tacacs+ log

Tacacs+ accounting information writes in file YYYYMM.log.

Example:

[2002/11/06-04-17:15:28] action=START user=84212322311 port=Serial1/0:21  from=84212322311 nas=192.168.113.21 task_id=27 start_time=1036566928 timezone=VSK service=connection protocol=h323 

[2002/11/06-04-17:15:54] action=STOP user=111 port=Serial1/0:21  from=84212322311 nas=192.168.113.21 task_id=27 start_time=1036566928  timezone=VSK service=connection protocol=h323  h323-gw-id=vgw.tts.khb.cisco h323-incoming-conf-id=5CBC9187 F08E11D6 8058C840 5D76F8B 3 h323-call-origin=answer h323-call-type=Telephony  h323-setup-time=17:15:28.589 VSK Wed Nov 6 2002 subscriber=RegularLine  in-portgrp-id=### 320320 ### h323-connect-time=17:15:28.599 VSK Wed Nov 6 2002  h323-disconnect-time=17:15:53.933 VSK Wed Nov 6 2002 h323-disconnect-cause=10  tariff-type=Unknown h323-voice-quality=0 pre-bytes-in=0 pre-bytes-out=0  pre-paks-in=0 pre-paks-out=0 bytes_in=0 bytes_out=64160 paks_in=0 paks_out=401 connect-progress=101 elapsed_time=25 nas-rx-speed=0 nas-tx-speed=0

this is full output of TACACS+ accounting packet.