CML 2.9 tacplus container - are the TACACS logs viewable?

[Arne Bier]

I launched a tacplus container and it's working great. The tac_plus.conf file contains the line

accounting file = /var/log/tacplus-acct.log

But since this is a container, we don't have access to the file system. Or is there a way to access the logs?

[Jens Albrecht · Accepted solution]

Hello @Arne Bier,

the CML-Team has made it pretty easy to access the logs as they integrated a couple of nice features into the docker support.

You just need to right-click the tacplus docker node and choose 'console'.
The message 'READY' should be displayed and then you see your log entries as soon as you start using the tacacs service.

You can also download the log files onto your pc. Just right-click onto the console-tab of your tacplus container and choose 'Download Console Log'. Once downloaded you can use any editor open the log file.

Furthermore, you can even access the shell on a second line very easily (works on some other containers as well).
Again right-click on the console-tab of your tacplus docker node and choose 'Change Serial' this time, then select 'Serial line 1' to get shell access.

So the CML-Team has put a lot of efforts into making it as easy as possible to work with the docker containers.

HTH!

[Arne Bier]

Thanks Jens. . When you launch tacplus initially, the console is just black (blank). I only realised this later after I clicked on the console again. Might have been helpful to print a little message there, e.g. "TACACS logs below:" 

CML 2.9 is one of the best upgrades in years! Thanks Cisco.

[Jens Albrecht]

You're welcome! Yes, this update is really a huge step forward. Still waiting for the supplemental ISO file to get my hands on the new WLC and ISE node types. They had some problems with the release but it should be online early next week, hopefully on Monday...

[Arne Bier]

I downloaded the refplat-20250718-supplemental-iso.zip which apparently contains the C9800 - but the unzip always produces a 'data error'. Is this what you are referring to as "some problems" ?

I copied the refplat into CML anyway and this is what it complained about

libburn : SORRY : Read start address 5619872s larger than number of readable blocks 5619844
libisofs: FAILURE : Read error occurred with IsoDataSource
xorriso : FAILURE : Cannot read all bytes from ISO file '/virl-base-images/fmcv-7-7-0/Cisco_Secure_FW_Mgmt_Center_Virtual_KVM-7.7.0-91.qcow2'
xorriso : FAILURE : Cannot restore regular file to disk filesystem: '/virl-base-images/fmcv-7-7-0/Cisco_Secure_FW_Mgmt_Center_Virtual_KVM-7.7.0-91.qcow2'
xorriso : SORRY : Restoring failed:  '/virl-base-images/fmcv-7-7-0/Cisco_Secure_FW_Mgmt_Center_Virtual_KVM-7.7.0-91.qcow2' = '/var/lib/libvirt/images/virl-base-images/fmcv-7-7-0/Cisco_Secure_FW_Mgmt_Center_Virtual_KVM-7.7.0-91.qcow2'
...
...
*** Copying failed
*** Not all files have been copied successfully

The C9800 image made it through. But the Splunk image didn't - I will wait for the updated refplat.

[balaji.bandi]

I was told in the WebEx group they uploaded the corrupted ISO image, now they corrected, i could able to download the correct one now.

[Jens Albrecht]

Yes, they mentioned some 'file size problems' so that the supplemental ISO was withdrawn.

They decided to split the image and I just noticed that the new version is now available for download as 2 separate files:

• refplat-20250718-supplemental-iso.zip
• refplat-20250718-ise-iso.zip

So starting to upgrade as soon as the downloads are finished...

[Jens Albrecht]

Quick update.

The supplemental ISO got corrupted during upload to SWC and has been removed again.
They hope to have it back online before the weekend.

[Jens Albrecht]

The updated supplemental ISO is back online and I could successfully copy it into CML without any errors.