Change audith and tacacs

[Sarla]

How can I make Change Audith and TACACS work together?
I need to see the TACACS user (on the Audith report) who
has made changes to router configurations (snmp strings,
access lists etc.)

Any information on TACACS and Cisco Works will be greatly
appreciated.

Thank you.

 

[jgercken]

Configure TACACS command level accounting by:
CatOS:set accounting commands enable all stop-only tacacs+

IOS: aaa accounting commands 15 default start-stop group tacacs+

Then you can pull the daily csv files from your tacacs server from \Program Files\CiscoSecure ACS v2.6\Logs\TACACS+ Administration
The output looks like:
Date Time User-Name Group-Name cmd priv-lvl service NAS-Portname task_id NAS-IP-Address reason
02/13/2002 13:06:05 jgercken NOC show port 6 15 shell telnet86 920 192.168.170.32 ..