Configuring Command Accounting - H3C S5120-EI Series Operation Manual

Follow these steps to enable command authorization:
To do...
Enter system view
Enter AUX user interface view
Enable command authorization

Configuring Command Accounting

Command accounting allows the HWTACACS server to record all commands executed on the device
regardless of the command execution result. This helps control and monitor the user operations on the
device.
If command accounting is enabled and command authorization is not enabled, every executed
command will be recorded on the HWTACACS server. If both command accounting and command
authorization are enabled, only the authorized and executed commands will be recorded on the
HWTACACS server.
The command accounting configuration involves three steps:
1) Enable command accounting. See the following table for details.
2) Configure a HWTACACS scheme. Specify the IP addresses of the HWTACACS accounting
servers and other related parameters. For details, refer to the section Configuring HWTACACS of
AAA Configuration in the Security Volume.
3) Configure the ISP domain to use the HWTACACS scheme for command line users. For details,
refer to the section Configuring AAA Accounting Methods for an ISP Domain of AAA Configuration
in the Security Volume.
Follow these steps to enable command accounting:
To do...
Enter system view
Enter AUX user interface view
Enable command accounting
Use the command...
system-view
0
user-interface aux
command authorization
Use the command...
system-view
user-interface aux 0
command accounting
2-12
Remarks
—
—
Required
Disabled by default, that is,
users can execute commands
without authorization.
Remarks
––
––
Required
Disabled by default, that is, the
accounting server does not
record the commands the users
execute.