ISE TACACS Command Accounting report

[umeshunited]

We have deployed ISE on VM and having version 2.4 patch 6.

I was checking TACACS commands reports that ISE exports. I found that ISE was only showing part of the actual command the user typed.

e.g.

If someone typed "show run | sec tacacs "

ISE would show as "show" in command column and "running-config" in the Command arguments column.

It won't show the command that the user typed in after pipe, "sec tacacs" in this case.

Is there any way I can make ISE reflect it in the report?

[Surendra · Accepted solution]

Hi Umesh,

Whatever a user types with | is neither a command nor an argument. It is a filter that is applied on the output of the combination of the command and the argument that a user enters before the |. So, by design and the concept, show running-config is the only set that is sent for authorization.