V 2.0 RADIUS Accounting Event

V 2.0 RADIUS Accounting Event

Base Rule

RADIUS Information

Information

V 2.0 EVID 3000 RADIUS Accounting Request Start

Sub Rule

RADIUS Accounting-Request Received

Information

V 2.0 EVID 3001 RADIUS Accounting Request Stop

Sub Rule

RADIUS Accounting-Request Received

Information

V 2.0 EVID 3002 RADIUS Accounting Watchdog Updat

Sub Rule

General RADIUS Message

Information

V 2.0 EVID 3003 RADIUS Accounting On

Sub Rule

General RADIUS Message

Information

V 2.0 EVID 3004 RADIUS Accounting Off

Sub Rule

General RADIUS Message

Information

V 2.0 EVID 3005 RADIUS Accounting Tunnel Start

Sub Rule

RADIUS Accounting-Request Received

Information

V 2.0 EVID 3006 RADIUS Accounting Tunnel Stop

Sub Rule

RADIUS Accounting-Request Received

Information

V 2.0 EVID 3007 RADIUS Accounting Tunnel Reject

Sub Rule

General RADIUS Message

Information

V 2.0 EVID 3008 RADIUS Acc. Tunnel Link Start

Sub Rule

General RADIUS Message

Information

V 2.0 EVID 3009 RADIUS Acc. Tunnel Link Stop

Sub Rule

General RADIUS Message

Information

V 2.0 EVID 3010 RADIUS Acc. Tunnel Link Reject

Sub Rule

General RADIUS Message

Information

pri_num

N/A

N/A

Priority value of the message, a combination of the facility value and the severity value of the message. Priority value = (facility value * 8) + severity value.
The facility code valid options are:
LOCAL0 (Code = 16)
LOCAL1 (Code = 17)
LOCAL2 (Code = 18)
LOCAL3 (Code = 19)
LOCAL4 (Code = 20)
LOCAL5 (Code = 21)
LOCAL6 (Code = 22; default)
LOCAL7 (Code = 23)

time

N/A

N/A

Date of the message generation, according to the local clock of the originating Cisco ISE server, in the format Mmm DD hh:mm:ss.

IP address/hostname

N/A

N/A

IP address of the originating Cisco ISE node, or the hostname.

cat_name

<vendorinfo>

Text/String

Logging category name preceded by the CSCOxxx string.

msg_id

N/A

N/A

Unique message ID; 1 to 4294967295. The message ID increases by 1 with each new message. Message IDs restart at 1 each time the application is restarted.

total_seg

N/A

N/A

Total number of segments in a log message. Long messages are divided into more than one segment.
Note : The total_seg depends on the Maximum Length setting in the remote logging targets page. See Remote Logging Target Settings.

seg_num

N/A

N/A

Segment sequence number within a message. Use this number to determine what segment of the message you are viewing.

timestamp

N/A

N/A

Date of the message generation, according to the local clock of the originating the Cisco ISE node, in the following format : YYYY-MM-DD hh:mm:ss:xxx +/-zh:zm.

sequence_num

N/A

N/A

Global counter of each message. If one message is sent to the local store and the next to the syslog server target, the counter increments by 2. Possible values are 0000000001 to 999999999.

msg_code

<vmid>
<tag1>

Number

Message code as defined in the logging categories.

msg_sev

<severity>

Text/String

Message severity level of a log message.

msg_class

<subject> 

Text/String

Message class, which identifies groups of messages with the same context.

msg_text

<action> 

Text/String

English language descriptive text message.

ConfigVersionId

<version>

Number

N/A

Device IP Address

<sip>

IP Address

N/A

UserName

<domainimpacted> / <account>

Text/String

N/A

RequestLatency

N/A

N/A

N/A

NetworkDeviceName

N/A

N/A

N/A

User-Name

<domainimpacted> / <account>

Text/String

N/A

NAS-IP-Address

<snatip>

IP Address

N/A

NAS-Port

<snatport>

Number

N/A

Service-Type

<objecttype>

Text/String

N/A

Framed-IP-Address

<dip>

Ip Address

N/A

Class

<object>

Text/String

N/A

Called-Station-ID

<dmac>

Text/String/Number

N/A

Calling-Station-ID

<smac>

Text/String/Number

N/A

NAS-Identifier

N/A

N/A

N/A

Acct-Status-Type

<status>

Text/String

N/A

Acct-Delay-Time

N/A

N/A

N/A

Acct-Input-Octets

<bytesin>

Number

N/A

Acct-Output-Octets

<bytesout>

Number

N/A

Acct-Session-Id

<session>

Text/String

N/A

Acct-Authentic

N/A

N/A

N/A

Acct-Session-Time

N/A

N/A

N/A

Acct-Input-Packets

<packetsin>

Number

N/A

Acct-Output-Packets

<packetsout>

Number

N/A

Acct-Terminate-Cause

N/A

N/A

N/A

Event-Timestamp

N/A

N/A

N/A

NAS-Port-Type

N/A

N/A

N/A

NAS-Port-Id

N/A

N/A

N/A

attribute-151

N/A

N/A

N/A

Tunnel-Type

N/A

N/A

N/A

Tunnel-Medium-Type

N/A

N/A

N/A

Tunnel-Private-Group-ID

N/A

N/A

N/A

cisco-av-pair=audit-session-id

N/A

N/A

N/A

cisco-av-pair=nas-update

N/A

N/A

N/A

cisco-av-pair=disc-cause-ext

N/A

N/A

N/A

cisco-av-pair=connect-progress

N/A

N/A

N/A

cisco-av-pair=method

N/A

N/A

N/A

Airespace-Wlan-Id

N/A

N/A

N/A

AcsSessionID

N/A

N/A

N/A

SelectedAccessService

N/A

N/A

N/A

Step

N/A

N/A

N/A

Step

N/A

N/A

N/A

Step

N/A

N/A

N/A

NetworkDeviceGroups

N/A

N/A

N/A

NetworkDeviceGroups

N/A

N/A

N/A

ServiceSelectionMatchedRule

N/A

N/A

N/A

CPMSessionID

N/A

N/A

N/A

Device Type

N/A

N/A

N/A

Location

N/A

N/A

N/A

Model Name

N/A

N/A

N/A

Software Version

N/A

N/A

N/A

Key1

N/A

N/A

N/A

Key2

N/A

N/A

N/A