Hi
In WAE log we found below messages
config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting after command is executed (logging host 10.11.4.20 priority information)
07-17-2011 16:15:08 User.Info 10.10.170.71 2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.
07-17-2011 16:15:08 User.Info 10.10.170.71 2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting before command is executed (exit)
07-17-2011 16:15:08 User.Info 10.10.170.71 2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.
07-17-2011 16:15:09 User.Info 10.10.170.71 2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Reported an accounting to a remote server
07-17-2011 16:15:09 User.Info 10.10.170.71 2011 Jul 17 16: config: %WAAS-PARSER-6-350232: CLI_LOG log_cli_command: exit
07-17-2011 16:15:09 User.Info 10.10.170.71 2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting after command is executed (exit)
07-17-2011 16:15:09 User.Info 10.10.170.71 2011 Jul 17 16: config: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.
07-17-2011 16:15:09 User.Info 10.10.170.71 2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting after command is executed (conf t)
07-17-2011 16:15:09 User.Info 10.10.170.71 2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.
07-17-2011 16:15:10 User.Info 10.10.170.71 2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Report accounting before command is executed (wr)
07-17-2011 16:15:10 User.Info 10.10.170.71 2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: SendReport: Unknown Remote Host address due to console login.
07-17-2011 16:15:10 User.Info 10.10.170.71 2011 Jul 17 16: -exec: %WAAS-UNKNOWN-6-899999: ReportCommandsAccounting: Reported an accounting to a remote server
07-17-2011 16:15:10 User.Info 10.10.170.71 2011 Jul 17 16: -exec: %WAAS-PARSER-6-350232: CLI_LOG log_cli_command: wr
07-17-2011 16:15:10 User.Info 10.10.170.71 2011 Jul 17 16: sshd: %WAAS-UNKNOWN-6-899999: ReportExecAccounting
07-17-2011 16:15:10 User.Info 10.10.170.71 2011 Jul 17 16: sshd: %WAAS-UNKNOWN-6-899999: Report exec shell accounting after command is executed
What these means?
Is there any unknown user trying to execute some commands? The same is reflecting as security warning in TACACS reports.
Regards
Sameer Shah
