TACACS+ Server not logging events.

Question

Hi all,
I am having an issue with the tacacs+ server not logging login requests or commands entered. I am running the tac_plus.F4.0.4.alpha release that cisco provides for free on a mandrake 10.1 linux box. I am able to use the server to authenticate logins to the routers but it is not logging those requests.
Here is the config I used on one of our routers.
aaa group server tacacs+ prego
server xxx.xxx.xxx.xxx
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
aaa accounting exec default start-stop group prego
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common
ip subnet-zero
Also here is a sh verion
Cisco Internetwork Operating System Software
IOS (tm) 3700 Software (C3725-IS-M), Version 12.2(15)ZJ3, EARLY DEPLOYMENT RELEASE SOFTWARE (fc2)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Thu 25-Sep-03 22:23 by eaarmas
Image text-base: 0x60008954, data-base: 0x61C2C000
ROM: System Bootstrap, Version 12.2(8r)T2, RELEASE SOFTWARE (fc1)
ROM: 3700 Software (C3725-I-M), Version 12.2(8)T10, RELEASE SOFTWARE (fc1)
PRVGW3725 uptime is 10 weeks, 1 day, 7 hours, 35 minutes
System returned to ROM by power-on
System image file is "flash:c3725-is-mz.122-15.ZJ3.bin"
cisco 3725 (R7000) processor (revision 0.1) with 121856K/9216K bytes of memory.
Processor board ID JMX0749L1XC
R7000 CPU at 240Mhz, Implementation 39, Rev 3.3, 256KB L2 Cache
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
2 FastEthernet/IEEE 802.3 interface(s)
2 Serial network interface(s)
DRAM configuration is 64 bits wide with parity disabled.
55K bytes of non-volatile configuration memory.
31360K bytes of ATA System CompactFlash (Read/Write)
Configuration register is 0x2102
Any help would be great.
Thank you
Joseph Jackson

Answer 1

If you are able to authenticate via TACACS I would believe that this indicates that there is not a problem with your configuration of the TACACS server(s) (addresses are correct, keys are correct, etc) and that the TACACS server recognizes the router ok.
So I assume that either there is some problem on the router generating the accounting records. Or that there might be a problem on the server and receiving and processing the accounting records.
As a next step in investigating this issue I suggest that you run two debugs on the router:
debug aaa accounting
debug tacacs accounting
While the debug is running have someone access the router and login, access privilege mode, and execute several commands. Then post any debug output.
HTH
Rick