Cisco ACS - determine who was in a particular device

[Steve Coady]

Hello

How can I determine who was in a particular device at a specific day/time?

[Jatin Katyal · Accepted solution]

Hi Steve,

You can use "query and run" inside the tacacs or radius accounting section on ACS 5. The exec accounting provides information about user EXEC terminal sessions (user shells) on the network access server, including username, date, start and stop times, the access server IP address. 

If you want to see what changes were made by a specific user then that can only be checked if command accounting is enabled on the Network Access Device. Command accounting provides information about the EXEC shell commands for a specified privilege level that are being executed on a network access server. Each command accounting record includes a list of the commands executed for that privilege level, as well as the date and time each command was executed, and the user who executed it. Remember command accounting is only supported by tacacs+.

Regards,

Jatin Katyal

**Do rate helpful posts**

[Steve Coady]

Jatin

Thank you for the reply. My apologies for the delay in providing points!