Syslog all commands

[jkjackson]

Is there a way in a 3560, 3750 switch and 3845, and 2811 router to tell it to send all config commands someone is typing on the router to a syslog server? Is this only available in TACACS+?

[Richard Burts]

Joseph

You have AAA configured for authentication and authorization but not for accounting. Add this to your config:

aaa accounting cpmmands 15 default start-stop group (groupname)

This should get you all the privilege level commands that are entered.

HTH

Rick

[jkjackson]

Rick,

That is fine and dandy. What i don't understand is where does it log the messages on the AAA server? What i am trying to obtain is everytime some one does something on a network device i see it on my monitoring system monitor automatically, in a syslog type format.

[Richard Burts]

Joseph

My experience with AAA accounting is with an ACS server. In the ACS server there is a report heading where the accounting records are displayed. Assuming that your Radius server is not an ACS server I am not sure where the accounting records are logged.

HTH

Rick

[jkjackson]

Yeah, well i will work with what y'all have given me and see what i can come up with. I will rate the post accordingly Monday. Thank both of you for your enduring help!

[royalblues]

add these accounting commands as well and check

aaa accounting exec default start-stop group radius

aaa accounting commands 1 default start-stop group radius

aaa accounting commands 15 default start-stop group radius

HTH

Narayan

[atif-siddiqui]

this does not work for RADUIS, but yet we have the command avaliable; msg shows that it can only be for TACACS. how can we get it.

PE2(config)#aaa accounting commands 15 default start-stop group TESTR

PE2(config)#

10w1d: %AAAA-4-SERVNOTACPLUS: The server-group "TESTR" is not a tacacs+ server group. Please define "TESTR" as a tacacs+ server group.

PE2(config)#

Also Cisco Documnetation:

http://www.cisco.com/en/US/docs/ios/11_3/security/configuration/guide/scacct.html#wp6192

Cisco's implementation of RADIUS does not support command accounting.

how can we do that?? any ideas.

[Edison Ortiz]

Try without using the group name and please enter the commands as Narayan illustrated.

The link you posted is from 11.3 IOS release. That's very old information and it's no longer true.

Please follow the link I posted at the beginning of this thread.

It has the most recent information regarding AAA Accounting configuration.

BTW, What IOS release are you running ?

[ColForbin]

Any chance anyones got an updated link?