Tac_plus Accounting Log: Why Only Stop Records for GNMiC?

Tac_plus is an AAA (Authentication, Authorization, and Accounting) server used for network device user authentication, authorization, and accounting. The reason why Tac_plus accounting logs only record GNMiC stop events and not start events might be due to the accounting section in the configuration being set to only record stop events.

RFC 2866 defines the Accounting function within the RADIUS protocol, specifying the format and event types for accounting records. According to this RFC, accounting records include three types: start, stop, and interim-update. Start records are used to begin billing and accounting, stop records are used to end billing and accounting, and interim-update records are used to update billing and accounting. Therefore, based on this RFC, Tac_plus might choose to only record stop events to fulfill accounting requirements.

However, be aware that Tac_plus configurations can vary, so there might be other reasons in specific implementations for only recording stop events and not start events. To accurately understand Tac_plus accounting log configurations and behavior, it is recommended to consult the official Tac_plus documentation or contact Tac_plus developers or support teams.