TACACS+ Authentication Manager Help >> Operation Guide >> Device User >> Log Management >> Authorization Logs

Authorization Logs

Authorization logs include login authorization logs and CLI authorization logs.

• TAM authorizes login privilege levels and records login authorization logs for login users from devices that are enabled with login authorization.
• TAM checks whether users are authorized to execute commands and records CLI authentication logs for the users from devices that are enabled with CLI authorization.

An authorization log result can be Permit or Deny. An authorization deny log also provides the reason for the deny action. Authorization logs can be exported to a file for audit.

Features

• Query Authorization Logs
  
  Perform this task to query authorization logs by predefined criteria.

  Procedure

  1. Click the User tab, and then select Device User > Log Management > Authorization Logs from the navigation tree.
  2. The Query Authorization Logs function provides the basic query and advanced query. You can switch between basic query and advanced query by clicking the Basic Query link and the Advanced Query link in the right upper corner. The basic query criteria include account name, authorization result, and authorization time. The advanced query criteria include account name, authorization result, authorization time, device user group, user status, CLI, authorization policy, profile attributes, privilege level, device IP, user IP, and session ID. The account name, CLI, and profile attributes support fuzzy query.
  3. Click Query to display the authorization logs matching the query criteria or click Reset to query authorization logs with the default query criteria.
• Export Authorization Logs
  
  Perform this task to export all logs displayed on the authorization log list.

  Procedure

  1. Click the User tab, and then select Device User > Log Management > Authorization Logs from the navigation tree.
  2. Set the basic or advanced query criteria and click Query.
  3. Click Export.
  4. Select the file format and column separator, and click OK. The result page displays the log export result and provides a link for downloading the file.

Parameters

• Profile Attributes: All profile attribute value pairs are assigned by the system.
• Session ID: For an authorization action, the device and the server use the same session ID for packet exchanges.

Remarks

• Operations to other pages can be performed during the exporting process. After the export is finished, click the Last Export Result link to view the export result.
• Export formats include text file and CSV table. When exporting logs to a text file, be sure to select the column separator. The separators include: blank space; tab; comma(,); semicolon (;); number sign (#); and dollar sign ($). The CSV format uses commas(,) as the field separators. By default, Windows opens CSV files in Excel. Excel automatically selects the display format according to the contents. For example, 123456789123456789 will be displayed as 1.23457E+17 (scientific notation). In this case, display the data in the text format or use a text edit tool such as Notebook to display the data.
• When Send Syslog Messages is Yes in confguration User > Device User Policy > Service Parameters > System Configuration, TAM will send authorization log data packets to destination which Syslog Server IP and Syslog Server Port. The parameters in data packets are:
   
  1. userName: Account Name.
  2. terminal: Terminal.
  3. terminalIp: User IP Address.
  4. deviceIp: Device IP Address
  5. type: Authorization Type. 1: Login; 2: CLI.
  6. result: Authorization Result. 1: Permit; 2: Deny.
  7. command: CLI.
  8. errorCode: Error Code.
  9. errorDesc: Error Code Description.
  10. authorizeTime: Authorization Time.