Filter
Top Products
8-4
Configuration Guide for Cisco Secure ACS 4.2
OL-14390-02
Chapter 8 Syslog Logging Configuration Scenario
Format of Syslog Messages in ACS Reports
Step 6 Click Submit.
Step 7 Repeat the process for any additional reports for which you want to enable syslog reporting.
Format of Syslog Messages in ACS Reports
Syslog messages included in ACS reports have the following format:
<n> mmm dd hh:mm:ss XX:XX:XX:XX TAG msg_id total_seg seg# A1=V1
The elements of the message are:
• n—The Priority value of the message; it is a combination of facility and severity of the syslog
message, which is calculated according to RFC 3164, by first multiplying the facility value by 8 and
then adding the severity value.
• mmm dd hh:mm:ss—Date and time of the message.
• XX:XX:XX:XX—IP Address of the machine generating this syslog message.
• TAG—One of the following values, depending on the application name.
–
CisACS_01_PassedAuth—Cisco ACS passed authentications.
–
CisACS_02_FailedAuth—Cisco ACS failed attempts.
–
CisACS_03_RADIUSAcc—Cisco ACS RADIUS accounting.
–
CisACS_04_TACACSAcc—Cisco ACS TACACS+ accounting.
–
CisACS_05_TACACSAdmin—Cisco ACS TACACS+ administration.
–
CisACS_06_VoIPAcc—Cisco ACS VoIP accounting.
–
CisACS_11_BackRestore—ACS backup and restore log messages.
–
CisACS_12_Replication—ACS database replication log messages.
–
CisACS_13_AdminAudit—ACS administration audit log messages.
–
CisACS_14_PassChanges—ACS user password changes log messages.
–
CisACS_15_ServiceMon—ACS service monitoring log messages.
–
CisACS_16_ApplAdmin—ACS appliance administration audit log messages.
• msg_id —Unique message id. All segments of one message share the same message ID.
• total_seg —Total number of segments in this message.
• seg# -Segment sequence number within this message segmentation.
• A1=V1—Attribute-value pairs delimited by a comma (,) for Cisco ACS log messages and the
message itself.
Facility Codes
ACS syslog messages use the following facility values:
• 4—Security and authorization messages. This value is used for all AAA related messages (failed
attempts, passed attempts, accounting, and so on).
• 13—Log audit. This value is used for all other ACS report messages.