Page 409

AAA Accounting 383

time. This does not, however, minimize the power of accounting to enable the administrator to
track unauthorized attempts and proactively create security for system resources. In addition,
accounting can be used to track resource usage to better allocate system usage.

Accounting is generally used for billing and auditing purposes and is simply turned on for those
events that are to be tracked. As with explaining any authentication or authorization, an example
is a good way to start. Syntactically, the commands follow this general syntax:

aaa accounting what-to-track how-to-track where-to-send-the-information

The what-to-track arguments are as follows:

network--With this argument, network accounting logs the information, on a user basis,
for PPP, SLIP, or ARAP sessions. The accounting information provides the time of access
and the network resource usage in packet and byte counts.

connection--With this argument, connection accounting logs the information about
outbound connections made from the router or RAS device, including Telnet and rlogin
sessions. The key word is outbound; it enables the tracking of connections made from the
RAS device and where those connections were established.

exec--With this argument, EXEC accounting logs the information about when a user
creates an EXEC terminal session on the router. The information includes the IP address
and telephone number, if it is a dial-in user, and the time and date of the access. This
information can be particularly useful for tracking unauthorized access to the RAS device.

system--With this argument, system accounting logs the information about system-level
events. System-level events include AAA configuration changes and reloads for the
device. Again, this information would be useful to track unauthorized access or tampering
with the router.

command--With this argument, command accounting logs information regarding which
commands are being executed on the router. The accounting record contains a list of
commands executed for the duration of the EXEC session, along with the time and date
information.

As you can see, the amount of information that can be tracked is substantial. It is important that
the administrator track only that information that is useful. Tracking of unwanted information
can create a large overhead on the network resource.

The how-to-track argument can be any of the following:

start-stop--The start-stop option sends an accounting record when the process begins.
This is sent as a background process and the user request is begun without delay. When
the user process is completed, the stop time and information is sent to the AAA database.
This option is needed when an elapsed time of usage is required.

stop-only--The stop-only option sends aggregated information based on the what-to-
track at the end of the user process. This option can be used when only the what-to-track
information is needed.