>
    Strata Copilot
    Configure AAA Accounting on a Log Collector
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Manage Log Collection
    4. Configure Authentication for a Dedicated Log Collector
    5. Configure AAA Accounting on a Log Collector
    Download PDF
    Panorama

    Configure AAA Accounting on a Log Collector

    Table of Contents

    Configure AAA Accounting on a Log Collector

    Enable AAA accounting on a Log Collector by assigning a TACACS+ Accounting Server Profile in Panorama.
    Where Can I Use This?What Do I Need?
    • Dedicated Log Collectors managed by Panorama
    • Panorama virtual appliance in Dedicated Log Collector mode
    • Device Management License
    Authentication, Authorization, and Accounting (AAA) tracks administrator activity on your Dedicated Log Collectors by forwarding session Start and Stop records to a TACACS+ server. This gives you an audit trail of who accessed each Log Collector, when sessions began and ended, and which commands were executed—information that is critical for compliance reporting and security investigations.
    Before you begin, ensure that TACACS+ authentication is already configured for the Log Collector. If it is not, first complete Configure TACACS+ Authentication for a Dedicated Log Collector.
    Additionally, confirm that all target Log Collectors are running PAN-OS 12.2.2 or a later release and that your TACACS+ server is reachable from the Log Collector management interface.
    In PAN-OS 12.2.2 and later releases, Panorama® includes an Accounting Server Profile field on the Log Collector Authentication tab. When you assign a TACACS+ server profile to this field and push the configuration, the Log Collector forwards accounting records to the specified TACACS+ server for every administrator session. You can use the same TACACS+ server profile already used for authentication, or assign a dedicated profile for accounting.
    1. Assign the Accounting Server Profile to the Log Collector.
      1. In Panorama, select PanoramaManaged Collectors and click the name of the Log Collector.
      2. Select the Authentication tab.
      3. In the Accounting Server Profile field, select the TACACS+ server profile to use for accounting.
      4. Click OK.
    2. Commit and push the configuration to the Log Collector.
      1. Select CommitCommit and Push.
      2. Under Push Scope, click Edit Selections, select the Collector Groups tab, and select the Collector Group that contains the Log Collector.
      3. Click OK, then click Commit and Push.
      The Log Collector begins forwarding accounting Start and Stop records to the configured TACACS+ server for all subsequent administrator sessions.
    Verify that accounting is active on the Log Collector:
    • Confirm the pushed configuration on the Panorama CLI:
      show shared server-profile
      Confirm the TACACS+ server profile with the correct server IP address and port appears in the output.
    • Confirm accounting records reach the TACACS+ server:
      Log in to the Log Collector CLI and run any operational command, for example show system info. On your TACACS+ server, confirm that an accounting record appears for the session, including the administrator username and session start time.
    • View accounting statistics on the Log Collector:
      show tacacs-acct-stats
    • Test TACACS+ server reachability from the Log Collector:
      test tacacs-acct-server-connection address <server-ip-or-hostname>
    • Review local accounting logs:
      less mp-log authd.log
      Accounting events are written to authd.log and are automatically included in standard tech-support files. Root access is not required.

    © 2026 Palo Alto Networks, Inc. All rights reserved.