Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Cisco ACS - determine who was in a particular device

Hello

 

How can I determine who was in a particular device at a specific day/time?

sMc
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Hi Steve,You can use "query

Hi Steve,

You can use "query and run" inside the tacacs or radius accounting section on ACS 5. The exec accounting provides information about user EXEC terminal sessions (user shells) on the network access server, including username, date, start and stop times, the access server IP address. 

If you want to see what changes were made by a specific user then that can only be checked if command accounting is enabled on the Network Access Device. Command accounting provides information about the EXEC shell commands for a specified privilege level that are being executed on a network access server. Each command accounting record includes a list of the commands executed for that privilege level, as well as the date and time each command was executed, and the user who executed it. Remember command accounting is only supported by tacacs+.

 

Regards,

Jatin Katyal

**Do rate helpful posts**

~Jatin Katyal
2 REPLIES
Cisco Employee

Hi Steve,You can use "query

Hi Steve,

You can use "query and run" inside the tacacs or radius accounting section on ACS 5. The exec accounting provides information about user EXEC terminal sessions (user shells) on the network access server, including username, date, start and stop times, the access server IP address. 

If you want to see what changes were made by a specific user then that can only be checked if command accounting is enabled on the Network Access Device. Command accounting provides information about the EXEC shell commands for a specified privilege level that are being executed on a network access server. Each command accounting record includes a list of the commands executed for that privilege level, as well as the date and time each command was executed, and the user who executed it. Remember command accounting is only supported by tacacs+.

 

Regards,

Jatin Katyal

**Do rate helpful posts**

~Jatin Katyal
Community Member

Jatin Thank you for the reply

Jatin

 

Thank you for the reply. My apologies for the delay in providing points!

sMc
26
Views
0
Helpful
2
Replies
CreatePlease to create content