User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 10 Logs and Reports
OL-14386-02
About ACS Logs and Reports
where SERVICE is the name that represents the applicable service, for example auth represents the
CSAuth service.
Older debug logs are named with the year, month, and date on which they were created. For example, a
file that was created on July 13, 1999, would be named:
SERVICE 1999-07-13.log
where SERVICE is the name that represents the applicable service.
If you selected the Day/Month/Year format, the file would be named:
SERVICE 13-07-1999.log
For information about changing the date format, see Date and Time Format Control, page 7-3.
Related Topics
Configuring Service Logs, page 10-29
Adding Session IDs to the CSAuth Diagnostic Log
ACS supports a session ID parameter for the CSAuth diagnostic log. The CSAuth diagnostic log tracks
each active authentication session by using a session data structure. The ACS services refer to these
structures by session ID. You can use a unique session ID to differentiate log threads in the CSAuth
diagnostic logs.
Example 10-1 shows the session ID 1000 is processed by two different threads (2560, 2548) in the
network model thread. You can filter the logs by session ID to restrict the output for each session.
Example 10-1 CSAuth Diagnostic Log with session ID
AUTH 09/08/2006 18:29:57 I 5081 2560 1000 Start RQ1040, client 1 (127.0.0.1)
AUTH 09/08/2006 18:30:13 I 5094 2548 Worker 1 processing message 17.
AUTH 09/08/2006 18:30:14 I 0991 2368 0000 pvNASMonitorThreadMain: start NM
update ...
AUTH 09/08/2006 18:30:14 I 1006 2368 0000 pvNASMonitorThreadMain: commit NM
update ...
AUTH 09/08/2006 18:30:14 I 5081 2560 1000 Done RQ1040, client 1, status 0
AUTH 09/08/2006 18:30:14 I 1011 2368 0000 pvNASMonitorThreadMain: succeeded
to commit NM update
AUTH 09/08/2006 18:30:28 I 5081 2548 1000 Start RQ1012, client 2 (127.0.0.1)
AUTH 09/08/2006 18:30:28 I 5081 2548 1000 Done RQ1012, client 2, status 0
Note The additional session ID field in the ACS diagnostic log involves minimal overhead: eight bytes per line
for each authentication session.
You use the same session ID for different authentication sessions. This means that the same session ID
can appear in the diagnostic logs for more than one session. Cisco recommends that you use unique
session IDs for each authentication session. Session IDs are maintained up to a limit of 120 seconds.
Description of Error Codes in the CSAuth Diagnostic Log
CSAuth diagnostic logs display a description of client requests and responses. Previous versions of ACS
used a numeric code for client requests and responses. The description is useful for locating client
requests and responses in the CSAuth diagnostic logs.
User Guide for Cisco Secure Access Control Server 4.2
10-13