Cisco IOS Cookbook, 2nd Edition

Logging System Events

Problem

You want to log various system events.

Solution

AAA Accounting includes the ability to log a variety of system events, including timestamps, along with associated usernames:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#aaa new-model
Router1(config)#aaa accounting exec default start-stop group tacacs+
Router1(config)#aaa accounting connection default start-stop group tacacs+
Router1(config)#aaa accounting system default stop-only group tacacs+
Router1(config)#end
Router1#

Discussion

In addition to capturing keystroke logs, AAA accounting can gather other useful pieces of information, such as exec, connection, and system events:

exec

This feature captures and timestamps the beginning and ending of a user’s Exec session on the router.

connection

This allows you to gather information about outgoing connections using an interactive protocol such as Telnet, SSH, or RSH.

system

When you enable this feature, AAA forwards information about system events such as router reboots or the disabling of AAA accounting.

Here is an example of an exec log entry:

Fri Jan  3 11:11:40 2003        toronto ijbrown tty67   172.25.1.1      start   task_id=514 start_time=1041610300   timezone=EST    service=shell

Fri Jan  3 11:18:47 2003        toronto ijbrown tty67   172.25.1.1      stop    task_id=514 start_time=1041610300   timezone=EST    service=shell   disc-cause=1   disc-cause-ext=1020 connect-progress=101    elapsed_time=427        nas-rx-speed=0  nas-tx-speed=0

These two records show that user ijbrown logged into router toronto at 11:11:40 AM on January 3rd, 2003, and stayed connected for 427 seconds. This information is useful for security auditing, and also can be used for billing purposes, if required. For example, if you are using this router to provide PAD or terminal server services to paying customers, this would be an ideal way to gather billing information.

Here is an example of a connection log event:

Fri Jan  3 11:30:19 2003        toronto ijbrown tty67   172.25.1.1      stop    task_id=522start_time=1041611404   timezone=EST    service=connection      protocol=telnet addr=10.2.2.2 cmd=telnet 10.2.2.2     pre-bytes-in=0  pre-bytes-out=0 pre-paks-in=0   pre-paks-out=0  bytes_in=1843   bytes_out=81    paks_in=43      paks_out=50     connect-progress=47     elapsed_time=15 nas-rx-speed=0  nas-tx-speed=0

In this record, you can see that user ijbrown initiated a Telnet session to IP address 10.2.2.2 and terminated it 15 seconds later. And you can even see the total number of bytes and packets both sent and received by the Telnet process.

The system event log entries look like this:

Fri Jan  3 11:35:19 2003        toronto unknown unknown unknown stop    task_id=265 start_time=1041611719   timezone=EST    service=system  event=sys_acct  reason=shutdown

Fri Jan  3 11:37:35 2003        toronto unknown unknown unknown start   task_id=1 timezone=EST    service=system  event=sys_acct  reason=reload

These records show that somebody reloaded the router called toronto at 11:35 on January 3, 2003. It came back up at 11:37, some 2 minutes later. Notice that the system event logging did not capture information on the user who submitted the reload command. That information could be captured using command logging.

Actually, this points out an interesting side benefit to capturing this information on a central server. If you were just using regular system logging in the router’s log buffer, this information would be lost during the reboot. However, by storing system events on the TACACS+ server, you don’t lose anything when the router reboots. For more information regarding logging, please see Chapter 18.

See Also

Recipe 4.5; Recipe 4.8; Chapter 18