RADIUS accounting overview

This accounting information is captured and made available for sending to remote accounting servers:

Exec Accounting: user login/logout events
Command accounting: commands executed by users. The Vendor-Specific Attribute (VSA) Aruba_Command_String with a value of 46 is available.
System accounting: remote accounting On/Off events.
CLI show commands.
Interactions on the non-CLI interfaces: REST and WebUI.

NOTE:

With RADIUS, command accounting logs a maximum of 247 characters per command entered by the user.

The following is not captured or made available as accounting information:

CLI commands that reboot the switch.
Interactions in the bash shell.

NOTE:

Local accounting (always enabled) must be functioning properly for remote Accounting to work.

NOTE:

The accounting information is sent to the first reachable remote RADIUS AAA server (configured for remote accounting). If no remote RADIUS server is reachable, local accounting remains available.

Sample accounting information on a RADIUS server

~~~~~~~~ EXEC ~~~~~~~~~~ 

Mon Jul 16 16:25:27 2018
        User-Name = "admin"
        NAS-Identifier = "8320"
        NAS-Port = 331
        NAS-Port-Type = Virtual
        Acct-Status-Type = Start
        Acct-Session-Id = "1531769192494"
        Acct-Authentic = Local
        Calling-Station-Id = "0.0.0.0"
        Event-Timestamp = "Jul 16 2018 16:25:22 PDT"
        Acct-Delay-Time = 0
        NAS-IP-Address = 10.10.10.1
        Acct-Unique-Session-Id = "b83e29f4140c17b1"
        Timestamp = 1531783527

~~~ EXEC stop ~~~
Mon Jul 16 16:26:42 2018
        User-Name = "admin"
        NAS-Identifier = "8320"
        NAS-Port = 331
        NAS-Port-Type = Virtual
        Acct-Status-Type = Stop
        Acct-Session-Id = "1531769192494"
        Acct-Authentic = Local
        Calling-Station-Id = "0.0.0.0"
        Event-Timestamp = "Jul 16 2018 16:26:37 PDT"
        Acct-Delay-Time = 0
        Acct-Session-Time = 75
        NAS-IP-Address = 10.10.10.1
        Acct-Unique-Session-Id = "b83e29f4140c17b1"
        Timestamp = 1531783602


~~~~~~~~ CMD ACCOUNTING ~~~~~~~~~~~~
Mon Jul 16 16:26:42 2018
        User-Name = "admin"
        NAS-Identifier = "8320"
        NAS-Port = 331
        NAS-Port-Type = Virtual
        Acct-Status-Type = Stop
        Acct-Session-Id = "1531769192496"
        Acct-Authentic = Local
        Aruba-Command-String = "exit"
        Calling-Station-Id = "0.0.0.0"
        Event-Timestamp = "Jul 16 2018 16:26:37 PDT"
        Acct-Delay-Time = 0
        NAS-IP-Address = 10.10.10.1
        Acct-Unique-Session-Id = "280710992629128c"
        Timestamp = 1531783602


~~~~~~~~~~~~~ SYSTEM ACCOUNTING ~~~~~~~~~~~~

Mon Jul 16 17:13:02 2018
        User-Name = "UNKNOWN"
        NAS-Identifier = "UNKNOWN"
        NAS-Port = 331
        NAS-Port-Type = Virtual
        Acct-Status-Type = Accounting-On
        Acct-Session-Id = "1531769192506"
        Acct-Authentic = Local
        Calling-Station-Id = "0.0.0.0"
        Event-Timestamp = "Jul 16 2018 17:12:56 PDT"
        Acct-Delay-Time = 0
        NAS-IP-Address = 10.10.10.1
        Acct-Unique-Session-Id = "b478e6402c86933e"
        Timestamp = 1531786382


Mon Jul 16 17:12:55 2018
        User-Name = "UNKNOWN"
        NAS-Identifier = "UNKNOWN"
        NAS-Port = 331
        NAS-Port-Type = Virtual
        Acct-Status-Type = Accounting-Off
        Acct-Session-Id = "1531769192491"
        Acct-Authentic = Local
        Calling-Station-Id = "0.0.0.0"
        Event-Timestamp = "Jul 16 2018 17:12:49 PDT"
        Acct-Delay-Time = 0
        NAS-IP-Address = 10.10.10.1
        Acct-Unique-Session-Id = "93da1f094121f2ee"
        Timestamp = 1531786375

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE:

This sample is representative and not from any particular RADIUS server implementation.