Sending AAA accouting log records to multiple AAA servers

IOS version c3640-a3jk9s-mz.123-18.bin
aaa group server tacacs+ cciesec
server 192.168.3.10
aaa group server tacacs+ ccievoice
server 192.168.3.11
aaa authentication login VTY group cciesec local
aaa accounting exec cciesec start-stop broadcast group cciesec group ccievoice
aaa accounting commands 0 cciesec start-stop broadcast group cciesec group ccievoice
aaa accounting commands 1 cciesec start-stop broadcast group cciesec group ccievoice
aaa accounting commands 15 cciesec start-stop broadcast group cciesec group ccievoice
tacacs-server host 192.168.3.10 key 123456
tacacs-server host 192.168.3.11 key 123456
C3640#sh tacacs
Tacacs+ Server : 192.168.3.10/49
Socket opens: 8
Socket closes: 8
Socket aborts: 0
Socket errors: 0
Socket Timeouts: 0
Failed Connect Attempts: 0
Total Packets Sent: 21
Total Packets Recv: 21
Tacacs+ Server : 192.168.3.11/49
Socket opens: 0
Socket closes: 0
Socket aborts: 0
Socket errors: 0
Socket Timeouts: 0
Failed Connect Attempts: 0
Total Packets Sent: 0
Total Packets Recv: 0
C3640#
As you can see, I can receive AAA accounting logs on server 192.168.3.10 but I am not getting logs on 192.168.3.11. I can confirm this with
tcpdump on host 192.168.3.11 and that I am not seeing any sent AAA to host 192.168.3.11.
Anyone know why?

http://www.cisco.com/en/US/docs/ios/12_1t/12_1t1/feature/guide/dt_aaaba.html
It stated the following:
"Before the introduction of the AAA Broadcast Accounting feature, Cisco IOS AAA could send accounting information to only one server at a time. This feature allows accounting information to be sent to one or more AAA servers at the same time. Service providers are thus able to simultaneously send accounting information to their own private AAA servers and to the AAA servers of their end customers. This feature also provides redundant billing information for voice applications."

Similar Messages

Sender JDBC Adapter : Fetch records from multiple tables

Hi Friends,
I am using sender JDBC adapter to select few records from DB2 database table.
This scenario is working fine.
Now my requirement is to fetch records from 3 tables. These table are independent to each other. There is no primary key or foreign key.
Please let me know how to write the sql in sender JDBC adapter to fetch records from these 3 tables.
Thanks,
Sandeep Maurya

hi sandeep...
if the tables are completely independent and do not share any primary / foreign key relation ship...
why dont u think towards creating a seperate interface for each of them..
or if u still want to select from multiple table at once..the best way would be to write a stored procedure on the sender side which do all the fetching n processing and pass the final resultset to PI
or u can think towards fetching the data from 1 table and then in UDF do lookup from other tables..which again is tricky and performace intensive

Sending Logs to Multiple Syslog Servers

Hi Team ,
is it doable to send log messages recorded on various cisco devices to multiple syslog servers by discriminating the severity level ?, for example I want to send all the critical and alerts logs to x.x.x.x server, but for other severities, I want to send the logs to y.y.y.y server.
Thanks.

Hi Team ,
is it doable to send log messages recorded on various cisco devices to multiple syslog servers by discriminating the severity level ?, for example I want to send all the critical and alerts logs to x.x.x.x server, but for other severities, I want to send the logs to y.y.y.y server.
Thanks.

WLAN and multiple AAA servers

Hello,
Our WLANs are configured with 2 AAA servers. The first authentication server is local, the 2nd authentication server is remote. I noticed that often, the 2nd server is used for the authentication even if the first server is up and available. It looks also that once the authentatication is done on the 2nd server it's stays there. Is there an option to:
- define server 1 is as the priority for authentication?
-switch authentication to server 2 when server 1 is not reachable, but switch back to server 1 as soon as server 1 reachable again?
Thanks

Hi,
I asked the question at CiscoNetworker2008.
In the version 5.0 it will be fixed.
When the first Radius is reachable again, the authentication will switched back on the first radius server.
Let see if this will be confirmed in the release notes...
Brgds.

Ability to send syslog events to multiple syslog servers - SA540

Please add the ability to send syslog events to multiple syslog servers in the SA500 Series routers. I know the functionality is currently in the RV220W because we utilized it. It would be great if you could configure the syslog servers by event type as well. For example, being able to send the kernel events to syslog server A, and all other events to syslog server B.

You can do the following:
1) Create a remote log target for your syslog server at
System Administration >
Configuration >
Log Configuration >
Remote Log Targets
2) Configure the log categories that should be enabled to eb sent to this log target.
Go to
System Administration >
Configuration >
Log Configuration >
Logging Categories >
GlobalSelect a specifc category and then look at "Remote Syslog Target" tab.
For each category that you want sent to your syslog server select the remote log target in the "
Selected Targets" transfer box
Note that this configuration is hierarchical. So if make configuration for one log category it applies to all subtemding categories. For example if configure
"AAA Audit" then the configuration will apply to the pass and failed attempts categories

JDBC Sender Adapter - NOT FETCHING RECORDS...

Hello Experts,
I know this was answered in a separate thread (JDBC Sender Adapter - NOT FETCHING RECORDS -PROCESSING STARTED).
However, my question is, Is there a way that we can be notified if a channel has stopped fetching records?
or is there a reporting tool that can be used to check/monitor if a channel is not processing any messages?
Thanks & Kregards,
allar

Hi Sreedhar,
Thanks for your reply.
These case is not being captured by our alert configuration because its not throwing any error.
in the communication channel monitoring, we see only something like this..:
3/16/09 8:25:19 PM Processing started
3/16/09 8:34:20 PM Processing started
3/16/09 8:33:55 PM Processing started
3/16/09 8:32:54 PM Processing started
but no error is being displayed nor sent.
Also, there was a case that the channel just stopped fetching, even though everything is active.
example log:
3/12/09 8:32:54 PM Processing started
We're looking for ways on how we can trap these scenarios as early as possible, get us notified and perform adapter-lock release when needed.
Regards,
allar

Adding AAA servers to ACS to use Proxy RADIUS distribution Table

Hello,
I've added two non ACS radius servers (Radiator) to the AAA servers on Network Config, in order to use them on a proxy distribution table.
I had problems authenticating users through those servers and I did a sniffer trace on the outside interface of the ACS.
What I saw is that ACS sends packets to the AAA server configured as RADIUS on port 1645, not 1812, the expected standard, and port to which the others servers are listening to. How can I change this behaviour?
Thanks
Gustavo

ACS by default will listen on both ports 1645 and 1812, the two "standard" Radius ports. However, when talking to a proxy server it will only send them on 1645, by default. To change this you have to go into the registry and change it as follows:
Under [HKEY_LOCAL_MACHINE\SOFTWARE\Cisco\CiscoAAAv3.x\Hosts\\RADIUS] (where is the server you want to send the 1812 reuests to, and note that you may have to add the RADIUS key if it isn't there already), you can add the following:
"authPort"=dword:0000066e <<---- 1645
"acctPort"=dword:0000066d <<---- 1646
"timeout"=dword:00000001
"single connection"=dword:00000000
"strip users"=dword:00000000
You don't need all of them, you can just change the authPort to 1812 (714 in hex) and acctPort to 1813 (0x715) and you should be good to go. Make sure you reboot the server after making the registry changes. Keys are case-sensitive too so make sure you type them in EXACTLY as I've shown above.

Log Records Being Scanned

We make extensive use of replication on our system (which is Sql Server 2012 SP2 Enterprise). We have a publisher, 3 subscribers and a distributor. It is all transactional immediate push.
Lately our replication is running behind many mornings and here are the symptoms:
1. I look on the distributor and the cpus are all pegged at 100%
2. The log reader history shows that for hours it has been doing the following:
"Approximately 8000000 log records have been scanned in pass #4, 0 of which where marked for replication"
Basically, for hours the log reader has been scanning log records. We have our publisher currently set to SIMPLE and the log file is usually "medium" in size - maybe 20-30G.
To solve the problem, I usually do a restart of the services on the distributor and then that sends the cpu down to more normal levels. It will do usually a little more scanning but not hours of it and then replication will almost instantly catch up.
Any idea what would cause this? This is causing production issues almost every night and so any tips on how to debug/solve this would be much appreciated.

Hi clm2,
According to your description, you performed transactional replication. But CPU of distributer was pegged at 100% and log reader agent history scanned amount of log records. And CPU became normal after restarting services on the distributer.
Firstly, I would like to deliver some information about log reader agent and distributor to you.
The distributor is a server that contains the distribution database and stores metadata and history data for all types of replication. The distributor can be the same server as the publisher (a local distributor) or it can be a separate server from the publisher
(a remote distributor).
Log reader agent moves transactions marked for replication from the transaction log on the publisher to the distribution database. Each database published using transactional replication has its own log reader agent that runs on the distributor and connects
to the publisher (the distributor can be on the same computer as the publisher).
According to your description, since the CPU is pegged at 100% on distributor, we need to verify if publisher and distributor exist on the same server. If yes, it can make distributor CPU higher. As other post, the distributor is a separate server from the
publisher or you can use a remote distributor. In addition, the server you select as the distributor should have adequate disk space and processor power to support replication and any other activities on that server.
Besides, the log reader has to do much more reading of the log and it consumes lots of CPU resource. From this article: Impact on Log Reader Agent after reindex operations (http://blogs.msdn.com/b/repltalk/archive/2011/03/30/impact-on-log-reader-agent-after-reindex-operations.aspx
), we can know reindex transaction can impact Transactional Replication latency. I suggest you check reindex maintenance plan and use reindex options that generate less records in the transactions logs. For more information, please refer to this article: Impact
on Log Reader Agent after reindex operations (http://blogs.msdn.com/b/repltalk/archive/2011/03/30/impact-on-log-reader-agent-after-reindex-operations.aspx).
Finally, because it is a performance problem, we can use performance monitor to perform troubleshoot. For more information, please refer to this article: Transactional Replication Conversations (
http://blogs.msdn.com/b/chrissk/archive/2009/05/25/transactional-replication-conversations.aspx ).
Best regards,
Qiuyun Yu

HELP: Is it possible to record from multiple video streams using iMovie?

Is it possible to record from multiple video streams using iMovie.
I want to record a presenter on a greenscreen and also his powerpoint slides at the same time and cut from one to other.
Can imovie record from screen and camera at same time?
If so is there a link to somewhere explaining how to do so?
If not, what is the most efficient way to do so, without having to learn a whole complex program?
Please advise asap.
Very many thanks

Alan and Anthony,
Thanks for the quick responses. Unfortunately, there is no backup :(.
I will ask if they get logged into the global zone, but one thing I forgot to mention is that this zone (as are all our non-global zones and the global zone also) are configured for ldap logins.
Assuming that they can even try to login to the global zone, can they even see the directory structure in the non-global zone (sorry, I haven't worked with Zones much thus far) from the global zone?
Also, if they can see the non-global zones directory structure, what should they then try?
Also, I've been searching and I've seen some suggestions of running a "pkgcheck -af" which might restore the directory permissions to what the various packages expect. Assuming that they can get to the point that they can at least log into the zone, is that something that would work?
I'm setting up a new test Solaris box now, with a zone, to try to reproduce the problem. If I can reproduce the problem, I'll post back whether or not I see the same thing.
In the meantime, if anyone has any suggestions, please post them.
Thanks,
Jim
P.S. In case you're wondering, the box/zone that got messed up was a test/integration zone, and they were in the process of installing some software when this chmod happened.

How to send a job log/Spool once the job completed?

Could you please help me how to send a job log/Spool once the job completed.
There was an option is available System Send mail to send a mail once the job completed . So could you please help me how we can send a job log using this option .
I have tried the below but i didn't get any mail . Could some one help this please !
For example :
Job chain name : Test_spool
                Step1 : Reportstep
                                Job definition u2013 XXX_YYY
                Step2: Mailstep
                                Job definition: system_mail_send
Expression : Reportstep,job<(what i need to mention here )>:reportstep/log.txt
Check the ablove mentioned is correct and correct me , still i didnu2019t get the log in the mail please .
Thanks
Ramkumar

Hi Ram,
I need your help on getting mail alert with log file.
here is how i have provide the parameter valure for job definition: system_mail_sent.
Step1 with one job1 and step2 with one job1
In step2 , i have included the job definition to send mail. with below parameter.
Relative Job: Step 1, Job 1
Job File: step 1, job 1: step 1/log.txt
Please let me know if the above method is correct or not.
NOTE: mail server and from address are configured.
Thanks,
Karthik

I use a gmail account for my mail. When I send an email I sometimes get multiple duplicates (up to 10-12) of the same sent message saved in my sent file. help

I use a gmail account for my mail. When I send an email I sometimes get multiple duplicates (up to 10-12) of the same sent message saved in my sent file. help

Did you check your user name and password in Settings>Mail,Contacts,Calendars...tap your email account, tap SMTP, then tap the primary server name. Make sure the settings there are correct.

Possible to send the 50,000 records at a time using proxy?

Hi All,
I am using the proxy to send the data form SAP to PI and then send it to Receciver by using JMS. Here i have a small issue.... is it possible to send the 50,000 records at a time using proxy? If not please suggest me how can i send bulk of records through proxy?
Thanks
Karthik.

is it possible to send the 50,000 records at a time using proxy? If not please suggest me how
can i send bulk of records through proxy?
you can try this in steps...do not go for a BigBang testing :)....check how much your XI system can handle at a time...then you may need to tune the system parameters to accomodate more message size.....how to do this??...check the below document..section 3.9.2 (Special Cases)
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/2016a0b1-1780-2b10-97bd-be3ac62214c7
Regards,
Abhishek.

Sender port in control record

Hey guys
i m trying to test my IDOC to FIle scenario and in WE19 i m getting an error with status 37 saying that sender port in control records is invalid.
i have created the Sender port correctly in WE21,what might the problem be?
thanx
ahmad

HI,
As you said you have created the port with WE21.
Did you checked , RFC destination which was configured in Port creation , what was the user ,pwd you used,does that user has the proper authorization , did you checked remote login for RFC destination,generally SAPxxx for port name, did you selected the version which was selected.
let me know what is the correct error.
Regards
Chilla..

What's the best way to insert/update thousands records in multiple tables

Can anyone give an example of how to insert/update thousands records in multiple tables on performance wise? or what should I do to improve the performance?
Thanks
jim

You can see a set of sample applications in various scenarious available at
http://otn.oracle.com/sample_code/tech/java/sqlj_jdbc/content.html

Log messages from multiple instances in single file.

Hi!
I have a requirement that i need to log messages from muliple instances of the same object in a file. The new file will be created every day. Likewise, multiple objects might have various instances each.
One class
->multiple instances
-> log message stored in single file.
Note :
I am using the Message driven bean. I need to log from the bean class. JDK 1.3
If u could help me out that would be great.

As long as they are all from the same OS program (a single Java VM), that's OK - you can use Log4j, and use a rotating file logger.
If you point two different virtual machine processes at the same file, one may have it open when the other is trying to rotate it, and your rotation may fail (at best) and/or you may lose the old log (the worst case).
If you need to collect log messages from multiple processes (or even multiple machines), use a syslog-based logger (Log4j has a SyslogAppender) or use Log4j's SocketAppender to write to a log4j-builtin log listener (SocketNode).

Sending AAA accouting log records to multiple AAA servers

Similar Messages

Maybe you are looking for