No TACACS+ Administration Logging on ACS

I can get a csv file created for a TACACS+ Administration log/report [configured in Interface Logging of the ACS] but that log file is is empty. Help states that aaa accounting commands start-stop TACACS+ must appear in the access server or router configuration file in order to capture this day but my ASA 5520 will only allow;
aaa accounting command <server group> or <privilege>.
How do I get this ASA and Windows ACS to collect TACACS+ administration?
Note: My TACACS+ accounting does collect data on users ssh into the ASA.

It's quite possible that you might be experiencing a know bug ( CSCsg97429 ) in ACS version 4.1.
Get this Patch: Acs-4.1.1.23.5-SW.zip. It fixes the TACACS+ Administration log/report problem.
You rigth in regards to the command. It is needed for your NAS to send accounting information to the ACS.
Here's an example of the commands:
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
Hope it helps.

Similar Messages

Tacacs+ Administration log Auditing

Hello ,
I am working as internal Auditor in Bank and i am having doubts about something on the logs generated by TACAS+ looking for someone assist on this.
My cocern is about Firewall changes which triggered on the Tacacs+ Administration, It shows you in terms of adding an IP address as Source to specifc group ( objects) as destination. What if I need more details about the destiation objects prviliages which I am adding this source to ,how can i identify these changes?

Hi Mahmoud,
You can send accounting messages to the TACACS+ accounting server when you enter any command other than show commands at the CLI.
To enable command accounting, enter the following command:
hostname(config)# aaa accounting command [privilege level] server-tag
and you do have this command in your configuration. Now if command accounting is not working in your case then you need to tell me what version of Cisco ACS are you running on, if it is ACS 4.1.1.23 then there is a defect that has been fixed in patc 5
The issue that you are facing could be due to,
CSCsg97429 - TACACS+ Command Accounting does not work in ACS 4.1(1) Build 23.
aaa-server AuthOutbound protocol tacacs+
aaa authentication http console LOCAL
aaa authentication enable console TACACS+
aaa authentication serial console TACACS+
aaa authentication ssh console TACACS+
aaa authorization command TACACS+
aaa accounting command TACACS+
How to configure command accounting on ASA
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/mgaccess.html#wp1059882
Hope this helps.
Let me know if you need further help on this.
Regards,
Jatin
Do rate helpful posts~

ACS Tacacs administration report Log Analyzer

The logs in ACS are in .csv format. My system is generation huge logs due to more than 1000 devices configured in ACS. Is there any tools available to analyze the Tacacs administration logs ?
Regards
Hitesh Vinzoda

Hi Hitesh,
The only option you have is to download the .CSV files and import it into spreadsheets by using most popular spreadsheet application software. You can also use a third-party reporting tool to manage report data. For example, aaa-reports! by Extraxi supports ACS.
To download a CSV report:
=========================
# click Reports and Activity.
# Click the CSV report filename that you want to download.
# In the right pane of the browser, click Download.
# You can easily analyse the logs in Microsoft excel
How to filter and analyze logs ( with Regular Expression Syntax Definitions):
========================================
http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/LgsRpts.html#wp632961
For downloading third party application
http://www.extraxi.com/
For more info, you can download the user guide:
http://www.extraxi.com/PDFs/aaa-reports%20sales%20proposal%20-%20customer.pdf
HTH
Regards,
JK

Cisco ASA 8.4 Command logging in ACS

Hello,
I have set up command authorisation on a ASA 8.4 firewall, and everything seems to work fine.
The only problem is that the commands executed on the device such as ssh or asdm access does not show up in the TACACS+ Administration log on de ACS 4.2 server.
While on switches and routers the commands executed does show up in the log.
I googled the web, but did not find any similar item for this issue.
Please help....

You need to look at the latency between the initial connection after the pause and the beginning of when data is returned to the client. I will virtually guarantee the application is timing the user out before restarting the session.
Sent from Cisco Technical Support iPad App

No TACACS+ Administration Reports after upgrade to ACS 4.1

Hi,
I was running ACS 4.0 demo version. Everything was running fine.
After upgrading and keeping the old configuration, I can't see logs in the TACACS+ Administration Reports. I kept the configurations on the router and switch the same, so I believe that the problem resides in the ACS software.
I tested some debug, and it seems that the router is sending the command that is being typed to ACS.
Here is the config I?m using:
aaa new-model
tacacs-server host 192.168.X.X key XXXXXXXXXXX
aaa authentication login telnet group tacacs+ enable
aaa authentication login console enable
aaa authentication enable default group tacacs+ enable
aaa accounting send stop-record authentication failure
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting connection telnet start-stop group tacacs+
line con 0
authorization exec NO-AUTH
login authentication console
line vty 0 4
authorization exec AUTH
login authentication telnet
aaa authorization exec AUTH group tacacs+ none
aaa authorization config-commands
aaa authorization exec NO-AUTH none
aaa authorization commands 0 default group tacacs+ none
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none

Hi,
This is a known issue, you need to apply patch ACS 4.1.1.23.5 to fix the issue.
Patch for appliance is availble on
http://www.cisco.com/cgi-bin/tablebuild.pl/acs-soleng-3des
Patch name : ACS SE 4.1.1.23.5 accumulative patch
Patch for acs windows is availble on
http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des
Patch Name : ACS 4.1.1.23.5 accumulative patch
That should fix the issue,
Regards,
Jagdeep
Note: If that answers your question, then please mark this thread as resolved, so that others can benefit from it.

Cisco ACS 4.2 TACACS+ Administration report - Help!

we had some switches mysteriously reloaded. Upon investigation, TACACS+ Administration report show no user login to the device, no command was issued, and the reason = reload.
how could this happen?

Guna,
Tacacs+ Does not use VSAs.
Radius uses VSAs.
This is what I found online:
http://198.152.212.23/css/P8/documents/100106731
See if this helps.
It has an example associated for server configuration.
In ACS 4, you need to use the shell exec and priv-lvl=<value>.
(Similar to Cisco IOS)
Regards
Ed

TACACS Administration issue in Cisco ACS V4.1

Hi,
I am using Cisco Secure ACS V 4.1 for windows. When takingTACACS+ Administration report, report is not getting generated. I have come to know that this is a Bug in this version so as per the support forums they have suggested to update to ACS-4.1.1.23.Link which shows this is given below.
https://supportforums.cisco.com/message/2015469;jsessionid=E5E34B6AE1216E24188E4712050285DC.node0
For the same i have searched in cisco but this particular version is not present. enstead ACS 4.1.4.13 is present.
Please let me know if i update ACS 4.1.4.13 will it resolve this TACACS+ administration report issue. else provide me the remedy to fix this issue.
Thanks,
Krishna.

Krishna,
That link does not have any full software listed, only patch are listed. This bug is fixed in ACS 4.1.1.23.5 accumulative patch which can be downloaded from that link.
Incase you want to upgrade ACS, you need to open a TAC case to get the full software.
Regards,
~JG
Do rate helpful posts

Tacacs+ accounting log question

I have a tacacs server running for accounting purpose only (so I use local authentiation). So I can collect all accounting logs only.
This is a snapshot for accounting part.
Tacacs accounting logs
<102> 2014-02-23 10:20:22 [10.254.1.2:22823] 02/23/2014 10:20:22 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.50.129 User= brian Flags=Stop task_id=57 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-23 10:23:51 [10.254.1.2:58167] 02/23/2014 10:23:51 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.50.129 User=brian Flags=Stop task_id=58 cmd=configure term service=shell elapsed_time=0
<102> 2014-02-24 07:06:31 [10.254.1.2:19784] 02/24/2014 07:06:31 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=59 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-24 07:07:53 [10.254.1.2:19254] 02/24/2014 07:07:53 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=5a cmd=configure term service=shell elapsed_time=0
As you can see, I can't see any command lines, such as show int ip b. I can see all routers and switches logs, but ASA logs shows only like above. No mather what commands I used, it only shows above logs. Do i miss something? I like to capture all commands lines when users use ASDM because we use always ASDM.
I used Free tacacs+ server, not ACS.
Thanks for your time.

Hi Patrick,
In the ACS View Reports (Monitoring & Reports > Reports > Catalog > AAA Protocol) you can select the
radio button and by selecting 'Run' on the bottom run a specific query. Without that by default you will see only a report from one day.
For the 2nd question, yes the ACS View is designed to store that information, however if needed you can send the logs to an external syslog server or perfrom regular backups of the ACS View database.
Kind regards,
Pawel

Unable to view Administrator Logs

Hello,
I am trying to view the Netweaver Administrator Logs to Troubleshoot a Runtime Error on Production Portal. But when I goto http:<host>:<port>/nwa -> Monitoring -> Logs And Traces , then I select Default Trace Option or Last 24 Hours Option in the Dropdown, it displays the Message : ' No records to display '. The same when I do for QA Portal it displays the Logs fine. What is missing for Prod. Portal which is not allowing to view the Logs.?
Any help would be highly Appreciated.
Thanks.

Pls check with your basis team whether the configuration to write the logs and traces were configured. It will be st by default but there might be a chance to set it to "OFF". In that case you will not get any traces or logs.
Thanks,
Mahe

I forgot my administrator log in to my macbook air os 10.7.5

I forgot my administrator log in to my macbook air os 10.7.5

Boot to the Recovery HD:
Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
When the menubar appears select Terminal from the Utilities menu. Enter resetpassword at the prompt and press RETURN. Follow instructions in the dialog window that will appear.
Or see Reset a Mac OS X 10.7 Lion Password and OS X Lion- Apple ID can be used to reset your user account password.

Administrator Log no letters

Hi everyone...
i has been installing new software at my imac(2011), but, in my administrator log i cant see anything...
What i can do?
See: https://dl.dropbox.com/u/95497203/2013-02-05%2018.32.48.jpg
Thx for any reply ^^

Back up all data.
Launch the Font Book application and validate all fonts. You must select the fonts in order to validate them. See the built-in help and the support article linked below for instructions. If Font Book finds any issues, resolve them, then boot in safe mode* (by holding down the shift key at the startup chime) to rebuild the font caches. Boot again as usual and test.
Mac 101: Font Book
*Note: If FileVault is enabled under OS X 10.7 or later, or if a firmware password is set, or if the boot volume is a software RAID, you can’t boot in safe mode. In that case only, after running Font Book, launch the Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Drag or copy — do not type — the following line into the Terminal window, then press return:
sudo atsutil databases -remove
You'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning not to screw up. After running the command, reboot as usual.

Portal Netweaver Administrator Logs

Hello,
I want to view the Administrator Logs on the Portal for which I am going to http://<host>:<port>/nwa, but then it says 'Select systems before proceeding' and no logs are displayed.
Please help.

Hello,
Please check whether your sld is started or not, and technical system is created.
to check sld go to http://host:port/sld, configure sld and create technical system.
Thanks,
Sagar Pande

Passed Authentication Logs on ACS 4113 SE appliance

I need to get a copy of all Passed Authentication logs from our appliance. Is there a way that I can ftp all those files to another device? Or is there another way that I can retrieve those files?
Thanks
Dwane

Dwane,
Yes, you can send logs to another system on the network using remote agent.
Remote Logging for ACS SE with ACS Remote Agents
The Remote Logging feature enables ACS to send data to one or more ACS Remote Agents. The remote agent runs on a computer on your network. It writes the data that ACS sends to it into CSV files. You can configure many ACS Solution Engines to point to a single remote agent, thus making the computer that runs the remote agent a central logging server.
For more information about installing and configuring an ACS Remote Agent, see Installation and Configuration Guide for Cisco Secure ACS Remote Agents Release 4.1
Regards,
~JG
Do rate helpful posts

Remote Logging for ACS

I am testing remote logging in ACS. Is it by design that logging from all ACS appliances goes to the same files configured by the Configuration Provider? Whatever is specified in the other ACS appliances is ignored and all entries from all appliances end up being logged to the same file.
Just would like confirmation. Thanks.

Hi
There are some real problems with remote logging:
1) Requires a dedicated server to receive logs
2) Not all logs are supported
3) Constant increased traffic over WAN
4) Added CPU burden on each ACS
5) Increased latency in AAA responses from ACS
Take a look at CSVSYNC. Its our answer to all these issues. A simple CLI driven .exe that can connect via HTTP(s) to any number of ACSs (software and appliace) and pull down *all* csv logs.
It can be scheduled and scripted to run at quiet times.
Regards
Darran
www.extraxi.com/utils.htm

ACS 3.3 Administration Logs

Hi
I am logging executed commands locally to my ACS, however the csv seems to only be a day old. How can I view all the csv's in multiple day by day files, like you can with the failed attempts loggs?
Thanks

First you need to check the following:
Go into "System Configuration" then into the "Logging" section. Select one of the logs that isn't working.
Scroll to the bottom of the page and check that:
a) The Log file management is set to Generate a new file every day
b) If the 'Manage directory' option is turned on, make sure the settings allow files to remain for more than one day.

No TACACS+ Administration Logging on ACS

Similar Messages

Maybe you are looking for