ACS 5.4 CLI logging

[webstert]

I need to be able to see login and logoff of the admin to the ACS 5.4 CLI.  I would like remote syslog message anytime someone uses ssh to the ACS server CLI. 

I currently have have remote logging enabled and have tried both 6-inform and 7-debug loglevels.

logging 192.x.x.x

logging loglevel 7

The only message I see on my syslog server that suggests a login of the "admin" user is the following.

Jun 13 21:30:54 acsservername debugd[13478]: [14209]: utils: cars_shellcfg.c[118] [admin]: Invoked carsGetConsoleConfig

And I see no message that the admin user logged off.

I've tried enabling "debug all" and I can see the logged in users via "show users" but I need some sort of log message so I can track and audit the log in attempts.  It would also be nice to  see password failure attempts which I don't see either.

Am I missing something?  Can the CLI of ACS 5.4 be configured to log this information? 

Thanks

Tony

[Richard Atkin]

What I think you're after is the ACS's "ACSManagementAudit.log" file which is stored in /opt/CSCOacs/logs/ and accessed via the "show ACS-logs" CLI command. This should show you all ACS GUI and CLI Admin Activities...



Sent from Cisco Technical Support iPad App