Accounting Command for Configuration Changes

Hi All,
i want the logs of command 0r configuration changes made in ROuters or Switches to ACS 4.1,
like the following
Wed Jun 27 03:46:47 2001 172.16.25.15 fgeorge tty3 5622329430/4327528 stop
task_id=3 service=shell priv-lvl=1 cmd=show version <cr>
the above is found in the Command Accounting of the Link
http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfacct.html#wp1000976

Anand
The information that you need about how to configure this is not so good in the link that you posted. But it is not difficult to configure. I use the following line in configuration of routers and get the accounting records in ACS for all privilege level commands including any configuration commands.
aaa accounting commands 15 default start-stop group tacacs+
You might want to change some details (like tacacs+) depending on how your routers are configured to talk to ACS.
HTH
Rick

Similar Messages

ASA send syslog messages for configuration changes

On a router you can send configuration changes to the syslog server by doing,
conf t
archive
log config
logging enable
notify syslog
Then the router will send something like,
.Aug 3 13:12:00.776 PACIFIC: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin logged command:no interface Loopback76
if I had typed at the command line, "no int lo76"
How do you do this on the ASA?
Goal: I want to know when anybody does any kind of config on my ASA.

The syslog number 111008 and 111010 will log the command that is entered by user.
111010 is for configuration changes.
Here is the syslog for your information:
111008:
http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4769400
111010:
http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4769410
You need to enable syslog, and severity level 5, and if you don't want to see any other logging, you can only log the above 2 syslog numbers.

Enable aaa accounting commands for all privilege levels?

Here is the command's syntax:
aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} {start-stop | stop-only | none} [broadcast] group groupname
The "command" accounting type must include the privilege level of the commands you are logging. How do I log ALL commands?
Take the following example:
aaa accounting commands 15 default start-stop group mygroup
If I issue this command will that mean commands the user executes that have a privilege level lower than 15 will not be logged? Or only commands that require exactly privilege level 15 will be logged?
How can I log all commands regardless of privilege level?

Hi Red,
If you customize the command privilege level using the privilege command, you can limit which commands the appliance accounts for by specifying a minimum privilege level. The security appliance does not account for commands that are below the minimum privilege level.
The default privilege level is 0. So if you don't specify any privilege level then all should be accounted for.
You can find the command detail at. This is for ASA though.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/command/reference/cmd_ref/a1.html#wp1535253
Regards,
Kanwal
Note: Please mark answers if they are helpful.

Internet working but can't access AirPort for configuration changes

I have an AirPort Express and it connects to the internet properly through my cable modem -- solid green light and all -- and allows my PC to surf wirelessly.
Sounds pretty good, but...
For some reason I can't access the AirPort Express to change any of the settings. For example, I would like to change the SSID and the IP numbering scheme to give out 192 IPs, but when I open the Admin Utility I can't see the AirPort Express. When I try to access it manually in the utility by hitting "Other..." and entering the IP that my PC is assigned on the network (10.0.1.2), it puts up a window that says "Reading configuration from base station", then an error message with code -6753.
I know it is working, otherwise I wouldn't be writing this right now, but how to I access it???
Thanks in advance for someone helping me out.

journey778, Welcome to the discussion area!
Your system information states OS 10.0.x. If you are using that version of OS X you do not have an Intel based iMac. I would suggest that you upgrade to OS 10.2 at least.
If you do have an Intel based iMac, you may want to try renewing the DHCP lease. Open System Preferences->Ethernet->Advanced... and click on the "Renew DHCP Lease".

Blank window when internet accounts asks for password change

I'm on OSX Yosemite and I've got a gmail account that I've just changed the password to. I keep getting a pop up from system prefs to change my password. Clicking on the pop up takes me to internet accounts, but another window pops up and its blank. I managed to change my password for the account on the mail app, but now I'm trying to send an email and the pop up is back and I have no idea how else to change my password.
Here's a screen shot of the screen.

When I go to internet accounts and click on the account, the pop up just comes up again. How do I change the password without the pop up? Clicking details only has name and description.

Log configuration changes to syslog on Nexus 7000?

I need to be able to log any configuration changes to syslog on our Nexus switches. On IOS this is easy with the archive commands, but I'm a little stuck trying to do this on our Nexus gear. On the IOS gear I run the commands:
archive
log config
logging enable
logging size 100
hidekeys
notify syslog
How do I do the equivalent on NX-OS?

Cisco NX-OS can log configuration change events along with the individual changes when AAA command accounting is enabled.
With command accounting enabled, all CLI commands entered, including configuration commands, are logged to the configured AAA server. Using this information, a forensic trail for configuration change events along with the individual commands entered for those changes can be recorded and reviewed.
Because of this capability, it is strongly advised that AAA command accounting be enabled and configured.
Refer to the “TACACS+ Command Accounting” section of this document for more information.
The Nexus 7000, by default keeps a local accounting log of all the configuration commands entered on the device; you can view this with the 'show accounting log' command.
In NX-OS, we changed the way logging works. We keep a local accounting log of all the
configuration changes ("show accounting log"), but if you want to send those logs to a
server, it must be done with through a TACACS server. Please see the below documentation:
Configuring AAA on Nexus
TACACS command accounting
-Thanks
Vinod
**Encourage Contributors. RATE Them.**

Please ensure that the applicationhost.config file is correct and recommit the last configuration changes made

I am receiving event ID 5189 on Server 2008 R2, IIS 7.5. I experience this error across a number of servers, each of which is running only the default web site, but have 600+ applications running on the default web site. Each application
has its own application pool. My point is, the applicationhost.config is rather large.
I have seen a number of posts on this error message, but my issue itself seems to differ somewhat. I am aware of a similar post: http://social.technet.microsoft.com/Forums/en-US/3128ee93-1319-4cc2-9257-003512caf476/event-id-5189-microsoftwindowswas?forum=exchangesvrgeneral
which points to KB http://technet.microsoft.com/en-us/library/cc734988%28v=ws.10%29.aspx
However, in my case, it doesn't seem that the extreme measures for this resolution are required. The error usually indicates a corrupted applicationhost.config that must be manually fixed, or otherwise the WAS service needs to be restarted, or the
server itself, etc.
In my case, the issue can usually be fixed by an application pool recycle, or at worst a stop/start. I have an application which is sensitive to recycles, and so we do not have periodic recycle events configured for this application, which is the bulk
of the applications on the servers. It seems to me that this issue is usually caused by the application being in use when there is an applicationhost.config change.
For instance, we have one application that we deploy using msdeploy. We found that when we ran an installation for this application via msdeploy, we were receiving this event, and we would subsequently get 500 errors in the application (sometimes the
application pool corresponds to that which is identified in the event log, sometimes it doesn't).    It seems like applications that were being hit at the time the applicationhost.config was modified by msdeploy were affected. In an attempt
to correct this, we moved from msdeploy to a batch file containing appcmd commands. This also did not resolve the issue.
I have another application which is installed using PowerShell commandlets. We started to notice that this script also caused the issue to occur on occasion. As I continued to identify different processes that resulted in the same issue, I came
to the conclusion that this is likely due to any change in the applicationhost.config. I assume the issue is that the applicationhost.config is modified during a read operation to the file by the application pool, or WAS service, and that the recycle
event, which corrects the issue, forces a re-read of the applicationhost.config, resolving the bad-read issue.
Has anyone else experienced this, or do you have any recommendations? My current work-around is to not install any applications during peak hours, and performing an IISRESET after installs are completed, to ensure application stability.
Message              : The Windows Process Activation Service failed to generate an application pool config file for application pool 'myAppPool'. The error type is '7'. To resolve this issue,
please ensure that the applicationhost.config file is correct and recommit the last configuration changes made. The data field contains the error number.
Id                   : 5189
Version              : 0
Qualifiers           : 49152
Level                : 2
Task                 : 0
Opcode               : 0
Keywords             : 36028797018963968
RecordId             : 324108
ProviderName         : Microsoft-Windows-WAS
ProviderId           : 524b5d04-133c-4a62-8362-64e8edb9ce40
LogName              : System
ProcessId            : 0
ThreadId             : 0
MachineName          : MyComputer
TimeCreated          : 3/3/2014 9:03:24 PM
ContainerLog         : system
MatchedQueryIds      : {}
Bookmark             : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName     : Error
KeywordsDisplayNames : {Classic}
Properties           : {System.Diagnostics.Eventing.Reader.EventProperty, System.Diagnostics.Eventing.Reader.EventProperty, System.Diagnostics.Eventing.Reader.EventProperty}

As an update to this issue, after doing some research, it appears the behavior is related to a new feature in IIS7 called Application Pool Isolation (http://technet.microsoft.com/en-us/library/dd163536.aspx).
This new feature prevents cross-application spillage by isolating the configuration for each application pool in IIS. So in reality, an application pool never actually reads the applicationhost.config - that is just a master file, and each time it
is update, it triggers a change to the individual application pool configuration files, located in C:\inetpub\temp\apppools.
We did try setting Advanced Settings > Disable Recycling for Configuration Change to true, but after an IIS reset we were still able to reproduce the issue - worse actually, because in our test program, which continually hits the web
service, and also continually makes apphost.config changes, when the two events collide, the 500.19 issue precipitates; but after an additional change to the apphost.config, it seems that the additional changes will actually correct the issue (seemingly forcing
another recycle, which is also how we resolve the issue manually); after making this setting adjustment, once the 500.19 issue precipitates, additional changes to the apphost.config does not correct the problem, only a manual recycle corrects it. This
is the recycling.disallowRotationOnConfigChange property of the app pool. We also set the setting for recycling.disallowOverlappingRotation to True as well, with the same result.
We ARE able to prevent this issue by setting the C:\inetpub\temp\apppools\myapppool\myapppool.config to read-only, but for obvious reasons, this is not a desired work-around.
It seems like what is happening is that any change to the ApplicationHost.config is resulting in each of the C:\inetpub\temp\apppools temp application pool config files being updated as well, in addition to triggering an application pool recycle. It
seems to me the desired behavior would be that these files are only updated if the applicationhost.config changes are specific to that application pool - but that doesn't seem to be the behavior.
After turning on failed request tracing, I was able to narrow the error down more:
ModuleName
AnonymousAuthenticationModule
Notification
2
HttpStatus
500
HttpReason
Internal Server Error
HttpSubStatus
19
ErrorCode
2147942413
ConfigExceptionInfo
\\?\C:\inetpub\application\application\web.config ( 9) :Failed to decrypt attribute 'password'
Notification
AUTHENTICATE_REQUEST
ErrorCode
The data is invalid. (0x8007000d)
This seems to be pretty static. Trying to look into possible causes of this issue.

GPIB command for acquire simultaneous 2 scope channels?

I am a new GPIB programmer, and I want to acquire 2 signals simultaneous from a HP54111D oscilloscope (HP) via a gpib bus.
I can acquire a channel and after the other. do you
know the gpib command to acquire 2 channels simultaneous and transfer data ?

Hello,
If you uses LabVIEW or LabWindows/CVI IDEs the best way to control your instrument is to use the instrument drivers provided on our site:
http://search.ni.com/query.html?lk=1&col=alldocs&nh=500&rf=3&ql=&pw=595&qp=%2BContentType%3AInstrumentDriver&qt=HP+54111&layout=IDNet
If for some reason you must use GPIB commands the best for you is to request from HP the set of commands for your scope.
I assume that you have some commands for configuration of your scope then you can enable ch1 and ch 2. then when you acquire data your scope will probablely fill a memory buffer (record) with your signals data. so i think that there is only one function for one channel and two channel. When using two channel tha data will probably be interleaved in your record i
.e (ch1[0],ch2[0],...ch1[n],ch2[n]) .
Hopes this helps
Regards
Salissou ISSA
Applications Engineer
NI France

The password for the account "account name" was not changed. Your system administrator may not allow you to change your password or there was some other problem with your password. Contact your system administrator for help.

I have a user who's Active Directory password is going to expire. I had her reset her password by going to apple > system prefs > user > and clicking change password. She received the error "The password for the account "account name" was not changed. Your system administrator may not allow you to change your password or there was some other problem with your password. Contact your system administrator for help."
I had her change her password via the kpasswd command in terminal and that changed her password on the server sucessfully however the laptop has FileVault on it. Filevault is not recognizing the new password just the old password.
I have deleted the keychain which didn't resolve and now I am going to decrypt and reencrypt the drive. I'm hoping this is an isolated issue I have over 25 laptops configured like this.

I "think" the trick was unbinding and rebinding the computer account.
After unencrypting and trying to reencrypt Filevault would still not take the new password.
Rebooted the prompt to update the keychain appeared. Updated the keychain. Filevault would still not take the new password.
Unbinded and rebinded the computer account. It worked and let me add the user to filevault.

[Microsoft Store][Profile][Billing] How Do I Change Country/Residence for Microsoft Account? Editing Your Microsoft Account Profile for Microsoft Store. SOLVED: Change Home Location

Hello,
I am experiencing problems with using my Microsoft Account for billing and purchasing apps in Windows store.
I am using my old WLID that I've created several years ago, and I have obsolete information including my country residence there. Now when I go to
https://billing.microsoft.com, I see that I have 2 profiles:
Personal profile: US
Business profile: Russia.
Now the problem is that I want my personal profile be changed to Russia as well. Having US in the profile makes it impossible to make purchases from Microsoft Store because Store does not allow for changing country when making purchases via PayPal.
Currently I have this information:
I need the Country/Residence information to be changed to Russia. How do I do that?
I am stuck.
How do I change country for my Microsoft Account?
If it's not possible, would I be able to continue using my Microsoft Account with old residence/country information while making purchases through a new Microsoft account where I have specified my current residence?
Or is it the same as with Windows Phone 7:
http://support.microsoft.com/kb/2692008
If yes, do I understand that I have to start all my 'virtual living' from scratch to use Microsoft Store? In other words, do I have to sign-in into Windows 8 with a new Microsoft Account that will have Russia specified as a Country/Region to purchase apps
from Microsoft Store?
If yes, can I use this new account only for purchasing apps while continuing to use my old account or all purchased apps are strictly tied to this new Microsoft Account I will use for purchasing?
Thank you.
Well this is the world we live in And these are the hands we're given...

Hello,
Thanks to
this post @ Microsoft Answers, I was able to make Microsoft Store use correct information of my current country residence.
//The drawback in my case was that I lost the possibility to pay with Paypal, although Paypal supports payments in Russia, and, most importantly, I lost access to US marketplace, all comments/reviews are now in Russian. What a bummer! Honestly, I'd
like to have access to US store... Seems like the only workaround it to switch Home location for the time I purchase an app and change back when the app is purchased.
To change the Country/region data used for Payment and Billing in Microsoft Store,
Press WindowsKey+W to show Start screen and focus on searching in
Settings.
Type 'region' (without quotes) and open Region dialog box when found.
In the Region dialog switch to Location tab and change the country of choice in the
Home location drop-down list.
Click OK to apply changes and make them effective.
Open Store and press WindowsKey+I to show settings charms then choose
Your account.
In the Your account screen click Add payment method to configure your payment settings that will be used for purchasing apps from Windows Store.
Notice Country/region value has changed.
This country will be specified in Country/residence within Payment and Billing in Microsoft Store app.
Well this is the world we live in And these are the hands we're given...

How to load the boot menu using the command line , after the configuration change ?

how to load the boot menu using the command line , after the configuration change ?

Hi @Bask-48
Welcome to the HP Forums!
It is a terrific place to find answers.
For you to have the best experience in the HP forum I would like to direct your attention to the HP Forums Guide Learn How to Post and More
I grasp you are trying to change the boot order. Here is a link to Configuring the Boot Order in the System BIOS
that will assist you.
Good Luck and Happy Holidays!
Sparkles1
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the bottom right to say “Thanks” for helping!

HT201240 Changing or resetting an account password for os x lion

please help

Forgot Your Account Password
For Lion, Mountain Lion, or Mavericks
    Boot to the Recovery HD:
Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
     When the menubar appears select Terminal from the Utilities menu.
     Enter resetpassword at the prompt and press RETURN. Follow
     instructions in the dialog window that will appear.
     Or see:
       Reset a Mac OS X 10.7 Lion Password
       OS X Mountain Lion- Reset a login password,
       OS X Mavericks- Solve password problems,
       OS X Lion- Apple ID can be used to reset your user account password.
For Snow Leopard and earlier with installer DVD
     Mac OS X 10.6- If you forget your administrator password,
     OS X- Changing or resetting an account password (Snow Leopard and earlier).
For Snow Leopard and earlier without installer DVD
    How to reset your Mac OS X password without an installer disc | MacYourself

HT1918 I can't seem to update my apps or make any purchases on from my account. Nothing has changed with my credit card information and for some reason the iTunes Store tells me my information is incorrect. What do I do?

I can't seem to update my apps or make any purchases on from my account. Nothing has changed with my credit card information and for some reason the iTunes Store tells me my information is incorrect. What do I do?

Yes, it's frustrating.
I don't have my iPod with me but, as I recall, the change is done in Settings/Store. That change will apply to NEW purchases. However, be aware that all purchases are permanently associated with the Apple ID that was originally used. Generally, it's only a problem when you need to update an app. IF you do your updating from iTunes and your logged in to the "wrong" ID, you'll need to log out and back in again. It's easier from the iPod as you do not need to log out/in but you do need to know the password.
Unfortunately, you can not merge IDs nor can you transfer purchases from one ID to another. Go here to find out exactly what you have. I have the same problem so I deliberately made both passwords identical to make things slightly easier for me.

I created a new Apple ID for iCloud on my iPhone, but I can't seem to find a way to "sign out" or "log out" of that Apple ID (for iCloud) to sign in with another Apple ID. The only account login I could change was the Store. How do I "log out"

I created a new Apple ID for iCloud on my iPhone, but I can't seem to find a way to "sign out" or "log out" of that Apple ID (for iCloud) to sign in with another Apple ID. The only account login I could change was the Store.
How do I "log out" or "sign out" of iCloud on my iPhone? There is an option to delete the account, but I just want to log off. I want to keep the account name for future use.

@fernandamagalhaes
It looks like the article below has the information you are looking for.
iCloud: Change iCloud feature settings
http://support.apple.com/kb/PH2613
Turn off iCloud completely
Depending on whether you want to stop using iCloud on all or only some devices, do one or more of the following:
On your iOS device’s Home screen, go to Settings > iCloud, then at the bottom of the screen, tap Delete Account.
Note: If you delete your iCloud account, iCloud will no longer back up your iOS data. You can still back up your device in iTunes (for more information, open iTunes and choose iTunes > Help).
On your Mac, open iCloud preferences, then click Sign Out.
If your Mac has OS X v10.7.5 and you turn off iCloud, your calendar information and reminders aren’t stored locally in iCal. If you want to retain your calendar and reminder information, you need to back it up before turning off iCloud. For more information, see the Apple Support article iCloud: Calendar & reminder data removed from Calendar and Reminders or iCal when disabling iCloud Calendar.
On your Windows computer, open the iCloud Control Panel, then click Sign Out.
Note: If you turned on automatic download of music, app, or book purchases (in iTunes preferences or in Settings on your iOS device), your iTunes purchases are still downloaded to your devices.
Set up iCloud on your devices

How to configure Automatic Account Clearing for A/R

Hi,
Kindly advice me how to configure Automatic Account Clearing for A/R
The client requirement is
In A/R the customer accounts are not automatically clearing when a payment is posted for that account. We are still seeing all open items and all paid or cleared items when we go to FBL5N and select open items for viewing. Please make account clearing automatic for customer payments.
Thanks in advance
Sunitha

Hi,
Use T code OB74.
Maintain for your Chart Of Account, acct type "D", From and to customer accounts and then add the critera you want. Pls note you cannot define more than 5 criteria.
Then schedule the clearing program job F.13 in the background.
Cheers.

Accounting Command for Configuration Changes

Similar Messages

Maybe you are looking for