Logging issue in CiscoSecure ACS 4.2

Logging issue in CiscoSecure ACS 4.2

NewsGroups | Search | Tools
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Logging issue in CiscoSecure ACS 4.2 Daniel Alex 05-05-2008
Posted by Daniel Alex on May 5, 2008, 4:08 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi All,

Good day everyone, I have a problem with ACS's logging and I hope anyone who
had similar experience could help me on this issues.

We have two ACS on our network (primary & secondary). All our dial-up
customer are authenticated on primary ACS and the secondary ACS is only
serves as a backup ONLY when the primary ACS is fail or out of service. User
databases and groups including certain security & network configurations are
replicated to secondary ACS on daily basis (every 24 hours). The logging for
configuration for each ACS reports (Failed Attempts, Passed Authentication,
RADIUS Accounting and etc) are also configured to daily basis. So far, the
operational status for both are fine but I found out the logging files on
secondary ACS has an extra ACS report which ends with "(HH-MM-SS).csv", for
example, RADIUS Accounting 2008-05-02(00-00-33).csv. This happens whenever
the secondary ACS are in replication mode and receives updates from primary
ACS after every 24 hours.

In a day, the secondary ACS generates two identical ACS reports, with and
without '(HH-MM-SS)'. Example ACS reports generated by secondary ACS;

RADIUS Accounting 2008-05-02.csv
RADIUS Accounting 2008-05-02(00-00-33).csv

It only happens on secondary ACS but not in primary ACS, although in my
understanding, whenever ACS in replication mode, all ACS services will be
temporarily suspended and return to operational once the replication mode is
completed. Our billing software is customized only to process those normal
ACS reports (logs) but not those ends with "(HH-MM-SS).csv" and we have to
manually extrack the content and merge it with the current reports. We did
not having this problem in our previous ACS version 3.2 until we had
upgraded our service recently.

Question: How do I overcome this issue? Any workaround?

Thank you very much!

Regards,

Daniel


home networking made easy, greater protection, less stress, introducing nm 5.0, 728x90
Posted by Thrill5 on May 5, 2008, 11:41 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Disable log replication, and configure the primary to also log to the
secondary. When done this way, as each message is logged, it is
immediately sent to the secondary server, and both logs are always up to
date. Don't remember how to do this off the top of my head and if you don't
find where to set this up, post a reply.

> Hi All,
>
> Good day everyone, I have a problem with ACS's logging and I hope anyone
> who had similar experience could help me on this issues.
>
> We have two ACS on our network (primary & secondary). All our dial-up
> customer are authenticated on primary ACS and the secondary ACS is only
> serves as a backup ONLY when the primary ACS is fail or out of service.
> User databases and groups including certain security & network
> configurations are replicated to secondary ACS on daily basis (every 24
> hours). The logging for configuration for each ACS reports (Failed
> Attempts, Passed Authentication, RADIUS Accounting and etc) are also
> configured to daily basis. So far, the operational status for both are
> fine but I found out the logging files on secondary ACS has an extra ACS
> report which ends with "(HH-MM-SS).csv", for example, RADIUS Accounting
> 2008-05-02(00-00-33).csv. This happens whenever the secondary ACS are in
> replication mode and receives updates from primary ACS after every 24
> hours.
>
> In a day, the secondary ACS generates two identical ACS reports, with and
> without '(HH-MM-SS)'. Example ACS reports generated by secondary ACS;
>
> RADIUS Accounting 2008-05-02.csv
> RADIUS Accounting 2008-05-02(00-00-33).csv
>
> It only happens on secondary ACS but not in primary ACS, although in my
> understanding, whenever ACS in replication mode, all ACS services will be
> temporarily suspended and return to operational once the replication mode
> is completed. Our billing software is customized only to process those
> normal ACS reports (logs) but not those ends with "(HH-MM-SS).csv" and we
> have to manually extrack the content and merge it with the current
> reports. We did not having this problem in our previous ACS version 3.2
> until we had upgraded our service recently.
>
> Question: How do I overcome this issue? Any workaround?
>
> Thank you very much!
>
> Regards,
>
> Daniel
>



Posted by Daniel Alex on May 6, 2008, 6:18 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi,

I still need the log replication. However, I want to know how to prevent the
secondary ACS to produce similar log files (as shown below) after performing
replication.

RADIUS Accounting 2008-05-02.csv
RADIUS Accounting 2008-05-02(00-00-33).csv

It always happened whenever the primary ACS performed replication towards
secondary ACS. I wonder, after the replication complete on secondary ACS,
why it needs to create a new log instead of using the current log at that
day.

Thanks.

> Disable log replication, and configure the primary to also log to the
> secondary. When done this way, as each message is logged, it is
> immediately sent to the secondary server, and both logs are always up to
> date. Don't remember how to do this off the top of my head and if you
> don't find where to set this up, post a reply.
>
>> Hi All,
>>
>> Good day everyone, I have a problem with ACS's logging and I hope anyone
>> who had similar experience could help me on this issues.
>>
>> We have two ACS on our network (primary & secondary). All our dial-up
>> customer are authenticated on primary ACS and the secondary ACS is only
>> serves as a backup ONLY when the primary ACS is fail or out of service.
>> User databases and groups including certain security & network
>> configurations are replicated to secondary ACS on daily basis (every 24
>> hours). The logging for configuration for each ACS reports (Failed
>> Attempts, Passed Authentication, RADIUS Accounting and etc) are also
>> configured to daily basis. So far, the operational status for both are
>> fine but I found out the logging files on secondary ACS has an extra ACS
>> report which ends with "(HH-MM-SS).csv", for example, RADIUS Accounting
>> 2008-05-02(00-00-33).csv. This happens whenever the secondary ACS are in
>> replication mode and receives updates from primary ACS after every 24
>> hours.
>>
>> In a day, the secondary ACS generates two identical ACS reports, with and
>> without '(HH-MM-SS)'. Example ACS reports generated by secondary ACS;
>>
>> RADIUS Accounting 2008-05-02.csv
>> RADIUS Accounting 2008-05-02(00-00-33).csv
>>
>> It only happens on secondary ACS but not in primary ACS, although in my
>> understanding, whenever ACS in replication mode, all ACS services will be
>> temporarily suspended and return to operational once the replication mode
>> is completed. Our billing software is customized only to process those
>> normal ACS reports (logs) but not those ends with "(HH-MM-SS).csv" and we
>> have to manually extrack the content and merge it with the current
>> reports. We did not having this problem in our previous ACS version 3.2
>> until we had upgraded our service recently.
>>
>> Question: How do I overcome this issue? Any workaround?
>>
>> Thank you very much!
>>
>> Regards,
>>
>> Daniel
>>
>
>


Posted by Thrill5 on May 6, 2008, 8:16 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You can't prevent this from happening when you replicate the log FILES, but
you can when you configure the primary also log to the secondary.

> Hi,
>
> I still need the log replication. However, I want to know how to prevent
> the secondary ACS to produce similar log files (as shown below) after
> performing replication.
>
> RADIUS Accounting 2008-05-02.csv
> RADIUS Accounting 2008-05-02(00-00-33).csv
>
> It always happened whenever the primary ACS performed replication towards
> secondary ACS. I wonder, after the replication complete on secondary ACS,
> why it needs to create a new log instead of using the current log at that
> day.
>
> Thanks.
>
>> Disable log replication, and configure the primary to also log to the
>> secondary. When done this way, as each message is logged, it is
>> immediately sent to the secondary server, and both logs are always up to
>> date. Don't remember how to do this off the top of my head and if you
>> don't find where to set this up, post a reply.
>>
>>> Hi All,
>>>
>>> Good day everyone, I have a problem with ACS's logging and I hope anyone
>>> who had similar experience could help me on this issues.
>>>
>>> We have two ACS on our network (primary & secondary). All our dial-up
>>> customer are authenticated on primary ACS and the secondary ACS is only
>>> serves as a backup ONLY when the primary ACS is fail or out of service.
>>> User databases and groups including certain security & network
>>> configurations are replicated to secondary ACS on daily basis (every 24
>>> hours). The logging for configuration for each ACS reports (Failed
>>> Attempts, Passed Authentication, RADIUS Accounting and etc) are also
>>> configured to daily basis. So far, the operational status for both are
>>> fine but I found out the logging files on secondary ACS has an extra ACS
>>> report which ends with "(HH-MM-SS).csv", for example, RADIUS Accounting
>>> 2008-05-02(00-00-33).csv. This happens whenever the secondary ACS are in
>>> replication mode and receives updates from primary ACS after every 24
>>> hours.
>>>
>>> In a day, the secondary ACS generates two identical ACS reports, with
>>> and without '(HH-MM-SS)'. Example ACS reports generated by secondary
>>> ACS;
>>>
>>> RADIUS Accounting 2008-05-02.csv
>>> RADIUS Accounting 2008-05-02(00-00-33).csv
>>>
>>> It only happens on secondary ACS but not in primary ACS, although in my
>>> understanding, whenever ACS in replication mode, all ACS services will
>>> be temporarily suspended and return to operational once the replication
>>> mode is completed. Our billing software is customized only to process
>>> those normal ACS reports (logs) but not those ends with "(HH-MM-SS).csv"
>>> and we have to manually extrack the content and merge it with the
>>> current reports. We did not having this problem in our previous ACS
>>> version 3.2 until we had upgraded our service recently.
>>>
>>> Question: How do I overcome this issue? Any workaround?
>>>
>>> Thank you very much!
>>>
>>> Regards,
>>>
>>> Daniel
>>>
>>
>>
>



Posted by Daniel Alex on May 6, 2008, 10:07 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Okay. I will test it. Thanks.


> You can't prevent this from happening when you replicate the log FILES,
> but you can when you configure the primary also log to the secondary.
>
>> Hi,
>>
>> I still need the log replication. However, I want to know how to prevent
>> the secondary ACS to produce similar log files (as shown below) after
>> performing replication.
>>
>> RADIUS Accounting 2008-05-02.csv
>> RADIUS Accounting 2008-05-02(00-00-33).csv
>>
>> It always happened whenever the primary ACS performed replication towards
>> secondary ACS. I wonder, after the replication complete on secondary ACS,
>> why it needs to create a new log instead of using the current log at that
>> day.
>>
>> Thanks.
>>
>>> Disable log replication, and configure the primary to also log to the
>>> secondary. When done this way, as each message is logged, it is
>>> immediately sent to the secondary server, and both logs are always up to
>>> date. Don't remember how to do this off the top of my head and if you
>>> don't find where to set this up, post a reply.
>>>
>>>> Hi All,
>>>>
>>>> Good day everyone, I have a problem with ACS's logging and I hope
>>>> anyone who had similar experience could help me on this issues.
>>>>
>>>> We have two ACS on our network (primary & secondary). All our dial-up
>>>> customer are authenticated on primary ACS and the secondary ACS is only
>>>> serves as a backup ONLY when the primary ACS is fail or out of service.
>>>> User databases and groups including certain security & network
>>>> configurations are replicated to secondary ACS on daily basis (every 24
>>>> hours). The logging for configuration for each ACS reports (Failed
>>>> Attempts, Passed Authentication, RADIUS Accounting and etc) are also
>>>> configured to daily basis. So far, the operational status for both are
>>>> fine but I found out the logging files on secondary ACS has an extra
>>>> ACS report which ends with "(HH-MM-SS).csv", for example, RADIUS
>>>> Accounting 2008-05-02(00-00-33).csv. This happens whenever the
>>>> secondary ACS are in replication mode and receives updates from primary
>>>> ACS after every 24 hours.
>>>>
>>>> In a day, the secondary ACS generates two identical ACS reports, with
>>>> and without '(HH-MM-SS)'. Example ACS reports generated by secondary
>>>> ACS;
>>>>
>>>> RADIUS Accounting 2008-05-02.csv
>>>> RADIUS Accounting 2008-05-02(00-00-33).csv
>>>>
>>>> It only happens on secondary ACS but not in primary ACS, although in my
>>>> understanding, whenever ACS in replication mode, all ACS services will
>>>> be temporarily suspended and return to operational once the replication
>>>> mode is completed. Our billing software is customized only to process
>>>> those normal ACS reports (logs) but not those ends with
>>>> "(HH-MM-SS).csv" and we have to manually extrack the content and merge
>>>> it with the current reports. We did not having this problem in our
>>>> previous ACS version 3.2 until we had upgraded our service recently.
>>>>
>>>> Question: How do I overcome this issue? Any workaround?
>>>>
>>>> Thank you very much!
>>>>
>>>> Regards,
>>>>
>>>> Daniel
>>>>
>>>
>>>
>>
>
>


Similar ThreadsPosted
CiscoWorks and CiscoSecure ACS January 24, 2006, 2:33 am
ciscosecure acs certificate question January 5, 2005, 8:45 pm
CiscoSecure ACS 3.3 and MS Active Directory ? February 23, 2005, 7:57 am
MAC authentication on Linksys switches with CiscoSecure ACS 4.2 May 8, 2008, 6:32 am
CiscoSecure ACS v. 3.3 user TACACS+ password choice defaults not LDAP April 18, 2007, 2:22 pm
logging buffered vs. logging history February 5, 2006, 8:57 am
logging w/ PIX / ASA January 4, 2006, 11:43 am
VPN logging April 6, 2006, 7:58 am
logging PIX August 15, 2006, 10:20 am
PIX Logging October 19, 2006, 11:40 pm

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map