about ACS log information.

zixu · ‎08-14-2006

Hi expert,

my customer got some alerts from his ACS log, see below:

TCS 08/01/2006 00:01:08 E 1935 3556 Failed to obtain callback type for user profile getconfig

TCS 08/01/2006 00:01:09 E 1935 3556 Failed to obtain callback type for user profile getconfig

CS 08/01/2006 00:07:47 E 0269 0544 Single connect Pipeline recived unexpected pac seq_non (NAS: 11.8.254.100 socket b78 session id 527f740 seq 9)

TCS 08/01/2006 00:07:49 E 0269 0544 Single connect Pipeline recived unexpected pac seq_non (NAS: 11.8.254.100 socket b78 session id 4f36f254 seq 9)

TCS 08/01/2006 00:07:50 E 0269 0544 Single connect Pipeline recived unexpected pac seq_non (NAS: 11.8.254.100 socket b78 session id 6e91e9a seq 7)

who can give an explain or tech me where i can find some stuff to interpret it?

Thanks a lot.

Eric

darpotter · ‎08-15-2006

Hi

The first group means that CSTacacs asked CSAuth for some data (in this case for callback) and it looks like CSAuth possibly didnt respond. It could be that CSauth was down, replicating etc or in fact just returned an unexpected error code to CSTacacs. You'd have to look in the csauth log file for the same time to see what it was doing.

The second batch indicate that the nas sent a T+ packet with an out-sequence msg id. This tells ACS either the NAS missed a response or some requests have got lost.

Darran

zixu · ‎08-15-2006

Hi Darran,

Thanks for your quickly reply. router's related configuration is followed:

aaa new-model

aaa authentication login default tacacs+ local

aaa authentication enable default tacacs+ enable

aaa authorization exec default tacacs+ local

aaa authorization commands 1 default tacacs+ local

aaa authorization commands 15 default tacacs+ local

aaa authorization network default tacacs+ local

aaa accounting exec default start-stop tacacs+

aaa accounting commands 1 default start-stop tacacs+

aaa accounting commands 15 default start-stop tacacs+

aaa accounting network default start-stop tacacs+

ip tacacs source-interface Loopback0

tacacs-server host 11.4.254.108

tacacs-server key

could you please tell me what kind of operation will make such alert and how i can avoid it?

thanks again.