Send AAA Accounting Log to Syslog Server

[mramirez-t]

I found this article trhough another forum post about checking AAA accounting log to track commands that users would put in on our Cisco switches to audit changes.  Question is, how can I send this info to a Tripwire server?

Here's the link that told me to run "Show accounting log" to track changes.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_aaa.html#wp1152764

[Richard Burts]

The AAA accounting records are sent to the AAA server. Is the Tripwire your AAA server?

HTH

Rick

[mramirez-t]

I'm using Server 2008 R2 NPS for AAA.  I'm not really using it for Accounting though.  The NPS server is only set up for authentication.

[Richard Burts]

If the server is set up only for authentication then you would not be able to send accounting log records to it.

HTH

Rick