Cisco 3650 no radius debug output

[joeharb]

We are deploying dot1x and have noticed that we don't get debug information displayed on more than one cisco 3650.  If I do something like debug ip packet and then term mon I get output, but if I do debug radius accounting or even debug radius and then term mon we get nothing but syslog messages.  

The are both on the 16.X train...one is on 16.9.4

Is there something I am missing, our 4500's display information without issue.

Thanks,

Joe

[Damien Miller]

I've seen this before in a lab and I wasn't exactly sure why it happened. There is an old Cisco Live deck that indicates with ios-xe debug radius won't work, yet I know it can. For what it's worth, I just tried this on 16.9.5 with a 3850 and I added just those two commands, term mon + debug radius. Following that I get the radius debugs for the endpoint.

Now you at least have an alternative. Set this trace.
set platform software trace smd switch active R0 radius debug

View the trace debugs with this command.
show platform software trace message smd switch active r0

[poongarg]

Adding to above:

Due to changes in software architecture starting from IOS-XE version 16.3.2, all AAA components have been moved to separate Linux daemon Session Manager Daemon (SMD), . Ultimate result of this change is that traditional CLI debugs like:

debug radius
debug access-session all
debug dot1x all

do not produce any output during troubleshooting (No output returned in console/terminal/syslog when corresponding destination configured to receive appropriate level of log messages, particularly "debugging" for this example). The reason behind of this is that IOS syslog subsystem is implemented in IOS Daemon (IOSd) which is independent from SMD. 

Table below contains mappings between most common old and new style debugs:

Old style command	New style command
#debug radius	#set platform software trace smd switch active R0 radius debug
#debug dot1x all	#set platform software trace smd switch active R0 dot1x-all debug
#debug access-session all	#set platform software trace smd switch active R0 auth-mgr-all debug
#debug epm all	#set platform software trace smd switch active R0 epm-all debug

[joeharb]

Awesome...thanks so much for the information....one last question...how do turn off the debugging or set it back to default?

Thanks,

Joe

[poongarg]

Classical way of disabling debug using "no debug" of "undebug all" - Traditional no debug commands will be automatically converted in corresponding set platform software trace commands, undebug all will reset all components to their default level.

[Damien Miller]

I've always found this poorly documented, and it's not even a blanket statement that holds true. As mentioned above, debug radius works fine again on a 3850 running 16.9.5 without the need to set the trace. So it's like it went that way, then did a u-turn.