Accounting Overview; Accounting Events; Specifying When To Create Accounting Records - Cisco WS-C2950SX-48-SI Configuration Manual

Understanding How Accounting Works

Accounting Overview

You can configure these accounting methods to monitor access to the switch:
•
•
Accounting allows you to track user activity to a specified host, suspicious connection attempts in the
network, and unauthorized changes to the NAS configuration. The accounting information is sent to the
accounting server where it is saved as a record. Accounting information typically consists of the user's
action and the duration for which the action lasted. You can use the accounting feature for security,
billing, and resource allocation purposes.
The accounting protocol operates in a client-server model, using TCP for transport. The NAS acts as the
client, and the accounting server acts as the daemon. The NAS sends accounting information to the
server. After successfully processing the information, the server sends a response to the NAS,
acknowledging the request. All transactions between the NAS and server are authenticated using a key.
After accounting has been enabled and an accountable event occurs on the system, the accounting
information is gathered dynamically in memory. When the event ends, an accounting record is created
and sent to the NAS; the system then deletes the record from memory. The amount of memory that is
used by the NAS for accounting varies depending on the number of concurrent accountable events.

Accounting Events

You can configure accounting for the following types of events:
•
•
•
•

Specifying When to Create Accounting Records

You can configure the switch to gather accounting information and create records. When you configure
accounting (using the set accounting command), the switch can generate two types of records:
•
•
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2980G Switches Software Configuration Guide
30-48
TACACS+ accounting
RADIUS accounting
EXEC mode accounting—Provides information about user EXEC sessions (normal login sessions)
on the NAS. This information includes the duration of the EXEC session but does not include traffic
statistics.
Connect accounting—Provides information about all outbound connections from the NAS (such as
Telnet, rlogin).
If you get a connection immediately upon login and then your connection is terminated, the
Note
EXEC and connect events will overlap and will have almost identical start and stop times.
System accounting—Provides information on system events not related to users. This information
includes system reset, system boot, and user configuration of accounting.
Command accounting—Sends a record for each command that is issued by the user. This permits
audit trail information to be gathered.
Start records—Include partial information of the event (when the event started, type of service, and
traffic statistics).
Stop records—Include complete information of the event (when the event started, its duration, type
of service, and traffic statistics).
Chapter 30 Configuring Switch Access Using AAA
—
Release 8.1
78-15486-01