hi all
i am not sure if this is the right place for this question, sorry if it is not
i need to parse the logs of tacacs accounting for ppp (cisco secure 2.4). i know that the start and stop of the ppp conection are logged, and the acct_flags is the one that tells what the record was for.
acct_flags is either a string or a number depending of the type of logging, if the logs are in CSV it is a string, if the logs are redirected to some RDBMS (SQL server for example) then it is a number
i know that when it is (2 or 'start') it means "start of the connection"
and when it is('4' or 'stop') it means "end of connection" and the record also contains elapsed_time.
what bothers me is the that sometimes i get 512 or "nas port re-used" value for acct_flags and it still has some elapsed_time in that record.
i couldnt find any information what this means ?
especially the sequence 2,4,512 (start, stop, nas-port reused ??? )
any help would be greatly appreciated
thanx in advance