parsing of tacacs accounting logs

[alextr75]

hi all

i am not sure if this is the right place for this question, sorry if it is not

i need to parse the logs of tacacs accounting for ppp (cisco secure 2.4). i know that the start and stop of the ppp conection are logged, and the acct_flags is the one that tells what the record was for.

acct_flags is either a string or a number depending of the type of logging, if the logs are in CSV it is a string, if the logs are redirected to some RDBMS (SQL server for example) then it is a number

i know that when it is (2 or 'start') it means "start of the connection"

and when it is('4' or 'stop') it means "end of connection" and the record also contains elapsed_time.

what bothers me is the that sometimes i get 512 or "nas port re-used" value for acct_flags and it still has some elapsed_time in that record.

i couldnt find any information what this means ?

especially the sequence 2,4,512 (start, stop, nas-port reused ??? )

any help would be greatly appreciated

thanx in advance

[ciscomoderator]

Since there has been no response to your post, it appears to be either too complex or too rare an issue for other forum members to assist you. If you don't get a suitable response to your post, you may wish to review our resources at the online Technical Assistance Center (http://www.cisco.com/tac) or speak with a TAC engineer. You can open a TAC case online at http://www.cisco.com/tac/caseopen

If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.