Accounting

Accounting tracks user activities and resource usage. All user activities that affect the system, such as configuration changes, are written to an audit log. Audit log messages can be viewed by issuing the show log audit command, and indicate the following:

Which user made the change (login and logout details, including the origin, authentication method, and role).
Authentication failures and lockouts.
The interface used to make the change: Command Line Interface (CLI), Web UI, Serial Console, or LCD Panel Interface.
The change that was made.
The date and time the change was made.
The session ID used to initiate the change. The session ID persists for the duration of the session, which starts when the user logs in and ends when the user logs out.

Audit log messages are also logged to the system log. The audit log messages in this log are prefixed with AUDIT: and tagged as described in the following table so you can quickly locate them.

Message type	Tag
Configuration changes	`Config change ID`
Other actions	`Action ID`
User login	`User login`
User logout	`User logout`
Authentication failure	`Authentication failure`
User account lockout	`Maximum number of failed logins reached, account locked`
Authorization failure	`Denying access to`
Execution of CLI commands	`Executing command: ...`
Miscellaneous	`Boot manager password changed` `Time change detected, clock was moved...`

See Managing audit logs using the CLI for information about configuring and viewing audit logs.

Note

You can use the aaa accounting CLI command to send audit messages to TACACS+ servers.