Troubleshoot TACACS+ Problems

Use the trace level command to check traps and log files to see any TACACS+ failure. If TACACS+ experiences failure conditions, the TACACS+ module sends SNMP traps to notify the user. The TACACS+ module also logs the failure information into the system log file.

About this task

Caution

Caution

Using the trace tool inappropriately can cause CPU lockup conditions, loss of access to the device, loss of protocols, and service degradation. If you use trace level 3 (verbose) or trace level 4 (very verbose), do not use the screen to view commands due to the volume of information the system generates and the effect on the system.

Procedure

  1. Enter Privileged EXEC mode:

    enable

  2. Configure the trace level for the TACACS+ module:

    trace level 109 <1–4>

    The TACACS+ module ID is 109.

  3. Stop trace:

    trace shutdown

  4. View the trace results on screen:

    trace screen enable

  5. View trace saved to a file:

    show trace file [tail]

  6. Save the trace file to the Compact Flash card for retrieval:

    save trace [file WORD<1–99>]

    If you do not specify a file name, the file name is systrace.txt. By default, the system saves the file to the external flash.

  7. Save the trace file for retrieval:

    save trace [file WORD<1–99>]

    If you do not specify a file name, the file name is systrace.txt.

Variable Definitions

The following table defines parameters for the trace command.

Variable

Value

level [<Module_ID>] [<1–4>]

Starts the trace by specifying the module ID and level. Module ID 23 represents the IGMP module

<Module_ID> specifies the module for the trace. Different hardware platforms support different ID ranges because of feature support differences. To see which module IDs are available on the switch, use the show trace modid-list command or CLI command completion Help.

<0-4> specifies the trace level:

  • 0 — Disabled

  • 1 — Very terse

  • 2 — Terse

  • 3 — Verbose

  • 4 — Very verbose

shutdown

Stops the trace operation.

screen {disable|enable}

Enables or disables the display of trace output to the screen.

Important:

As a best practice, avoid using the screen to view commands if you use trace level 3 (verbose) or trace level 4 (very verbose) due to the volume of information generated and the effect on the system.

The following table defines parameters for the show trace command.

Variable

Value

file [tail]

Displays the trace results saved to a file.

level

Displays the current trace level for all modules.

modid-list

Specifies the module ID list.
9037602-00 Rev AB