show acounting log

Syntax

show accounting log [last <QTY-TO-SHOW> | all] [vsx-peer]

Description

Entered without optional parameters, this command shows all accounting log records for the current boot. Sensitive information is masked from the log, by being represented as asterisks.
NOTE:

This show accounting log command replaces the show audit-log command that is supported only in 10.00 releases.

Command context

Manager (#)

Parameters

last <QTY-TO-SHOW>

Specifies how many most-recent accounting log records to show for the current boot. Range: 1 to 1000.

all

Selects for showing, all accounting records from the current boot and the previous boot.

[vsx-peer]

Shows the output from the VSX peer switch. If the switches do not have the VSX configuration or the ISL is down, the output from the VSX peer switch is not displayed.

Authority

Administrators

Usage

The three types of accounting log information are identified by the msg= element starting with the rec= item as follows:

  • Exec is identified with: msg='rec=ACCT_EXEC

  • Command is identified with: msg='rec=ACCT_CMD

  • System is identified with: msg='rec=ACCT_SYSTEM

These elements are shown in context under Examples.

Examples

Showing the accounting log for the last 12 records. 

switch# show accounting log last 12
type=USYS_CONFIG msg=audit(May 10 2018  00:52:32.428:79) : msg='rec=ACCT_SYSTEM op=start timezone=UTC user=UNKNOWN auth-method=LOCAL auth-type=LOCAL service=system event=sys_acct reason="System-accounting-ON" hostname=UNKNOWN addr=0.0.0.0 res=success' 
----
type=USER_START msg=audit(May 10 2018  00:52:47.611:80) : msg='rec=ACCT_EXEC op=start timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:52:47.614:81) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="enable" hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:52:50.851:82) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="configure" hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:52:53.427:83) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="interface 1/1/3" hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:52:54.447:84) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="no shutdown" hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:52:58.131:85) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="ip address 10.10.13.1/24" hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:52:59.468:86) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="exit" hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:53:10.204:92) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="exit" hostname=8320 addr=192.168.1.20 res=success' 
----
type=USER_END msg=audit(May 10 2018  00:53:10.205:93) : msg='rec=ACCT_EXEC op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell hostname=8320 addr=192.168.1.20 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:53:44.472:94) : msg='rec=ACCT_CMD op=stop timezone=UTC user=admin priv-lvl=15 auth-method=LOCAL auth-type=LOCAL service=shell data="no aaa accounting all default" hostname=8320 addr=0.0.0.0 res=success' 
----
type=USYS_CONFIG msg=audit(May 10 2018  00:53:44.473:95) : msg='rec=ACCT_SYSTEM op=stop timezone=UTC user=UNKNOWN auth-method=LOCAL auth-type=LOCAL service=system event=sys_acct reason="System-accounting-OFF" hostname=UNKNOWN addr=0.0.0.0 res=success'