Specifications

3-253
Cisco Wide Area Application Services Command Reference
OL-11817-01
Chapter 3 CLI Commands
(config) aaa accounting
Usage Guidelines The AAA accounting feature enables you to track the activities of an administrative user, services that
users access, and the amount of network resources they consume (for example, connection time or the
bytes transferred). You can use the AAA accounting feature to track user activity for billing, auditing,
reporting, or security purposes. WAAS uses TACACS+ to implement AAA accounting; RADIUS is not
currently supported. When AAA accounting is enabled, the WAAS device reports user activity to the
TACACS+ security server in the form of accounting records. This data can then be analyzed for network
management, client billing, and auditing.
You can activate accounting for the following types of events:
• EXEC—EXEC shell accounting is used to report the events of an administrator logging in and out
of the EXEC shell through Telnet, FTP, or SSH (SSH Version 1 or Version 2). This type of
accounting records information about user EXEC terminal sessions (user shells) on the WAAS
device, including username, date, start and stop times for each session, time zone, and IP address of
the system used to access the WAAS device. The EXEC shell accounting information can be
accessed through the accounting log file on the TACACS+ server. This log file uses the following
report format for this type of accounting information:
WeekDay#Month#Day#Time#Year#CEaddress#username#terminal#RemoteHost#Event#
EventTime#TaskId#Timezone#Service
• Command—The WAAS device records information about the CLI commands that were executed on
the WAAS device. Each command accounting record includes the executed command syntax,
username of the user who executed the command, the privilege level of the user, and the date and
time that each command was executed. The WAAS device supports two privilege levels, 0 and 15,
representing normal users and administrative users, respectively. The command accounting
information can be accessed through the accounting log file on the TACACS+ server. This log file
uses the following report format for this type of accounting information:
WeekDay#Month#Day#Time#Year#CEaddress#username#terminal#RemoteHost#Event#
EventTime#TaskId#Timezone#Service#PrivilegeLevel#CLICommand
• System—The WAAS device records information about all system-level events (for example, when
the system reboots). You can access the system accounting information through the accounting log
file on the TACACS+ server. This log file uses the following report format for this type of accounting
information:
WeekDay#Month#Day#Time#Year#CEaddress#username#terminal#RemoteHost#Event#
EventTime#TaskId#Timezone#SystemService#SystemAccountingEvent#EventReason
WAAS software supports only the default accounting list.
Caution Before using the wait-start option, make sure that the WAAS device is configured with the TACACS+
server and is able to successfully contact the server. If the WAAS device cannot contact a configured
TACACS+ server, it might become unresponsive.
The WAAS software displays the following warning message if the wait-start option is configured:
Warning: The device may become non-responsive if it cannot contact a configured TACACS+
server.
The administrator is asked to confirm the configuration in an indefinite loop until the administrator
enters “yes” to the following prompt:
Are you sure you want to proceed? [yes]