Table of Contents

Working with Logging and Reports

Cisco Secure Access Control Server (Cisco Secure ACS) for Windows Server version 3.1 produces a variety of logs and provides a way to view most of these logs in the Cisco Secure ACS HTML interface as HTML reports. This chapter contains the following topics about logging:

Logging Formats

Cisco Secure ACS logs a variety of user and system activities. Depending on the log, and how you have configured Cisco Secure ACS, logs can be recorded in one of two formats:

For information about the formats available for a specific log, see About Cisco Secure ACS Logs and Reports.

Special Logging Attributes

Among the many attributes that Cisco Secure ACS can record in its logs, a few are of special importance. The following list explains the special logging attributes provided by Cisco Secure ACS.

The content of these attributes is determined by the values entered in the corresponding fields in the user account. For more information about user attributes, see User Data Configuration Options.

The Filter Information attribute is available for Passed Authentication and Failed Attempts logs.

The Device Command Set attribute is available for Failed Attempts logs.

---

Note    Cisco Secure ACS cannot determine how a remote logging service is configured to process accounting packets that it is forwarded. For example, if a remote logging service is configured to discard accounting packets, it discards a forwarded accounting packet and responds to Cisco Secure ACS with an acknowledgment message, causing Cisco Secure ACS to write a value of Remote-logging-successful in the Remote Logging Result attribute in the local log that records the account packet.

---

Update Packets In Accounting Logs

Whenever you configure Cisco Secure ACS to record accounting data for user sessions, Cisco Secure ACS records start and stop packets. If you want, you can configure Cisco Secure ACS to record update packets, too. In addition to providing interim accounting information during a user session, update packets drive password expiry messages via CiscoSecure Authentication Agent. In this use, the update packets are referred to as watchdog packets.

Note   To record update packets in Cisco Secure ACS accounting logs, you must configure your AAA clients to send the update packets. For more information about configuring your AAA client to send update packets, refer to the documentation for your AAA clients.

For more information on setting this option for a AAA client, see Adding a AAA Client.

For more information on setting this option for a AAA server, see Adding a AAA Server.

About Cisco Secure ACS Logs and Reports

The logs that Cisco Secure ACS provides can be divided into four groups:

This section contains information about the first three groups. For information about service logs, see Service Logs.

Accounting Logs

Accounting logs contain information about the use of remote access services by users. By default, these logs are available in CSV format. With the exception of the Passed Authentications log, you can also configure Cisco Secure ACS to export the data for these logs to an ODBC-compliant relational database that you configure to store the log data. Table 9-1 describes all accounting logs.

In the HTML interface, all accounting logs can be enabled, configured, and viewed. Table 9-2 contains information about what you can do in the Cisco Secure ACS HTML interface regarding accounting logs.

Dynamic Administration Reports

These reports show the status of user accounts at the moment you access them in the Cisco Secure ACS HTML interface. They are available only in the HTML interface, are always enabled, and require no configuration.

Table 9-3 contains descriptions of all dynamic administration reports and information about what you can do regarding dynamic administration reports.

Viewing the Logged-in Users Report

To view the Logged-in Users report, follow these steps:

Step 2   Click Logged-in Users.

Result: The Select a AAA Client page displays the name of each AAA client, its IP address, and the number of users logged in through the AAA client. At the bottom of the table, the All AAA Clients entry shows the total number of users logged in.

Tip You can sort the table by any column's entries, in either ascending or descending order. Click a column title once to sort the table by the entries in that column in ascending order. Click the column a second time to sort the table by the entries in that column in descending order.

Step 3   Do one of the following:

Result: Cisco Secure ACS displays a table of users logged in, including the following information:

Tip You can sort the table by the entries in any column, in either ascending or descending order. Click a column title once to sort the table by the entries in that column, in ascending order. Click the column a second time to sort the table by the entries that column in descending order.

Deleting Logged-in Users

From a Logged-in Users Report, you can instruct Cisco Secure ACS to delete users logged into a specific AAA client. When a user session terminates without a AAA client sending an accounting stop packet to the Cisco Secure ACS server, the Logged-in Users Report continues to show the user. Deleting logged-in users from a AAA client ends the accounting for those user sessions.

Note   Deleting logged-in users only ends the Cisco Secure ACS accounting record of users logged in to a particular AAA client. It does not terminate active user sessions, nor does it affect user records.

To delete logged-in users, follow these steps:

Step 2   Click Logged-in Users.

Result: The Select a AAA Client page displays the name of each AAA client, its IP address, and the number of users logged in through the AAA client. At the bottom of the table, the All AAA Clients entry shows the total number of users logged in.

Step 3   Click the name of the AAA client whose users you want to delete from the Logged-in Users report.

Result: Cisco Secure ACS displays a table of all users logged in through the AAA client. The Purge Logged in Users button appears below the table.

Step 4   Click Purge Logged in Users.

Result: Cisco Secure ACS displays a message, indicating the number of users purged from the report and the IP address of the AAA client.

Viewing the Disabled Accounts Report

To view the Disabled Accounts report, follow these steps:

Step 2   Click Disabled Accounts.

Result: The Select a user account to edit page displays disabled user accounts, the account status, and the group to which the user account is assigned.

Step 3   To edit a user account listed, in the User column, click the username.

Result: Cisco Secure ACS opens the user account for editing.

For more information about editing a user account, see Basic User Setup Options.

Cisco Secure ACS System Logs

System logs are logs about the Cisco Secure ACS system and therefore record system-related events. These logs are useful for troubleshooting or audits. They are always enabled and are only available in CSV format. Some system logs can be configured. For information about each system log, including which system logs are configurable, see "Accounting Log Descriptions and Related Topics".

For instructions on viewing a CSV report in the HTML interface, see Viewing a CSV Report.

Configuring the Administration Audit Log

To configure the Administrative Audit log, follow these steps:

Step 2   Click Audit Policy.

Result: The Audit Policy Setup page appears.

Step 3   To generate a new Administrative Audit CSV file at a regular interval, select one of the following options:

Step 4   To generate a new Administrative Audit CSV file when the current file reaches a specific size, select the When size is greater than X KB option and type the file size threshold in kilobytes in the X box.

Step 5   To manage which Administrative Audit CSV files Cisco Secure ACS keeps, follow these steps:

Step 6   Click Submit.

Result: Cisco Secure ACS saves and implements the Administrative Audit log settings you specified.

Working with CSV Logs

This section contains the following topics:

CSV Log File Names

When you access a report in Reports and Activity, Cisco Secure ACS lists the CSV files in chronological order, with the current CSV file at the top of the list. The current file is named log.csv, where log is the name of the log.

Older files are named in the following format:

logyyyy-mm-dd.csv

where

log is the name of the log.

yyyy is the year the CSV file was started.

mm is the month the CSV file was started, in numeric characters.

dd is the date the CSV file was started.

For example, a Database Replication log file that was generated on October 13, 2002, would be named Database Replication 2002-10-13.csv.

CSV Log File Locations

By default, Cisco Secure ACS keeps log files in directories unique to the log. The HTML interface enables you to configure the log file location for some logs while the location for other log files is not configurable. The default directories for all logs are within sysdrive:\Program Files\CiscoSecure ACS vx.x. For the subdirectory of this location for a specific log, see Table 9-5.

Enabling or Disabling a CSV Log

This procedure describes how to enable or disable a CSV log. For instructions about configuring the content of a CSV log, see Configuring a CSV Log.

Note   Some CSV logs are always enabled. For information about specific logs, including whether you can disable them, see About Cisco Secure ACS Logs and Reports.

To enable or disable a CSV log, follow these steps:

Step 2   Click Logging.

Step 3   Click the name of the CSV log you want to enable.

Result: The CSV log Comma-Separated Values File Configuration page appears, where log is the name of the CSV log you selected.

Step 4   To enable the log, under Enable Logging, select the Log to CSV log report check box, where log is the name of the CSV log you selected in Step 3.

Step 5   To disable the log, under Enable Logging, clear the Log to CSV report log check box, where log is the name of the CSV log you selected in Step 3.

Step 6   Click Submit.

Result: If you enabled the log, Cisco Secure ACS begins logging information for the log selected. If you disabled the log, Cisco Secure ACS stops logging information for the log selected.

Viewing a CSV Report

When you select Logged-in Users or Disabled Accounts, a list of logged-in users or disabled accounts appears in the display area, which is the frame on the right side of the web browser. For all other types of reports, a list of applicable reports appears. Files are listed in chronological order, with the most recent file at the top of the list. The reports are named and listed by the date on which they were created; for example, a report ending with 2002-10-13.csv was created on October 13, 2002.

Files in CSV format can be imported into spreadsheets using most popular spreadsheet application software. Refer to your spreadsheet software documentation for instructions.

You can download the CSV file for any CSV report you view in Cisco Secure ACS. The procedure below includes steps for doing so.

To view a CSV report, follow these steps:

Step 2   Click the name of the CSV report you want to view.

Result: On the right side of the browser, Cisco Secure ACS lists the current CSV report file name and the file names of any old CSV report files.

Tip You can configure how Cisco Secure ACS handles old CSV report files. For more information, see Configuring a CSV Log.

Step 3   Click the CSV report file name whose contents you want to view.

Result: If the CSV report file contains information, the information appears in the display area.

Tip You can sort the table by any entries in the column, in either ascending or descending order. Click a column title once to sort the table by that column's entries in ascending order. Click the column a second time to sort the table by the entries in that column in descending order.

Tip To check for newer information in the current CSV report, click Refresh.

Step 4   If you want to download the CSV log file for the report you are viewing, follow these steps:

Result: Your browser displays a dialog box for accepting and saving the CSV file.

Configuring a CSV Log

This procedure describes how to configure the content of a CSV log. For instructions to enable or disable a CSV log, see Enabling or Disabling a CSV Log.

The logs to which this procedure applies are as follows:

You can configure several aspects of a CSV log:

To configure a CSV log, follow these steps:

Step 2   Click Logging.

Step 3   Click the name of the CSV log you want to enable.

Result: The CSV log Comma-Separated Values File Configuration page appears, where log is the name of the CSV log you selected.

The Select Columns To Log table contains two lists, Attributes and Logged Attributes. The attributes in the Logged Attributes list appear on the log selected.

Step 4   To add an attribute to the log, select the attribute in the Attributes list, and then click —> (right arrow button).

Result: The attribute moves to the Logged Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list box.

Step 5   To remove an attribute from the log, select the attribute in the Logged Attributes list, and then click <— (left arrow button).

Result: The attribute moves to the Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list.

Step 6   To set the attributes in the Logged Attributes list back to the default selections, at the bottom of the browser window, click Reset Columns.

Step 7   To generate a new CSV file at a regular interval, select one of the following options:

Step 8   To generate a new CSV file when the current file reaches a specific size, select the When size is greater than X KB option and type the file size threshold, in kilobytes, in the X box.

Step 9   To manage which CSV files Cisco Secure ACS keeps, follow these steps:

Step 10   Click Submit.

Result: Cisco Secure ACS implements the CSV log configuration that you specified.

Working with ODBC Logs

This section contains procedures for the following topics:

Preparing for ODBC Logging

To prepare for ODBC logging, there are several steps you must complete. After you have prepared for ODBC logging, you can configure individual ODBC logs.

To prepare for ODBC logging, follow these steps:

Step 2   Set up a system data source name (DSN) on the Cisco Secure ACS server. For instructions, see Configuring a System Data Source Name for ODBC Logging.

Step 3   Enable ODBC logging in the Cisco Secure ACS HTML interface:

Result: Cisco Secure ACS enables the ODBC logging feature. On the Logging page, in the System Configuration section, Cisco Secure ACS displays links for configuring ODBC logs.

Result: You can now configure individual ODBC logs. For instructions, see Configuring an ODBC Log.

Configuring a System Data Source Name for ODBC Logging

On the computer running Cisco Secure ACS, you must create a system DSN for Cisco Secure ACS to communicate with the relational database that is to store your logging data.

To create a system DSN for use with ODBC logging, follow these steps:

Step 2   In the ODBC Data Source Administrator page, click the System DSN tab.

Step 3   Click Add.

Step 4   Select the driver you need to use with your new DSN, and then click Finish.

Result: A dialog box displays fields requiring information specific to the ODBC driver you selected.

Step 5   Type a descriptive name for the DSN in the Data Source Name box.

Step 6   Complete the other fields required by the ODBC driver you selected. These fields may include information such as the IP address of the server on which the ODBC-compliant relational database runs.

Step 7   Click OK.

Step 8   Close the ODBC window and Windows Control Panel.

Result: The System DSN to be used by Cisco Secure ACS for communicating with the relational database is created on the computer running Cisco Secure ACS. The name you assigned to the DSN appears in the Data Source list on each ODBC log configuration page.

Configuring an ODBC Log

The logs to which this procedure applies are as follows:

To configure an ODBC log, follow these steps:

Step 2   Click Logging.

Step 3   Click the name of the ODBC log you want to enable.

Result: The ODBC log Configuration page appears, where log is the name of the ODBC log you selected.

The Select Columns To Log table contains two lists: Attributes and Logged Attributes. When you first access the ODBC configuration page for a log, the Logged Attributes list contains the default set of attributes. Cisco Secure ACS includes in the log only those attributes that are in the Logged Attributes list.

Step 4   Specify the attributes that you want Cisco Secure ACS to send to the relational database:

Result: The attribute moves to the Logged Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list box.

Result: The attribute moves to the Attributes list.

Tip Use the vertical scroll bar to find attributes not visible in the list box.

Step 5   In the ODBC Connection Settings table, configure Cisco Secure ACS to communicate with the ODBC database. To do so, follow these steps:

---

Note    The user must have sufficient privileges in the relational database to write the ODBC logging data to the appropriate table.

---

Step 6   Click Submit.

Result: Cisco Secure ACS saves the log configuration.

Step 7   Click the name of the ODBC log you are configuring.

Result: Cisco Secure ACS displays the ODBC log configuration page again.

Step 8   Click Show Create Table.

Result: The right side of the browser displays an SQL create table statement for Microsoft SQL Server. The table name is the name specified in the Table Name box. The column names are the attributes specified in the Logged Attributes list.

---

Note    The generated SQL is valid for Microsoft SQL Server only. If you are using another relational database, refer to your relational database documentation for information about writing a command to create a table.

---

Step 9   Using the information provided in the generated SQL, create a table in your relational database for this ODBC log.

---

Note    For ODBC logging to work, the table name and the column names must match exactly the names in the generated SQL.

---

Step 10   Continuing in Cisco Secure ACS, access the configuration page for the ODBC log you are configuring:

Result: The ODBC log Configuration page appears, where log is the name of the ODBC log you selected.

Step 11   Select the Log to ODBC log report check box, where log is the name of the ODBC log you selected.

Step 12   Click Submit.

Result: Cisco Secure ACS begins sending logging data to the relational database table specified, using the system DSN you configured.

Remote Logging

This section discusses remote logging capabilities of Cisco Secure ACS. It contains the following topics:

About Remote Logging

The Remote Logging feature enables you to centralize accounting logs generated by multiple Cisco Secure ACSes. You can configure each Cisco Secure ACS to point to one Cisco Secure ACS that is to be used as a central logging server. The central logging Cisco Secure ACS still performs AAA functions, but it also is the repository for accounting logs it receives. For more information about Cisco Secure ACS accounting logs, see Accounting Logs.

The Remote Logging feature enables Cisco Secure ACS to send accounting data received from AAA clients directly to the CSLog service on the remote logging server, where the accounting data is written to the logs. The logging server generates the accounting logs in the formats it is configured to use—CSV and ODBC—regardless of the local logging configuration on the Cisco Secure ACSes sending the data to the central logging server.

Cisco Secure ACS listens on TCP port 2001 for remote logging communication. Remote logging data is encrypted by a 128-bit proprietary algorithm.

Note   The Remote Logging feature does not affect the forwarding of accounting data for proxied authentication requests. Cisco Secure ACS only applies Remote Logging settings to accounting data for sessions authenticated by proxy when accounting data for sessions authenticated by proxy is logged locally. For more information about proxied authentication requests and accounting data for sessions authenticated by proxy, see Proxy Distribution Table Configuration.

Implementing Centralized Remote Logging

Before You Begin

Make sure that gateway devices between remote Cisco Secure ACSes and the central logging Cisco Secure ACS permit the central logging Cisco Secure ACS to receive data on TCP port 2001.

To implement centralized remote logging, follow these steps:

Step 2   In the Cisco Secure ACS running on the central logging server, follow these steps:

Accounting logs can be recorded in either CSV or ODBC format. For information about configuring CSV logs, see Working with CSV Logs. For information about configuring ODBC logs, see Working with ODBC Logs.

---

Note    If the central logging server is to log watchdog and update packets for a Cisco Secure ACS, be sure that the Log Update/Watchdog Packets from this remote AAA Server check box is selected for that Cisco Secure ACS in the AAA Servers table.

---

Step 3   For each Cisco Secure ACS that is to send its accounting data to the central logging server, follow these steps:

Step 4   If you want to create other central logging servers, for use either as secondary servers or as mirrored logging servers, perform Step 1 through Step 3 for each additional server.

Remote Logging Options

Cisco Secure ACS provides the remote logging options listed below. These options appear on the Remote Logging Setup page.

Enabling and Configuring Remote Logging

Note   Before configuring the Remote Logging feature on a Cisco Secure ACS, make sure that you have configured your central logging Cisco Secure ACS. For more information, see Implementing Centralized Remote Logging.

To enable and configure remote logging, follow these steps:

Result: Cisco Secure ACS displays the Remote Logging link on the Logging page in the System Configuration section.

Step 2   Click System Configuration.

Step 3   Click Logging.

Result: The Logging Configuration page appears.

Step 4   Click Remote Logging.

Step 5   Select the applicable remote logging option:

---

Note    Use the Log to subsequent remote log services on failure option when you want to configure Cisco Secure ACS to send accounting data to a second remote Cisco Secure ACS if the first Cisco Secure ACS fails.

---

Step 6   For each remote Cisco Secure ACS you want to have in the Selected Log Services list, follow these steps:

---

Note    The Cisco Secure ACSes available in the Remote Log Services list is determined by the AAA Servers table in Network Configuration. For more information about the AAA Servers table, see AAA Server Configuration.

---

Step 7   To assign an order to the servers in the Selected Log Services list, click Up and Down to move selected Cisco Secure ACSes until you have created the order you need.

---

Note    If the Log to subsequent remote log services on failure option is selected, Cisco Secure ACS logs to the first accessible Cisco Secure ACS in the Selected Log Services list.

---

Step 8   Click Submit.

Result: Cisco Secure ACS saves and implements the remote logging configuration you specified.

Disabling Remote Logging

By disabling the Remote Logging feature, you prevent Cisco Secure ACS from sending its accounting information to a central logging Cisco Secure ACS.

To disable remote logging, follow these steps:

Step 2   Click Logging.

Step 3   Click Remote Logging.

Step 4   Select the Do not log Remotely option.

Step 5   Click Submit.

Result: Cisco Secure ACS no longer sends its accounting information for locally authenticated sessions to remote logging servers.

Service Logs

Service logs are considered diagnostic logs and are used for troubleshooting or debugging purposes only. These logs are not intended for general use by Cisco Secure ACS administrators; instead, they are mainly sources of information for Cisco support personnel. Service logs contain a record of all Cisco Secure ACS service actions and activities. Cisco Secure ACS generates these logs whenever the services are running, regardless of whether the administrative interface is started, and regardless of whether you are using the service. For example, RADIUS service logs are created even if you are not using the RADIUS protocol in your network.

For more information about Cisco Secure ACS services, see "Cisco Secure ACS Internal Architecture."

Services Logged

Cisco Secure ACS generates logs for the following services:

These files are located in the \Logs subdirectory of the applicable service directory. For example, the following is the default directory for the CiscoSecure authentication service:

c:\Program Files\CiscoSecure ACS vx.x\CSAuth\Logs

The most recent debug log is named as follows:

SERVICE.log

where SERVICE is the name of the applicable service.

Older debug logs are named with the year, month, and date they were created. For example, a file created on July 13, 1999, would be named as follows:

SERVICE 1999-07-13.log

where SERVICE is the name of the applicable service.

If you selected the Day/Month/Year format, the file would be named as follows:

SERVICE 13-07-1999.log

Configuring Service Logs

You can configure how Cisco Secure ACS generates and manages the service log file. The options for configuring the service log file are listed below.

To configure how Cisco Secure ACS generates and manages the service log file, follow these steps:

Step 2   Click Service Control.

Result: The status of the services appears in the CiscoSecure ACS on hostname table, where hostname is the name of the Cisco Secure ACS server.

Step 3   To disable the service log file, under Level of detail, select the None option.

Result: After you click Restart, Cisco Secure ACS does not generate new service logs file.

Step 4   To configure how often Cisco Secure ACS creates a service log file, select one of the options under Generate New File.

---

Note    Settings under Generate New File have no effect if you selected None under Level of detail.

---

Step 5   To manage which service log files Cisco Secure ACS keeps, follow these steps:

Step 6   Click Restart.

Result: Cisco Secure ACS restarts its services and implements the service log settings you specified.