Table of Contents

Working with Logging and Reports

Cisco Secure Access Control Server for Windows NT/2000 Servers Version 3.0 (Cisco Secure ACS) produces a wide variety of logs and provides a way to view most of these logs in the Cisco Secure ACS HTML interface as HTML reports. This chapter contains the following topics about logging:

Logging Formats

Cisco Secure ACS logs a variety of user and system activities. Depending on the log, and how you have configured Cisco Secure ACS, logs can be recorded in one of two formats:

For information about the formats available for a specific log, see the "About Cisco Secure ACS Logs and Reports" section.

Special Logging Attributes

Among the many attributes that Cisco Secure ACS can record in its CSV or ODBC logs, a few are of special importance. The following list explains the special logging attributes provided by Cisco Secure ACS.

The content of these attributes is determined by the values entered in the corresponding fields in the user account. For more information about user-defined attributes, see the "User Data Configuration Options" section.

For more information about configuring the content of CSV logs, see the "Configuring a CSV Log" section. For more information about configuring the content of an ODBC log, see the "Configuring an ODBC Log" section.

The Filter Information attribute is available for Passed Authentication and Failed Attempts logs.

The Device Command Set attribute is available for Passed Authentication and Failed Attempts logs.

Update Packets In Accounting Logs

Whenever you configure Cisco Secure ACS to record accounting data for user sessions, Cisco Secure ACS records start and stop packets. If you want, you can configure Cisco Secure ACS to record update packets, too. In addition to providing interim accounting information during a user session, update packets drive password expiry messages via CiscoSecure Authentication Agent. In this use, the update packets are referred to as watchdog packets.

Note   To record update packets in Cisco Secure ACS accounting logs, you must configure your AAA clients to send the update packets. For more information about configuring your AAA client to send update packets, refer to the documentation for your AAA clients.

For more information on setting this option for a AAA client, see the "Adding and Configuring a AAA Client" section.

For more information on setting this option for a AAA server, see the "Adding and Configuring a AAA Server" section.

About Cisco Secure ACS Logs and Reports

The logs that Cisco Secure ACS provides can be divided into four groups:

This section contains information about the first three groups. For information about service logs, see the "Service Logs" section.

Accounting Logs

Accounting logs contain information about the use of remote access services by users. By default, these logs are available in CSV format. With the exception of the Passed Authentications log, you can also configure Cisco Secure ACS to export the data for these logs to an ODBC-compliant relational database that you configure to store the log data.

The accounting logs include:

TACACS+ Accounting Log

The TACACS+ Accounting log contains the following information:

Topics regarding this log include the following:

For instructions on configuring the CSV TACACS+ Accounting log, see the "Configuring a CSV Log" section.

TACACS+ Administration Log

The TACACS+ Administration log lists configuration commands entered on a AAA client using TACACS+ (Cisco IOS). Particularly if you use Cisco Secure ACS to perform command authorization, we recommend that you use this log.

Note   To use the TACACS+ Administration log, your TACACS+ AAA clients must be configured to perform command accounting with Cisco Secure ACS.

Topics regarding this log include the following:

For instructions on configuring the CSV TACACS+ Administration log, see the "Configuring a CSV Log" section.

RADIUS Accounting Log

The RADIUS Accounting log contains the following information:

You can configure Cisco Secure ACS to include accounting for Voice over IP (VoIP) in the RADIUS Accounting log, in a separate VoIP accounting log, or in both places.

Topics regarding this log include the following:

For instructions on configuring the CSV RADIUS Accounting log, see the "Configuring a CSV Log" section.

VoIP Accounting Log

The VoIP Account log contains the following information:

You can configure Cisco Secure ACS to include accounting for VoIP in this separate VoIP accounting log, in the RADIUS Accounting log, or in both places.

Topics regarding this log include the following:

For instructions on configuring the CSV VoIP Accounting log, see the "Configuring a CSV Log" section.

Failed Attempts Log

The Failed Attempts log lists authentication and authorization failures with an indication of the cause.

Topics regarding this log include the following:

For instructions on configuring the CSV Failed Attempts log, see the "Configuring a CSV Log" section.

Passed Authentications Log

The Passed Authentications log lists successful authentication requests. This log is not dependent upon accounting packets from your AAA clients, so it is available even if your AAA clients do not support RADIUS accounting or if you have disabled accounting on your AAA clients.

Topics regarding this log include the following:

The default location for Passed Authentications files is Program Files\CiscoSecure ACS x.x\Logs\Passed Authentications.

For instructions on configuring the CSV Passed Authentications log, see the "Configuring a CSV Log" section.

Dynamic Cisco Secure ACS Administration Reports

These reports show the status of user accounts at the moment they are accessed. They are available only in the Cisco Secure ACS HTML interface.

The Dynamic Cisco Secure ACS Administration reports include:

Logged-In Users Report

The Logged-in Users report lists all users currently receiving services for a single AAA client or all AAA clients with access to Cisco Secure ACS.

Note   To use the logged-in user list feature, your AAA client must perform authentication and accounting using the same protocol—either TACACS+ or RADIUS.

Topics regarding this report include the following:

Viewing the Logged-in Users Report

To view the Logged-in Users report, follow these steps:

Step 2   Click Logged-in Users.

Result: The Select a AAA Client page displays the name of each AAA client, its IP address, and the number of users logged in through the AAA client. At the bottom of the table, the All AAA Clients entry shows the total number of users logged in.

Tip You can sort the table by any column's entries, in either ascending or descending order. Click a column title once to sort the table by that column's entries in ascending order. Click the column a second time to sort the table by that column's entries in descending order.

Step 3   Do one of the following:

Result: Cisco Secure ACS displays a table of users logged in, including the following information:

Tip You can sort the table by any column's entries, in either ascending or descending order. Click a column title once to sort the table by that column's entries in ascending order. Click the column a second time to sort the table by that column's entries in descending order.

Deleting Logged-in Users

From a Logged-in Users Report, you can instruct Cisco Secure ACS to delete users logged into a specific AAA client. When a user session terminates without a AAA client sending an accounting stop packet to the Cisco Secure ACS server, the Logged-in Users Report continues to show the user. Deleting logged-in users from a AAA client ends the accounting for those user sessions.

Note   Deleting logged-in users only ends the Cisco Secure ACS accounting record of users logged in to a particular AAA client. It does not terminate active user sessions, nor does it affect user records.

To delete logged-in users, follow these steps:

Step 2   Click Logged-in Users.

Result: The Select a AAA Client page displays the name of each AAA client, its IP address, and the number of users logged in through the AAA client. At the bottom of the table, the All AAA Clients entry shows the total number of users logged in.

Step 3   Click the name of the AAA client whose users you want to delete from the Logged-in Users report.

Result: Cisco Secure ACS displays a table of all users logged in through the AAA client. The Purge Logged in Users button appears below the table.

Step 4   Click Purge Logged in Users.

Result: Cisco Secure ACS displays a message, indicating the number of users purged from the report and the IP address of the AAA client.

Disabled Accounts Report

The Disabled Accounts report lists all user accounts that are currently disabled and the reason they were disabled.

Topics regarding this report include the following:

Viewing the Disabled Accounts Report

To view the Disabled Accounts report, follow these steps:

Step 2   Click Disabled Accounts.

Result: The Select a user account to edit page displays disabled user accounts, the account status, and the group to which the user account is assigned.

Step 3   To edit a user account listed, in the User column, click the username.

Result: Cisco Secure ACS opens the user account for editing.

For more information about editing a user account, see the "Basic User Setup Options" section.

Cisco Secure ACS System Logs

The system logs are logs about the Cisco Secure ACS system and therefore record system-related events. These logs are primarily useful for troubleshooting or audits. They are only available in CSV format. The system logs include the following:

ACS Backup and Restore Log

The ACS Backup and Restore log lists Cisco Secure ACS backup and restore activity.

Topics regarding this log include the following:

The default location for ACS Backup and Restore files is Program Files\CiscoSecure ACS vx.x\Logs\Backup and Restore.

RDBMS Synchronization Log

The RDBMS Synchronization log lists RDBMS Synchronization activity.

Topics regarding this log include the following:

The default location for RDBMS Synchronization files is Program Files\CiscoSecure ACS vx.x\Logs\DbSync.

Database Replication Log

The Database Replication log lists database replication activity.

Topics regarding this log include the following:

The default location for RDBMS Synchronization files is Program Files\CiscoSecure ACS vx.x\Logs\DBReplicate.

Administration Audit Log

The Administration Audit log lists actions taken by each system administrator, such as adding users, editing groups, configuring a AAA client, or viewing reports.

Topics regarding this log include the following:

The default location for Administration Audit files is Program Files\CiscoSecure ACS vx.x\Logs\AdminAudit.

For instructions on configuring the Administration Audit log, see the "Configuring the Administration Audit Log" section.

Configuring the Administration Audit Log

To configure the Administrative Audit log, follow these steps:

Step 2   Click Audit Policy.

Result: The Audit Policy Setup page appears.

Step 3   To generate a new Administrative Audit CSV file at a regular interval, select one of the following options:

Step 4   To generate a new Administrative Audit CSV file when the current file reaches a specific size, select the When size is greater than x KB option and type the file size threshold in kilobytes in the x box.

Step 5   To manage which Administrative Audit CSV files Cisco Secure ACS keeps, follow these steps:

Step 6   Click Submit.

Result: Cisco Secure ACS saves and implements the Administrative Audit log settings you specified.

ACS Service Monitoring Log

The ACS Service Monitoring log lists when ACS services start and stop.

Topics regarding this log include the following:

The default location for ACS Service Monitoring files is Program Files\CiscoSecure ACS vx.x\Logs\ServiceMonitoring.

Working with CSV Logs

This section contains the following topics:

CSV Log File Names

When you access a report in Reports and Activity, Cisco Secure ACS lists the CSV files in chronological order, with the current CSV file at the top of the list. The current file is named log.csv, where log is the name of the log.

Older files are named in the following format:

where

log is the name of the log.

yyyy is the year the CSV file was started.

mm is the month the CSV file was started, in numeric characters.

dd is the date the CSV file was started.

For example, a Database Replication log file that was generated on October 13, 1999, would be named Database Replication 1999-10-13.csv.

If you have selected the day-month-year format under Interface Configuration: Date Format Control, this log file would be named Database Replication 1999-13-10.csv.

Enabling or Disabling a CSV Log

This procedure describes how to enable or disable a CSV log. For instructions about configuring the content of a CSV log, see the "Configuring a CSV Log" section.

The logs to which this procedure applies are:

To enable or disable a CSV log, follow these steps:

Step 2   Click Logging.

Step 3   Click the name of the CSV log you want to enable.

Result: The CSV log Comma-Separated Values File Configuration page appears, where log is the name of the CSV log you selected.

Step 4   To enable the log, under Enable Logging, select the Log to CSV log report check box, where log is the name of the CSV log you selected in Step 3.

Step 5   To disable the log, under Enable Logging, clear the Log to CSV report log check box, where log is the name of the CSV log you selected in Step 3.

Step 6   Click Submit.

Result: If you enabled the log, Cisco Secure ACS begins logging information for the log selected. If you disabled the log, Cisco Secure ACS stops logging information for the log selected.

Viewing a CSV Report

The reports to which this procedure applies are:

When you select Logged-in Users or Disabled Accounts, a list of logged-in users or disabled accounts appears in the display area, which is the frame on the right side of the web browser. For all other types of reports, a list of applicable reports appears. Files are listed in chronological order, with the most recent file at the top of the list. The reports are named and listed by the date on which they were created; for example, 1999-10-05.csv was created on October 5, 1999.

Note   If you select Day/Month/Year format, a file created on 5 October 1999 is named 1999-05-10. For instructions, see the "Date Format Control" section on.

Files in CSV format can be imported into spreadsheets using most popular spreadsheet application software. Refer to your spreadsheet software manufacturer's documentation for instructions.

You can download the CSV file for any CSV report you view in Cisco Secure ACS. The procedure below includes steps for doing so.

To view a CSV report, follow these steps:

Step 2   Click the name of the CSV report you want to view.

Result: On the right side of the browser, Cisco Secure ACS lists the current CSV report file name and the file names of any old CSV report files.

Tip You can configure how Cisco Secure ACS handles old CSV report files. For more information, see the "Configuring a CSV Log" section.

Step 3   Click the CSV report file name whose contents you want to view.

Result: If the CSV report file contains information, the information appears in the display area.

Tip You can sort the table by any column's entries, in either ascending or descending order. Click a column title once to sort the table by that column's entries in ascending order. Click the column a second time to sort the table by that column's entries in descending order.

Tip To check for newer information in the current CSV report, click Refresh.

Step 4   If you want to download the CSV log file for the report you are viewing, follow these steps:

Result: Your browser displays a dialog box for accepting and saving the CSV file.

Configuring a CSV Log

This procedure describes how to configure the content of a CSV log. For instructions about enabling or disabling a CSV log, see the "Enabling or Disabling a CSV Log" section.

The logs to which this procedure applies are:

You can configure several aspects of a CSV log:

To configure a CSV log, follow these steps:

Step 2   Click Logging.

Step 3   Click the name of the CSV log you want to enable.

Result: The CSV log Comma-Separated Values File Configuration page appears, where log is the name of the CSV log you selected.

The Select Columns To Log table contains two lists, Attributes and Logged Attributes. The attributes in the Logged Attributes list appear on the log selected.

Step 4   To add an attribute to the log, select the attribute in the Attributes list, and then click —> (right arrow button).

Result: The attribute moves to the Logged Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list box.

Step 5   To remove an attribute from the log, select the attribute in the Logged Attributes list, then click <— (left arrow button).

Result: The attribute moves to the Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list.

Step 6   To set the attributes in the Logged Attributes list back to the default selections, at the bottom of the browser window, click Reset Columns.

Step 7   To generate a new CSV file at a regular interval, select one of the following options:

Step 8   To generate a new CSV file when the current file reaches a specific size, select the When size is greater than x KB option and type the file size threshold, in kilobytes, in the x box.

Step 9   To manage which CSV files Cisco Secure ACS keeps, follow these steps:

Step 10   Click Submit.

Result: Cisco Secure ACS implements the CSV log configuration that you specified.

Working with ODBC Logs

This section contains procedures for the following topics:

Preparing to Use ODBC Logging

If you plan to use ODBC logging, there are several steps you must complete before you configure an ODBC log.

To prepare to use ODBC logging, follow these steps:

Step 2   Set up a system data source name (DSN) on the Cisco Secure ACS server. For instructions, see the "Configuring a System Data Source Name for ODBC Logging" section.

Step 3   Enable ODBC logging in the Cisco Secure ACS HTML interface:

Result: Cisco Secure ACS enables the ODBC logging feature. On the Logging page, in the System Configuration section, Cisco Secure ACS displays links for configuring ODBC logs.

Result: You can now configure individual ODBC logs. For instructions, see the "Configuring an ODBC Log" section.

Configuring a System Data Source Name for ODBC Logging

On the Cisco Secure ACS server, you must create a system DSN for Cisco Secure ACS to communicate with the relational database that is to store your logging data.

To create a system DSN for use with ODBC logging, follow these steps:

Step 2   In the ODBC Data Source Administrator page, click the System DSN tab.

Step 3   Click Add.

Step 4   Select the driver you need to use with your new DSN, and then click Finish.

Result: A dialog box displays fields requiring information specific to the ODBC driver you selected.

Step 5   Type a descriptive name for the DSN in the Data Source Name box.

Step 6   Complete the other fields required by the ODBC driver you selected. These fields may include information such as the IP address of the server on which the ODBC-compliant relational database runs.

Step 7   Click OK.

Step 8   Close the ODBC window and Windows Control Panel.

Result: The System DSN to be used by Cisco Secure ACS for communication with the relational database is created on your Cisco Secure ACS server. The name you assigned to the DSN appears in the Data Source list on each ODBC log configuration page.

Configuring an ODBC Log

The logs to which this procedure applies are:

To configure an ODBC log, follow these steps:

Step 2   Click Logging.

Step 3   Click the name of the ODBC log you want to enable.

Result: The ODBC log Configuration page appears, where log is the name of the ODBC log you selected.

The Select Columns To Log table contains two lists: Attributes and Logged Attributes. When you first access the ODBC configuration page for a log, the Logged Attributes list contains the default set of attributes. Cisco Secure ACS includes in the log only those attributes that are in the Logged Attributes list.

Step 4   Specify the attributes that you want Cisco Secure ACS to send to the relational database:

Result: The attribute moves to the Logged Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list box.

Result: The attribute moves to the Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list box.

Step 5   In the ODBC Connection Settings table, follow these steps:

---

Note    The user must have sufficient privileges in the relational database to write the ODBC logging data to the appropriate table.

---

Step 6   Click Submit.

Result: Cisco Secure ACS saves the log configuration.

Step 7   Click the name of the ODBC log you are configuring.

Result: Cisco Secure ACS displays the ODBC log configuration page again.

Step 8   Click Show Create Table.

Result: The right side of the browser displays an SQL create table statement for Microsoft SQL Server. The table name is the name specified in the Table Name box. The column names are the attributes specified in the Logged Attributes list.

Note   The generated SQL is valid for Microsoft SQL Server only. If you are using another relational database, refer to your relational database documentation for information about writing a command to create a table.

Step 9   Using the information provided in the generated SQL, create a table in your relational database for this ODBC log.

---

Note    In order for ODBC logging to work, the table name and the column names must match exactly the names in the generated SQL.

---

Step 10   Continuing in Cisco Secure ACS, access the configuration page for the ODBC log you are configuring:

Result: The ODBC log Configuration page appears, where log is the name of the ODBC log you selected.

Step 11   Select the Log to ODBC log report check box, where log is the name of the ODBC log you selected.

Step 12   Click Submit.

Result: Cisco Secure ACS begins sending logging data to the relational database table specified, using the system DSN you configured.

Remote Logging

This section discusses remote logging capabilities of Cisco Secure ACS. It contains the following topics:

About Remote Logging

The Remote Logging feature enables you to centralize accounting logs generated by multiple Cisco Secure ACS servers. You can configure each Cisco Secure ACS to point to a single Cisco Secure ACS that is to be used as the logging server. The logging Cisco Secure ACS server can still perform its AAA duties, but it also is the repository for accounting logs it receives. For more information about Cisco Secure ACS accounting logs, see the "Accounting Logs" section.

The Remote Logging feature sends accounting data received from AAA clients by the local Cisco Secure ACS server directly to the CSLOG service on the remote logging server, where the accounting data is written to the logs. The logging server generates the accounting logs in the formats it is configured to use—CSV and ODBC—regardless of the local logging configuration on the servers sending the data to the logging server.

Note   The Remote Logging feature does not affect the forwarding of accounting data for proxied authentication requests. Cisco Secure ACS only applies Remote Logging settings to accounting data for sessions authenticated by proxy when accounting data for sessions authenticated by proxy is logged locally. For more information about proxied authentication requests and accounting data for sessions authenticated by proxy, see the "Proxy Distribution Table Configuration" section.

Remote Logging Options

Cisco Secure ACS provides the remote logging options listed below. These options appear on the Remote Logging page, available from the Logging page in the System Configuration section.

Configuring a Central Logging Server

A central logging server is a Cisco Secure ACS server that is to receive accounting data from Cisco Secure ACS servers configured to do remote logging. Configuring a central logging server consists entirely of making sure that all Cisco Secure ACS servers that are to send their accounting data are defined in the central logging server's AAA Servers table.

For each Cisco Secure ACS server that the central logging server is to log watchdog and update packets, be sure that the Log Update/Watchdog Packets from this remote AAA Server check box is selected in that server's entry in the central logging server's AAA Servers table.

For more information about the AAA Servers table, see the "AAA Server Configuration" section.

Enabling and Configuring Remote Logging

Note   Before configuring the Remote Logging feature on a Cisco Secure ACS server, make sure that you have configured your central logging server. For more information, see the "Configuring a Central Logging Server" section.

To enable and configure remote logging, follow these steps:

Result: Cisco Secure ACS displays the Remote Logging link on the Logging page in the System Configuration section.

Step 2   Click System Configuration.

Step 3   Click Logging.

Step 4   Click Remote Logging.

Step 5   Select the applicable remote logging option:

---

Note    Use the Log to Subsequent Selected Hosts on Failure option when you want to configure Cisco Secure ACS to send accounting data to a second remote Cisco Secure ACS server if the first server fails.

---

Step 6   For each remote Cisco Secure ACS server you want to have in the Log To list, follow these steps:

---

Note    The Cisco Secure ACS servers available in the Log Servers list is determined by the AAA Servers table in Network Configuration. For more information about the AAA Servers table, see the "AAA Server Configuration" section.

---

Step 7   To assign an order to the servers in the Log To list, click Up and Down to move selected Cisco Secure ACS servers until you have created the order you need.

---

Note    If the Log to Subsequent Selected Hosts on Failure option is selected, Cisco Secure ACS logs to the first accessible Cisco Secure ACS server Log To list.

---

Step 8   Click Submit.

Result: Cisco Secure ACS saves and implements the remote logging configuration you specified.

Disabling Remote Logging

You can prevent a Cisco Secure ACS server from sending its accounting information to a central logging Cisco Secure ACS server by disabling the Remote Logging feature.

To disable remote logging, follow these steps:

Step 2   Click Logging.

Step 3   Click Remote Logging.

Step 4   Select the Do not Log Remotely option.

Step 5   Click Submit.

Result: This Cisco Secure ACS server no longer sends its accounting information for locally authenticated sessions to remote logging servers.

Service Logs

The service logs may be considered diagnostic logs and are used for troubleshooting or debugging purposes only. These logs are not intended for general use by Cisco Secure ACS administrators; instead, they are mainly sources of information for Cisco support personnel. Service logs contain a record of all Cisco Secure ACS service actions and activities. Cisco Secure ACS generates these logs whenever you log in to Windows NT/2000 and the services are started, whether or not the administrative interface is started, and whether or not you are using the service. For example, RADIUS service logs are created even if you are not using the RADIUS protocol in your network.

For more information about Cisco Secure ACS services, see "Cisco Secure ACS Internal Architecture."

Services Logged

Cisco Secure ACS generates logs for the following services:

These files are located in the \Logs subdirectory of the applicable service's directory. For example, the following is the default directory for the CiscoSecure authentication service:

The most recent debug log is named as follows:

where SERVICE is the name of the applicable service.

Older debug logs are named with the year, month, and date they were created. For example, a file created on July 13, 1999, would be named as follows:

where SERVICE is the name of the applicable service.

If you selected the Day/Month/Year format, the file would be named as follows:

Configuring Service Logs

You can configure how Cisco Secure ACS generates and manages the service log file. The options for configuring the service log file are listed below.

To configure how Cisco Secure ACS generates and manages the service log file, follow these steps:

Step 2   Click Service Control.

Result: The status of the services appears in the CiscoSecure ACS on hostname table, where hostname is the name of the Cisco Secure ACS server.

Step 3   To disable the service log file, under Level of detail, select the None option.

Result: After you click Restart, Cisco Secure ACS does not generate new service logs file.

Step 4   To configure how often Cisco Secure ACS creates a service log file, select one of the options under Generate New File.

---

Note    Settings under Generate New File have no effect if you selected None under Level of detail.

---

Step 5   To manage which service log files Cisco Secure ACS keeps, follow these steps:

Step 6   Click Restart.

Result: Cisco Secure ACS restarts its services and implements the service log settings you specified.