ACS 4.2: Day-wise logging not reflecting

Question

Hi All,
I am trying to capture acs accounting logs day-wise, but unable to do it. When we check under report and monitoring it shows single thread, which contain all the accounting logs.
Need help to modify the config to get the logs on daily basis.
Regards
Amar

Answer 1

The Radius logs are only recording Start and Stops, which I also tried the switch to capture with the aaa accounting commands. Nothing there.
the authentication is Machine auth, using a certificate in AD. The Radius server(ACS) is configured to use external authentication and I have it setup with group mappings. When I intentially misconfigure that to get the laptop with the valid cert to fail its credentials, I do see the failed attempts. which tells me that the logging is working, but only for failed attempts by valid computers and that's of almost not use to me. I need to see when anonymous users are attempting the same thing. I am using a spare laptop that is not configured on my domain and therefore does not have a machine certificate.
I have gone back and forth with the switch config and have used guest-vlans, and no guest-vlans. The switchport AuthSM State always stays at "Connecting" and the PortStatus is at "Unauthorized" Which is the defualt it starts in. When I am using guest-vlans the port eventually goes to connected but its in the Guest-vlan. That tells me the switch is going through the EAP messages and determines there is no valid auth. In-fact I even see EAP-Fail in the debug dot1x outputs. So why would that not be logged on the Radius Server. The laptop pops up messages saying it couldn't find a valid certificate and in the network connections the interface status shows failed authentication. So windows is failing authentication.