Cisco ACS: How to send all radius and tacacs auth information to syslog

amigan_99
amigan_99 used Ask the Experts™
on
When I look at Splunk - where I send my Cisco ACS 5.4 syslog output - I see a record of actions I've done on ACS. But I'm not seeing the TACACS records when I log into various network devices. I can see the tacacs records if I go to Monitoring and Reports section of ACS. How can I view in syslog?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2017

Commented:
Please clarify your request, do you want logon events forwarded to syslog as well?
The link might address it where you specify which events you want logged ...
Another option you could setup snmptrap and send snmptraps to it with events ...
Distinguished Expert 2017

Commented:
You could log the events on the server where nps is running.
amigan_99Network Engineer

Author

Commented:
Thank you

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial