cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1429
Views
5
Helpful
4
Replies

No data Found TACACS Command Accounting

croonos23
Level 1
Level 1

Has anyone ever seen an issue with ISE 2.4.0 where when you go to the Operations > Reports > My reports > Device Administration > TACACS Command Accounting don't load any data ? Live Sessions has data and Reports show Tacacs Authentications. Any ideas or previous experiences? this service stopped working 2 days ago and I install patch 14 without changes

 

2022-06-16_20h55_23.png

4 Replies 4

Arne Bier
VIP
VIP

TACACS Accounting is a separate type of traffic that has to be enabled on the NAD. It's optional - possibly not enabled?

 

example below should log all exec commands, as well as config command to the group TACGRP (containing your ISE TACACS servers)

 

aaa accounting exec default start-stop group TACGRP
aaa accounting commands 15 default start-stop group TACGRP
aaa accounting connection default start-stop group TACGRP

The configuration in the equipment is correct, this problem appeared a few days ago. I made some captures and I am receiving data but it does not show it, as in the image. 

Are your monitoring nodes healthy?  Do they show up and registered?  

Also: https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-743964.html

The nodes are in good health, thanks for the Last Support Date information