Accounting on ACS 3.3, doesn't seem to be working.

Question

Hi Guys,
I have following 6 lines configured on our Cisco gears, switches, router & ASA.
However our ACS 3.3 ver does not seems to be capturing commands used by CLI users.
1
2
3
4
5
6
aaa authentication login default group tacacs+ local
aaa authentication login VTYLogin group tacacs+ local
aaa authentication login CONLogin group tacacs+ local
aaa authentication enable default enable
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
These 13 lines of configuration I have on our ASA 8.2
1
2
3
5
6
7
8
9
10
11
12
13
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host x.x.x.19
 timeout 30
 key cxxxxxxxr
aaa-server RADIUS (inside) host x.x.x.20
 key cxxxxxxxr
aaa-server SDI protocol sdi
aaa-server SDI (inside) host x.x.x.64
aaa authentication ssh console RADIUS LOCAL
aaa authentication http console RADIUS
aaa authentication telnet console RADIUS LOCAL
aaa authentication secure-http-client
These 15 lines of configuration, I have used before at other organisation that I have worked at.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
aaa authentication login default line
aaa authentication login VTYLogin group tacacs+ line
aaa authentication login CONLogin group tacacs+ line
aaa authorization config-commands
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization commands 0 default group tacacs+ if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 4 default group tacacs+
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting send stop-record authentication failure
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
Your input is highly appreciated and rated.

Answer 1

Hi Javier,
Thank you very much for taking the time to reply to my post.
I tried below both lines as well, and then I still I don't see any used commands are being recorded in ACS server.
aaa authorization commands 15 default group tacacs+ if-authenticated 
aaa accounting commands 15 default start-stop group tacacs+
To be more precious, I copied all below lines as well and switch did accepted them without any issue, and yet I don't see used commands are being recorded in the ACS.
aaa authentication login default line
aaa authentication login VTYLogin group tacacs+ line
aaa authentication login CONLogin group tacacs+ line
aaa authorization config-commands
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization commands 0 default group tacacs+ if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 4 default group tacacs+
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting send stop-record authentication failure
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
Thanks
Rizwan Rafeek.