Specifications

Accounting
25-8
When Events Are Logged
Introduction
This section describes when each specific event type is logged.
Login Events
Login events are logged at the time of the successful login (just before the user
gets the Local> prompt). Unsuccessful login attempts are handled by Kerberos
Password Fail, Login Password Fail, or Remote Password Fail events.
Logout Events
Logout events are stored when the port is logged out. There is always an
associated login event.
Session Connect Attempt Events
Session connect attempt events are stored when a session connect is being
attempted (either user-initiated or dedicated). All attempts are logged whether
they are successful or not.
Session Disconnect Events
Session disconnect events are logged when a session connect attempt fails or
when an existing session is terminated. There is always an associated session
connect attempt event. Use the disconnect reason or bytes Tx/Rx to determine
whether the connection attempt was successful.
Password Fail Events
Password fail (Kerberos, Privilege, Maintenance, Login, Remote) events are
logged for every attempt to enter the associated password.
SNMP Community Fail Events
SNMP community fail events are logged whenever an SNMP access attempt is
made with a community name and/or source IP address that is not enabled on
the access server.