trace the user's Activity's to a log file on Cisco ISE

[Ibrahim Jamil]

Hi Guys

Hope all safe

I just enabled Accounting on my Devices , Routers , Switches , Firewall , WLC , APs

how can i trace the user's Activity's to a log file on Cisco ISE

Thanks

Ibrahim

#stayhome,StayConnected,staysafe

[Mike.Cifelli · Accepted solution]

You can take a peek at the Tacacs+ live logs under: Operations->Tacacs->Live Logs OR you can generate a report by going here: Operations->Reports->Device Administration->TACACS Accounting. IMO the report is really nice because you can export to csv and it will show you several items including user, host, command, timestamp, and many more. HTH!

[Ibrahim Jamil]

thanks mike

[OaklandCounty_Mike]

Hey Mike,

Thanks for this response as well.  it got me to the location where i think this data is located, but i still have a question.

under TACACS Accounting, i can see login data, but i dont see a column for the actual commands used. Would that data be actually located under TACACS Command Accounting?  if so, i have 0 data there, would that also mean i dont have configuration in place to capture that data?

i am currenlty still using ISE 2.4 Patches: 2,6,11

Thanks in advance

[Greg Gibbs]

There is no column in the TACACS Command Accounting report page because the commands will only be seen when you click on the Detail Report for the session. If you are not seeing sessions in that report, you likely do not have command accounting enabled on the network device for the relevant line and/or privilege level that is being assigned to the user session.

[OaklandCounty_Mike]

Good morning Greg,

Thank you for your response.  where would i find the settings to enable/disable command accounting?

when i click on the detail reported of a given login session under TACACS Accounting, there are no details provided on what commands the user ran.  i assume as you mentioned, we dont have something enabled for this reporting feature.

Thank you,

Mike

[Greg Gibbs]

That depends entirely on what type of device for which you're looking to turn on command accounting. There are some examples in the Cisco ISE Device Administration Prescriptive Deployment Guide. If the device is not covered there, you will need to look into the documentation for that device.