After moving device administration from an old AAA server to ISE, an engineer signs into a core switch over TACACS+ and ISE records the login as accepted, with session start-stop records arriving in the accounting log, yet no privilege 15 command lines appear for the audit trail. Which configuration gap on the switch best explains the missing command accounting?
Select an answer to reveal the explanation.
Short Explanation
Your login records are like a door-entry log: they confirm access, but not what happened inside. Without a command accounting statement, the switch sends session records to ISE but doesn’t send privilege 15 command records, leaving your audit trail empty.
Full Explanation
AAA accounting on Cisco devices is separate from authentication, so a successful login alone does not establish that command accounting is configured. Session start-stop records reaching ISE confirm that an accounting path is working, which narrows the gap to command accounting itself: without a command accounting statement set for level 15, the switch does not generate command-accounting records for delivery. A key mismatch would conflict with the accepted login and the accounting records reaching ISE. Sending accounting to the retired server would conflict with ISE receiving the exec records described. Missing command authorization does not by itself prevent command accounting; command authorization and command accounting are independent features. Exam caveat: command accounting is configured per privilege level, so the statement must name level 15 to capture commands at that level. Practical check: review the ISE TACACS accounting logs for command records and compare them with the switch's local history buffer.