: sshd: %WAAS-UNKNOWN-6-899999: Report exec shell accounting after command is executed

What these means?

Is there any unknown user trying to execute some commands? The same is reflecting as security warning in TACACS reports.

Regards

Sameer Shah

1 Reply 1

Bhavin Yadav
Cisco Employee
Cisco Employee

Hi Sameer,

What is this ip address in logs: 10.10.170.71?

Further, can you also post the sh ver output from WAAS?

Regards.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: