{"id":243,"date":"2026-04-27T00:00:00","date_gmt":"2026-04-26T20:30:00","guid":{"rendered":"https:\/\/www.anynet.ir\/blog\/gnsi-acctz-%d8%ad%d8%b3%d8%a7%d8%a8%d8%b1%d8%b3%db%8c-accounting-%d8%b5%d9%81%d8%ad%d9%87-%d9%85%d8%af%db%8c%d8%b1%db%8c%d8%aa-%d8%af%d8%b1-cisco-ios-xr-en\/"},"modified":"2026-10-19T19:07:42","modified_gmt":"2026-10-19T15:37:42","slug":"gnsi-acctz-%d8%ad%d8%b3%d8%a7%d8%a8%d8%b1%d8%b3%db%8c-accounting-%d8%b5%d9%81%d8%ad%d9%87-%d9%85%d8%af%db%8c%d8%b1%db%8c%d8%aa-%d8%af%d8%b1-cisco-ios-xr-en","status":"publish","type":"post","link":"https:\/\/www.anynet.ir\/blog\/en\/gnsi-acctz-%d8%ad%d8%b3%d8%a7%d8%a8%d8%b1%d8%b3%db%8c-accounting-%d8%b5%d9%81%d8%ad%d9%87-%d9%85%d8%af%db%8c%d8%b1%db%8c%d8%aa-%d8%af%d8%b1-cisco-ios-xr-en\/","title":{"rendered":"gNSI Acctz \u2014 Management Plane Accounting on Cisco IOS XR"},"content":{"rendered":"<div><\/div>\n<div>\n<div><\/div>\n<\/div>\n<div>\n<div>\n<div>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">The Problem<\/h2>\n<p><a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Certz<\/a> authenticates clients through TLS. <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">Authz<\/a> decides which gRPC Services a user can call. <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/securing-gnmi-with-pathz\" style=\"color: rgb(0, 102, 204)\">Pathz<\/a> controls which gNMI Paths they can touch. But after all of that \u2014 what actually happened? Traditional AAA Accounting on IOS XR covers CLI and NETCONF sessions, but gRPC-based activity (gNMI, gNOI, gRIBI, gNSI itself) has no standard Audit Trail. Without structured Accounting Records for the gRPC Management Plane, compliance teams have no way to answer &#8220;who did what, when, and from where.&#8221; Previously, the only option was syslog.<\/p>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">What is Acctz<\/h2>\n<p><a href=\"https:\/\/github.com\/openconfig\/gnsi\/tree\/main\/acctz\" style=\"color: rgb(0, 102, 204)\">gNSI Acctz<\/a> fills that gap. It <strong style=\"color: rgb(26, 26, 26)\">streams structured Accounting Records<\/strong> from the device to a <strong style=\"color: rgb(26, 26, 26)\">Collector<\/strong> over gRPC. Records cover everything that touches the Management Plane:<\/p>\n<ul>\n<li><strong style=\"color: rgb(26, 26, 26)\">CLI<\/strong> and <strong style=\"color: rgb(26, 26, 26)\">Shell<\/strong> commands (expanded to full form \u2014 <code>sh ver det<\/code> becomes <code>show version detail<\/code>)<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">NETCONF<\/strong> sessions<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">RESTCONF<\/strong> and <strong style=\"color: rgb(26, 26, 26)\">WebUI<\/strong> activity<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">gRPC<\/strong> Services \u2014 gNMI, gNOI, gNSI, gRIBI, P4RT<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Login<\/strong> and <strong style=\"color: rgb(26, 26, 26)\">Logout<\/strong> events<\/li>\n<\/ul>\n<p>Each Record carries <strong style=\"color: rgb(26, 26, 26)\">Session metadata<\/strong> (5-tuple, channel ID, TTY), <strong style=\"color: rgb(26, 26, 26)\">Authentication details<\/strong> (type, status, cause of failure), and <strong style=\"color: rgb(26, 26, 26)\">Authorization outcome<\/strong> (PERMIT\/DENY with Policy detail). For gRPC Records, the RPC name (e.g., <code>\/gnmi.gNMI\/Set<\/code>, <code>\/gnsi.certz.v1.Certz\/Rotate<\/code>) and an optional payload snapshot are included. Sensitive payloads (Private Keys rotated via <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Certz<\/a> \/ <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-credentialz-ssh-credential-rotation-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Credentialz<\/a>) may be redacted.<\/p>\n<p>The device holds a <strong style=\"color: rgb(26, 26, 26)\">Circular Buffer<\/strong> of recent Records. A Collector calls <strong style=\"color: rgb(26, 26, 26)\">RecordSubscribe<\/strong>, passes a timestamp, and the device streams every Record from that point forward. A timestamp of <code>0<\/code> means &#8220;send all buffered history.&#8221; The stream continues indefinitely until the gNSI session ends or an error occurs.<\/p>\n<p>Within AAA, Acctz is the <strong style=\"color: rgb(26, 26, 26)\">Accounting<\/strong> plane \u2014 the structured audit trail for every action that touches the management plane, regardless of whether it was permitted or denied.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">IOS XR Support<\/h2>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Release<\/th>\n<th>What changed<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">24.3.1<\/strong><\/td>\n<td>gNSI Acctz Logging introduced \u2014 bidirectional <code>Acctz.RecordSubscribe<\/code>. Command and gRPC Service Records. <code>grpc aaa accounting queue-size<\/code> CLI.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">24.4.1<\/strong><\/td>\n<td><code>AcctzStream<\/code> (server-streaming) replaces the deprecated bidirectional <code>Acctz<\/code>. <code>grpc aaa accounting history-memory<\/code> CLI. Per-Collector statistics in <code>show gnsi acctz statistics<\/code>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Platforms: Cisco 8000, NCS 5500, ASR 9000 families. Confirm exact SKU and PI\/SMU in Release Notes.<\/p>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">Validated on:<\/strong> This article was end-to-end exercised on Cisco NCS-540<br \/>\nrunning IOS XR <strong style=\"color: rgb(26, 26, 26)\">25.3.1<\/strong>. Where the device behavior diverges from the<br \/>\nproto\/spec or from the original xrdocs text, the divergence is called<br \/>\nout inline below.<\/p>\n<\/blockquote>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">The two gRPC Services<\/h2>\n<p>The <a href=\"https:\/\/github.com\/openconfig\/gnsi\/blob\/main\/acctz\/acctz.proto\" style=\"color: rgb(0, 102, 204)\"><code>acctz.proto<\/code><\/a> defines two services:<\/p>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Service<\/th>\n<th>Stream type<\/th>\n<th>Status<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\"><code>Acctz<\/code><\/strong><\/td>\n<td>Bidirectional stream (<code>RecordSubscribe<\/code>)<\/td>\n<td>Deprecated (IOS XR 24.3.1)<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\"><code>AcctzStream<\/code><\/strong><\/td>\n<td>Client \u2192 server stream (<code>RecordSubscribe<\/code>)<\/td>\n<td>Preferred (IOS XR 24.4.1+)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><code>AcctzStream<\/code> is a unidirectional server-streaming service \u2014 the Collector sends one <code>RecordRequest<\/code>, and the server streams <code>RecordResponse<\/code> messages back. The deprecated <code>Acctz<\/code> used a bidirectional stream. Implementations may expose one or the other; always check with <strong style=\"color: rgb(26, 26, 26)\">Reflection<\/strong>.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">How Streaming Works<\/h2>\n<ol>\n<li>A <strong style=\"color: rgb(26, 26, 26)\">Collector<\/strong> calls <strong style=\"color: rgb(26, 26, 26)\">RecordSubscribe<\/strong>.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">RecordRequest<\/strong> carries a <strong style=\"color: rgb(26, 26, 26)\">timestamp<\/strong> (nanoseconds since epoch). <code>0<\/code> means &#8220;send all buffered history.&#8221; Current time means &#8220;only new Records.&#8221;<\/li>\n<li>The server streams <strong style=\"color: rgb(26, 26, 26)\">RecordResponse<\/strong> messages as new Records are created.<\/li>\n<li>The stream runs indefinitely until the gNSI session ends, a TCP keepalive expires, or the server disconnects a stuck Collector whose output buffer stays full for too long.<\/li>\n<\/ol>\n<pre><code><span> +-----------------+\n<\/span><span> | Remote Collector|\n<\/span><span> +-----------------+\n<\/span><span> ^\n<\/span><span> | gNSI Acctz stream\n<\/span><span> |\n<\/span><span> +----------------------------------+\n<\/span><span> | IOS XR Router |\n<\/span><span> | CLI NETCONF gNMI gNOI gRIBI |\n<\/span><span> | +------+-------+------+-----+--+\n<\/span><span> | Acctz Service |\n<\/span><span> +----------------------------------+\n<\/span><\/code><\/pre>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">History and the Circular Buffer<\/h3>\n<p>The device maintains a Circular Buffer so short Collector outages do not lose everything. Key behavior:<\/p>\n<ul>\n<li><strong style=\"color: rgb(26, 26, 26)\">History depth<\/strong> is configurable via <code>grpc aaa accounting queue-size<\/code> (default: 40 records, range: 1\u2013512) and <code>grpc aaa accounting history-memory<\/code> (default: 40 MB, range: 1\u2013400 MB).<\/li>\n<li>When the queue is full and no Collectors are connected, the oldest Records are overwritten.<\/li>\n<li>Besides the queue Records stored for streaming, up to <strong style=\"color: rgb(26, 26, 26)\">512 additional Records<\/strong> are held during processing.<\/li>\n<li>Worst-case EMSd memory usage: <strong style=\"color: rgb(26, 26, 26)\">(N+1) \u00d7 history-memory<\/strong>, where N is the number of connected Collectors.<\/li>\n<li>If <code>history_istruncated<\/code> appears in a <code>RecordResponse<\/code>, the Collector requested a timestamp older than the buffer \u2014 some Records were lost.<\/li>\n<\/ul>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">On 25.3.1:<\/strong> <code>RecordResponse.history_istruncated<\/code> is <code>true<\/code> on the first record of <strong style=\"color: rgb(26, 26, 26)\">every<\/strong> replay, even on a fresh buffer with <code>timestamp = \"1970-01-01T00:00:00Z\"<\/code>. Treat the flag as informational on this build and cross-check <code>Total History Truncation<\/code> in <code>show gnsi acctz statistics<\/code> to detect real buffer wrap.<\/p>\n<\/blockquote>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">RecordResponse Structure<\/h2>\n<p>Each <strong style=\"color: rgb(26, 26, 26)\">RecordResponse<\/strong> carries four categories of information:<\/p>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Key fields<\/th>\n<th>Purpose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">Session<\/strong><\/td>\n<td><code>local_address<\/code>, <code>remote_address<\/code>, <code>remote_port<\/code>, <code>channel_id<\/code>, <code>tty<\/code>, <code>status<\/code><\/td>\n<td>Who connected and from where<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">User \/ Authn<\/strong><\/td>\n<td><code>identity<\/code>, <code>role<\/code>, <code>authn.type<\/code>, <code>authn.status<\/code><\/td>\n<td>Who authenticated and how<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">Service payload<\/strong><\/td>\n<td><code>cmd_service<\/code> (CLI\/NETCONF\/etc.) or <code>grpc_service<\/code> (gNMI\/gNOI\/gNSI\/etc.)<\/td>\n<td>What was executed<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">Authorization<\/strong><\/td>\n<td><code>authz.status<\/code> (PERMIT\/DENY), <code>authz.detail<\/code><\/td>\n<td>Whether it was allowed<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The full proto field tree is in the <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-acctz-management-plane-accounting-on-cisco-ios-xr#appendix-recordresponse-field-tree\" style=\"color: rgb(0, 102, 204)\">Appendix<\/a> at the end of this article.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Command vs gRPC Records<\/h3>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Record type<\/th>\n<th>What it captures<\/th>\n<th>Key fields<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">CommandService<\/strong><\/td>\n<td>CLI, Shell, NETCONF, RESTCONF, WebUI<\/td>\n<td><code>cmd<\/code> + <code>cmd_args<\/code> (expanded from abbreviation), <code>authz<\/code> outcome<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">GrpcService<\/strong><\/td>\n<td>gNMI, gNOI, gNSI, gRIBI, P4RT<\/td>\n<td><code>rpc_name<\/code> (HTTP\/2 <code>:path<\/code> header), optional <code>payload<\/code>, <code>authz<\/code> outcome<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">Note:<\/strong> GRIBI Records can be very verbose. The proto comments recommend keeping GRIBI logging off by default in Authorization Policy.<\/p>\n<\/blockquote>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">IOS XR CLI Reference<\/h2>\n<div style=\"max-width: 100%\" class=\"table-responsive\">\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Command<\/th>\n<th>What it does<\/th>\n<th>Default<\/th>\n<th>Range<\/th>\n<th>Release<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>aaa accounting commands default start-stop group tacacs+<\/code><\/td>\n<td>Enable AAA Accounting (required for Acctz)<\/td>\n<td>\u2014<\/td>\n<td>\u2014<\/td>\n<td>\u2014<\/td>\n<\/tr>\n<tr>\n<td><code>grpc aaa accounting queue-size &lt;n&gt;<\/code><\/td>\n<td>Number of Records the Circular Buffer holds<\/td>\n<td>40<\/td>\n<td>1\u2013512<\/td>\n<td>24.3.1<\/td>\n<\/tr>\n<tr>\n<td><code>grpc aaa accounting history-memory &lt;MB&gt;<\/code><\/td>\n<td>Maximum memory for cached history Records<\/td>\n<td>40 MB<\/td>\n<td>1\u2013400 MB<\/td>\n<td>24.4.1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Show command<\/th>\n<th>What it shows<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>show gnsi state<\/code><\/td>\n<td>gNSI subsystem status (Acctz Thread, RDSFS State)<\/td>\n<\/tr>\n<tr>\n<td><code>show gnsi acctz statistics<\/code><\/td>\n<td>History Buffer, Queue Counters (sent\/dropped\/truncated), connected Collectors, per-Collector Records\/Drops<\/td>\n<\/tr>\n<tr>\n<td><code>show aaa accounting statistics<\/code><\/td>\n<td>AAA-level Accounting event Counters<\/td>\n<\/tr>\n<tr>\n<td><code>show tech-support gnsi<\/code><\/td>\n<td>Full gNSI diagnostic bundle<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">Hands-on: End-to-End Acctz Collection<\/h2>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Prerequisites<\/h3>\n<ul>\n<li>IOS XR router with gRPC enabled (24.3.1 or later for Acctz; 24.4.1+ for AcctzStream)<\/li>\n<li><a href=\"https:\/\/github.com\/fullstorydev\/grpcurl\" style=\"color: rgb(0, 102, 204)\">grpcurl<\/a> installed<\/li>\n<li>OpenConfig gNSI protos cloned: <code>git clone https:\/\/github.com\/openconfig\/gnsi.git<\/code><\/li>\n<li>AAA Accounting configured on the router (see configuration below)<\/li>\n<\/ul>\n<p>This walkthrough covers the full flow: configure the router, discover the RPCs, start a Collector stream, trigger Management Plane activity, inspect the Records, and verify with IOS XR CLI.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Environment (workstation)<\/h3>\n<pre><code><span><span>export<\/span> <span>GNSI_IMPORT<\/span><span>=<\/span><span>\"<span>${GNSI_IMPORT<span>:-<\/span>$PWD}<\/span>\"<\/span>\n<\/span><span><span>export<\/span> <span>XR<\/span><span>=<\/span><span>\"<span>${XR<span>:-<\/span>198.51.100.1<span>:<\/span>57400}<\/span>\"<\/span>\n<\/span><span><span>export<\/span> <span>XR_USER<\/span><span>=<\/span><span>\"<span>${XR_USER<span>:-<\/span>cisco}<\/span>\"<\/span>\n<\/span><span><span>export<\/span> <span>XR_PASS<\/span><span>=<\/span><span>\"<span>${XR_PASS<span>:-<\/span>}<\/span>\"<\/span>\n<\/span><span><span>GRPC_MD<\/span><span>=<\/span><span>(<\/span>-H <span>\"username:<span>${XR_USER}<\/span>\"<\/span> <span>-H<\/span> <span>\"password:<span>${XR_PASS}<\/span>\"<\/span><span>)<\/span>\n<\/span><span><span>PROTO_ACCTZ<\/span><span>=<\/span><span>\"acctz\/acctz.proto\"<\/span>\n<\/span><\/code><\/pre>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">Lab only:<\/strong> All examples below use <code>-plaintext<\/code> (no TLS). In production, replace <code>-plaintext<\/code> with <code>-cacert<\/code>, <code>-cert<\/code>, and <code>-key<\/code> flags. See the <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Certz article<\/a> for TLS setup.<\/p>\n<\/blockquote>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Configure the router (IOS XR CLI)<\/h3>\n<p>Enable AAA Accounting (if not already enabled) and tune the Acctz buffer:<\/p>\n<pre><code><span>configure\n<\/span><span> aaa accounting commands default start-stop group tacacs+\n<\/span><span> aaa accounting exec default start-stop group tacacs+\n<\/span><span> grpc aaa accounting queue-size 100\n<\/span><span> grpc aaa accounting history-memory 80\n<\/span><span> commit\n<\/span><span>end\n<\/span><\/code><\/pre>\n<p>Verify gNSI is active:<\/p>\n<pre><code><span>show gnsi state\n<\/span><\/code><\/pre>\n<p>Expected output:<\/p>\n<pre><code><span>----------------GNSI state--------------\n<\/span><span>Global:\n<\/span><span>Main Thread cerrno: Success\n<\/span><span>Acctz Thread cerrno: Success\n<\/span><span>State: Active\n<\/span><span>RDSFS State: Active\n<\/span><\/code><\/pre>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">List Services (Reflection)<\/h3>\n<p>Check which Acctz Services the device exports:<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> list gnsi.acctz.v1.Acctz\n<\/span><\/code><\/pre>\n<pre><code><span>gnsi.acctz.v1.Acctz.RecordSubscribe\n<\/span><\/code><\/pre>\n<pre><code><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> list gnsi.acctz.v1.AcctzStream\n<\/span><\/code><\/pre>\n<pre><code><span>gnsi.acctz.v1.AcctzStream.RecordSubscribe\n<\/span><\/code><\/pre>\n<p>Both services may appear in Reflection, but on current images only <strong style=\"color: rgb(26, 26, 26)\">AcctzStream<\/strong> is implemented. The deprecated <code>Acctz<\/code> (bidirectional) returns <code>Unimplemented<\/code> when called. Always use <code>AcctzStream<\/code>.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Describe the RPC<\/h3>\n<p>Inspect the RecordSubscribe method:<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> describe gnsi.acctz.v1.AcctzStream.RecordSubscribe\n<\/span><\/code><\/pre>\n<p>Router response:<\/p>\n<pre><code><span>gnsi.acctz.v1.AcctzStream.RecordSubscribe is a method:\n<\/span><span>rpc RecordSubscribe (.gnsi.acctz.v1.RecordRequest) returns ( stream.gnsi.acctz.v1.RecordResponse);\n<\/span><\/code><\/pre>\n<p>Print a template for the request message:<\/p>\n<pre><code><span>grpcurl -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> -msg-template describe gnsi.acctz.v1.RecordRequest\n<\/span><\/code><\/pre>\n<p>Router response:<\/p>\n<pre><code><span>Message template:\n<\/span><span>{\n<\/span><span> \"timestamp\": \"1970-01-01T00:00:00Z\"\n<\/span><span>}\n<\/span><\/code><\/pre>\n<p>The <code>timestamp<\/code> field uses RFC 3339 format. <code>\"1970-01-01T00:00:00Z\"<\/code> (epoch zero) means &#8220;send all buffered history.&#8221;<\/p>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\"><code>grpcurl<\/code> tip:<\/strong> the field is a <code>google.protobuf.Timestamp<\/code>, so <code>{\"timestamp\":\"0\"}<\/code> fails with a client-side parse error. Use <code>{\"timestamp\":\"1970-01-01T00:00:00Z\"}<\/code> or just <code>{}<\/code> \u2014 both replay the full buffer.<\/p>\n<\/blockquote>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Subscribe: replay all buffered Records<\/h3>\n<p>Timestamp <code>\"1970-01-01T00:00:00Z\"<\/code> replays everything in the Circular Buffer:<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{\"timestamp\": \"1970-01-01T00:00:00Z\"}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> gnsi.acctz.v1.AcctzStream.RecordSubscribe\n<\/span><\/code><\/pre>\n<p>This streams all buffered history, then continues with new Records in real time. Press <code>Ctrl+C<\/code> to stop. The first Record may include <code>\"historyIstruncated\": true<\/code> \u2014 meaning the Circular Buffer wrapped and older Records were lost:<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"sessionInfo\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"localAddress\"<\/span><span>:<\/span> <span>\"172.20.163.10\"<\/span><span>,<\/span>\n<\/span><span> <span>\"localPort\"<\/span><span>:<\/span> <span>57344<\/span><span>,<\/span>\n<\/span><span> <span>\"remoteAddress\"<\/span><span>:<\/span> <span>\"10.189.10.189\"<\/span><span>,<\/span>\n<\/span><span> <span>\"remotePort\"<\/span><span>:<\/span> <span>58091<\/span><span>,<\/span>\n<\/span><span> <span>\"ipProto\"<\/span><span>:<\/span> <span>6<\/span><span>,<\/span>\n<\/span><span> <span>\"channelId\"<\/span><span>:<\/span> <span>\"0\"<\/span><span>,<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"SESSION_STATUS_OPERATION\"<\/span><span>,<\/span>\n<\/span><span> <span>\"user\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"identity\"<\/span><span>:<\/span> <span>\"cisco\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"timestamp\"<\/span><span>:<\/span> <span>\"2026-04-16T05:51:01.332142269Z\"<\/span><span>,<\/span>\n<\/span><span> <span>\"historyIstruncated\"<\/span><span>:<\/span> <span>true<\/span><span>,<\/span>\n<\/span><span> <span>\"grpcService\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"serviceType\"<\/span><span>:<\/span> <span>\"GRPC_SERVICE_TYPE_GNSI\"<\/span><span>,<\/span>\n<\/span><span> <span>\"rpcName\"<\/span><span>:<\/span> <span>\"\/gnsi.credentialz.v1.Credentialz\/GetPublicKeys\"<\/span><span>,<\/span>\n<\/span><span> <span>\"authz\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"AUTHZ_STATUS_PERMIT\"<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"protoVal\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"@type\"<\/span><span>:<\/span> <span>\"type.googleapis.com\/google.protobuf.BytesValue\"<\/span><span>,<\/span>\n<\/span><span> <span>\"value\"<\/span><span>:<\/span> <span>null<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Subscribe: stream only recent Records<\/h3>\n<p>To stream Records from the last hour (ISO 8601\/RFC 3339 format):<\/p>\n<pre><code><span><span># macOS:<\/span>\n<\/span><span><span>SINCE<\/span><span>=<\/span><span><span>$(<\/span><span>date<\/span> <span>-u<\/span> -v-1H +<span>\"%Y-%m-%dT%H:%M:%SZ\"<\/span><span>)<\/span><\/span>\n<\/span><span><span># Linux:<\/span>\n<\/span><span><span># SINCE=$(date -u -d \"1 hour ago\" +\"%Y-%m-%dT%H:%M:%SZ\")<\/span>\n<\/span><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>\"{<span title=\"\\&quot;\">\\\"<\/span>timestamp<span title=\"\\&quot;\">\\\"<\/span>: <span title=\"\\&quot;\">\\\"<\/span><span>${SINCE}<\/span><span title=\"\\&quot;\">\\\"<\/span>}\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> gnsi.acctz.v1.AcctzStream.RecordSubscribe\n<\/span><\/code><\/pre>\n<p>To stream only <strong style=\"color: rgb(26, 26, 26)\">new<\/strong> Records going forward (skip history):<\/p>\n<pre><code><span><span>NOW<\/span><span>=<\/span><span><span>$(<\/span><span>date<\/span> <span>-u<\/span> +<span>\"%Y-%m-%dT%H:%M:%SZ\"<\/span><span>)<\/span><\/span>\n<\/span><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>\"{<span title=\"\\&quot;\">\\\"<\/span>timestamp<span title=\"\\&quot;\">\\\"<\/span>: <span title=\"\\&quot;\">\\\"<\/span><span>${NOW}<\/span><span title=\"\\&quot;\">\\\"<\/span>}\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> gnsi.acctz.v1.AcctzStream.RecordSubscribe\n<\/span><\/code><\/pre>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Trigger activity and watch Records arrive<\/h3>\n<p>With the stream running in one terminal, open a second terminal and trigger some gRPC activity:<\/p>\n<pre><code><span><span># Credentialz CanGenerateKey<\/span>\n<\/span><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"credentialz\/credentialz.proto\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{\"keyParams\": \"KEY_GEN_SSH_KEY_TYPE_EDDSA_ED25519\"}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> gnsi.credentialz.v1.Credentialz.CanGenerateKey\n<\/span><span><span># Certz GetProfileList<\/span>\n<\/span><span>grpcurl <span>-plaintext<\/span> <span>\\<\/span>\n<\/span><span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-proto<\/span> <span>\"certz\/certz.proto\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> gnsi.certz.v1.Certz.GetProfileList\n<\/span><\/code><\/pre>\n<p>Switch back to the Acctz stream terminal. New RecordResponse messages appear \u2014 one for each gRPC RPC executed.<\/p>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">On 25.3.1:<\/strong> every unary gRPC RPC (<code>gNMI\/Get<\/code>, <code>gNMI\/Set<\/code>, <code>Pathz\/Get<\/code>, <code>Credentialz\/CanGenerateKey<\/code>, <code>Credentialz\/GetPublicKeys<\/code>) emits <strong style=\"color: rgb(26, 26, 26)\">two<\/strong> records ~80 \u00b5s apart with identical <code>grpcService.rpcName<\/code>, <code>authz<\/code>, and <code>protoVal<\/code>. Plan collector capacity and per-RPC alerting around 2\u00d7 fan-out for unary calls.<\/p>\n<\/blockquote>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Read a RecordResponse<\/h3>\n<p>Here is a real gRPC Service Record captured from a Cisco 8000 router. This Record was generated when <code>Credentialz.CanGenerateKey<\/code> was called:<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"sessionInfo\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"localAddress\"<\/span><span>:<\/span> <span>\"172.20.163.10\"<\/span><span>,<\/span>\n<\/span><span> <span>\"localPort\"<\/span><span>:<\/span> <span>57344<\/span><span>,<\/span>\n<\/span><span> <span>\"remoteAddress\"<\/span><span>:<\/span> <span>\"10.189.10.189\"<\/span><span>,<\/span>\n<\/span><span> <span>\"remotePort\"<\/span><span>:<\/span> <span>58913<\/span><span>,<\/span>\n<\/span><span> <span>\"ipProto\"<\/span><span>:<\/span> <span>6<\/span><span>,<\/span>\n<\/span><span> <span>\"channelId\"<\/span><span>:<\/span> <span>\"0\"<\/span><span>,<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"SESSION_STATUS_OPERATION\"<\/span><span>,<\/span>\n<\/span><span> <span>\"user\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"identity\"<\/span><span>:<\/span> <span>\"cisco\"<\/span><span>,<\/span>\n<\/span><span> <span>\"role\"<\/span><span>:<\/span> <span>\"root-lr, netadmin, cisco-support\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"timestamp\"<\/span><span>:<\/span> <span>\"2026-04-16T06:01:47.028597996Z\"<\/span><span>,<\/span>\n<\/span><span> <span>\"grpcService\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"serviceType\"<\/span><span>:<\/span> <span>\"GRPC_SERVICE_TYPE_GNSI\"<\/span><span>,<\/span>\n<\/span><span> <span>\"rpcName\"<\/span><span>:<\/span> <span>\"\/gnsi.credentialz.v1.Credentialz\/CanGenerateKey\"<\/span><span>,<\/span>\n<\/span><span> <span>\"authz\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"AUTHZ_STATUS_PERMIT\"<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"protoVal\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"@type\"<\/span><span>:<\/span> <span>\"type.googleapis.com\/google.protobuf.BytesValue\"<\/span><span>,<\/span>\n<\/span><span> <span>\"value\"<\/span><span>:<\/span> <span>\"CAQ=\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p>And a Record for <code>Certz.GetProfileList<\/code> \u2014 notice the payload is <code>null<\/code> (empty response body, not truncated):<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"sessionInfo\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"localAddress\"<\/span><span>:<\/span> <span>\"172.20.163.10\"<\/span><span>,<\/span>\n<\/span><span> <span>\"localPort\"<\/span><span>:<\/span> <span>57344<\/span><span>,<\/span>\n<\/span><span> <span>\"remoteAddress\"<\/span><span>:<\/span> <span>\"10.189.10.189\"<\/span><span>,<\/span>\n<\/span><span> <span>\"remotePort\"<\/span><span>:<\/span> <span>58914<\/span><span>,<\/span>\n<\/span><span> <span>\"ipProto\"<\/span><span>:<\/span> <span>6<\/span><span>,<\/span>\n<\/span><span> <span>\"channelId\"<\/span><span>:<\/span> <span>\"0\"<\/span><span>,<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"SESSION_STATUS_OPERATION\"<\/span><span>,<\/span>\n<\/span><span> <span>\"user\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"identity\"<\/span><span>:<\/span> <span>\"cisco\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"timestamp\"<\/span><span>:<\/span> <span>\"2026-04-16T06:01:47.400770922Z\"<\/span><span>,<\/span>\n<\/span><span> <span>\"grpcService\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"serviceType\"<\/span><span>:<\/span> <span>\"GRPC_SERVICE_TYPE_GNSI\"<\/span><span>,<\/span>\n<\/span><span> <span>\"rpcName\"<\/span><span>:<\/span> <span>\"\/gnsi.certz.v1.Certz\/GetProfileList\"<\/span><span>,<\/span>\n<\/span><span> <span>\"authz\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"AUTHZ_STATUS_PERMIT\"<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"protoVal\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"@type\"<\/span><span>:<\/span> <span>\"type.googleapis.com\/google.protobuf.BytesValue\"<\/span><span>,<\/span>\n<\/span><span> <span>\"value\"<\/span><span>:<\/span> <span>null<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p>A Record for a streaming RPC like <code>RotateHostParameters<\/code> \u2014 note <code>payloadIstruncated: true<\/code> (large streaming payload is not fully captured):<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"sessionInfo\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"localAddress\"<\/span><span>:<\/span> <span>\"172.20.163.10\"<\/span><span>,<\/span>\n<\/span><span> <span>\"localPort\"<\/span><span>:<\/span> <span>57344<\/span><span>,<\/span>\n<\/span><span> <span>\"remoteAddress\"<\/span><span>:<\/span> <span>\"10.189.10.189\"<\/span><span>,<\/span>\n<\/span><span> <span>\"remotePort\"<\/span><span>:<\/span> <span>58076<\/span><span>,<\/span>\n<\/span><span> <span>\"ipProto\"<\/span><span>:<\/span> <span>6<\/span><span>,<\/span>\n<\/span><span> <span>\"channelId\"<\/span><span>:<\/span> <span>\"0\"<\/span><span>,<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"SESSION_STATUS_OPERATION\"<\/span><span>,<\/span>\n<\/span><span> <span>\"user\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"identity\"<\/span><span>:<\/span> <span>\"cisco\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"timestamp\"<\/span><span>:<\/span> <span>\"2026-04-16T05:50:39.054469860Z\"<\/span><span>,<\/span>\n<\/span><span> <span>\"grpcService\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"serviceType\"<\/span><span>:<\/span> <span>\"GRPC_SERVICE_TYPE_GNSI\"<\/span><span>,<\/span>\n<\/span><span> <span>\"rpcName\"<\/span><span>:<\/span> <span>\"\/gnsi.credentialz.v1.Credentialz\/RotateHostParameters\"<\/span><span>,<\/span>\n<\/span><span> <span>\"payloadIstruncated\"<\/span><span>:<\/span> <span>true<\/span><span>,<\/span>\n<\/span><span> <span>\"authz\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"AUTHZ_STATUS_PERMIT\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p>And the Acctz stream itself generates a self-referential Record:<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"sessionInfo\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"localAddress\"<\/span><span>:<\/span> <span>\"172.20.163.10\"<\/span><span>,<\/span>\n<\/span><span> <span>\"localPort\"<\/span><span>:<\/span> <span>57344<\/span><span>,<\/span>\n<\/span><span> <span>\"remoteAddress\"<\/span><span>:<\/span> <span>\"10.189.10.189\"<\/span><span>,<\/span>\n<\/span><span> <span>\"remotePort\"<\/span><span>:<\/span> <span>58880<\/span><span>,<\/span>\n<\/span><span> <span>\"ipProto\"<\/span><span>:<\/span> <span>6<\/span><span>,<\/span>\n<\/span><span> <span>\"channelId\"<\/span><span>:<\/span> <span>\"0\"<\/span><span>,<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"SESSION_STATUS_OPERATION\"<\/span><span>,<\/span>\n<\/span><span> <span>\"user\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"identity\"<\/span><span>:<\/span> <span>\"cisco\"<\/span><span>,<\/span>\n<\/span><span> <span>\"role\"<\/span><span>:<\/span> <span>\"root-lr, netadmin, cisco-support\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>\"timestamp\"<\/span><span>:<\/span> <span>\"2026-04-16T06:01:22.999917154Z\"<\/span><span>,<\/span>\n<\/span><span> <span>\"grpcService\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"serviceType\"<\/span><span>:<\/span> <span>\"GRPC_SERVICE_TYPE_GNSI\"<\/span><span>,<\/span>\n<\/span><span> <span>\"rpcName\"<\/span><span>:<\/span> <span>\"\/gnsi.acctz.v1.AcctzStream\/RecordSubscribe\"<\/span><span>,<\/span>\n<\/span><span> <span>\"payloadIstruncated\"<\/span><span>:<\/span> <span>true<\/span><span>,<\/span>\n<\/span><span> <span>\"authz\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"status\"<\/span><span>:<\/span> <span>\"AUTHZ_STATUS_PERMIT\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p>Key fields to look for:<\/p>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Field<\/th>\n<th>What it tells<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>sessionInfo.user.identity<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">Who<\/strong> \u2014 the username or SPIFFE ID<\/td>\n<\/tr>\n<tr>\n<td><code>sessionInfo.user.role<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">User groups<\/strong> \u2014 <code>root-lr, netadmin, cisco-support<\/code> etc. (may appear on some Records)<\/td>\n<\/tr>\n<tr>\n<td><code>sessionInfo.remoteAddress<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">From where<\/strong> \u2014 the client IP<\/td>\n<\/tr>\n<tr>\n<td><code>sessionInfo.status<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">Session type<\/strong> \u2014 <code>SESSION_STATUS_OPERATION<\/code> for RPC calls, <code>SESSION_STATUS_LOGIN<\/code>\/<code>LOGOUT<\/code> for session events<\/td>\n<\/tr>\n<tr>\n<td><code>grpcService.rpcName<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">What<\/strong> \u2014 the full gRPC path (e.g., <code>\/gnsi.credentialz.v1.Credentialz\/CanGenerateKey<\/code>)<\/td>\n<\/tr>\n<tr>\n<td><code>grpcService.serviceType<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">Which gRPC family<\/strong> \u2014 <code>GRPC_SERVICE_TYPE_GNSI<\/code>, <code>GRPC_SERVICE_TYPE_GNMI<\/code>, etc.<\/td>\n<\/tr>\n<tr>\n<td><code>grpcService.authz.status<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">Allowed or denied<\/strong> \u2014 <code>AUTHZ_STATUS_PERMIT<\/code> or <code>AUTHZ_STATUS_DENY<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>grpcService.payloadIstruncated<\/code><\/td>\n<td>Whether the payload was too large to include in full<\/td>\n<\/tr>\n<tr>\n<td><code>grpcService.protoVal<\/code><\/td>\n<td>Payload snapshot (base64-encoded protobuf) \u2014 present for unary RPCs, absent for truncated streaming RPCs<\/td>\n<\/tr>\n<tr>\n<td><code>cmdService.cmd<\/code> + <code>cmdArgs<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">CLI command<\/strong> \u2014 expanded from abbreviation (for CommandService Records)<\/td>\n<\/tr>\n<tr>\n<td><code>timestamp<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">When<\/strong> \u2014 RFC 3339 with nanosecond precision<\/td>\n<\/tr>\n<tr>\n<td><code>historyIstruncated<\/code><\/td>\n<td>Whether Records were lost before this point (buffer wrapped)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">On 25.3.1:<\/strong> <code>sessionInfo.user.role<\/code> is inconsistent \u2014 back-to-back records for the same user on the same channel sometimes include <code>\"role\": \"root-lr, cisco-support\"<\/code> and sometimes omit the <code>role<\/code> key entirely. Correlate alerting rules by <code>identity<\/code>, not <code>role<\/code>, on this build.<\/p>\n<\/blockquote>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">On 25.3.1:<\/strong> failed gRPC auth is mislabeled. A wrong-password <code>grpcurl<\/code> call emits a <code>SESSION_STATUS_LOGIN<\/code> record tagged <code>CMD_SERVICE_TYPE_CLI<\/code> (despite no CLI being touched) plus a <code>SESSION_STATUS_OPERATION \/ AUTHZ_STATUS_DENY<\/code> record on <code>ServerReflectionInfo<\/code>. The LOGIN-side records also carry <code>localAddress: \"None\"<\/code> \/ <code>remoteAddress: \"None\"<\/code>, so compliance pipelines that key off the 5-tuple cannot attribute the failed login.<\/p>\n<\/blockquote>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">Security-relevant on 25.3.1:<\/strong> when a <code>gNMI\/Set<\/code> is denied by Pathz, the Acctz record&#8217;s <code>protoVal<\/code> still contains the full base64-encoded payload of what the caller tried to set. A denied <code>Credentialz\/RotateAccountCredentials.password<\/code> or <code>Certz\/Rotate<\/code> would therefore leak secret material into the audit log. Treat <code>protoVal<\/code> as sensitive and encrypt the audit pipe end-to-end \u2014 we observed no redaction on the denied path.<\/p>\n<\/blockquote>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Verify on IOS XR<\/h3>\n<p>After running the stream, verify Records were produced and delivered:<\/p>\n<pre><code><span>show gnsi acctz statistics\n<\/span><\/code><\/pre>\n<p>Sample output (trimmed):<\/p>\n<pre><code><span>Acctz History Buffer:\n<\/span><span> Total Records: 80029\n<\/span><span> Total History Truncation: 0\n<\/span><span> Grpc Service Records:\n<\/span><span> GNMI: 80002\n<\/span><span> GNOI: 0\n<\/span><span> GNSI: 4\n<\/span><span> GRIBI: 0\n<\/span><span> P4RT: 0\n<\/span><span> Cmd Service Records:\n<\/span><span> Shell: 0\n<\/span><span> Cli: 23\n<\/span><span> Netconf: 0\n<\/span><span> History snapshot:\n<\/span><span> Max Memory Size: 80 MB\n<\/span><span> Memory Used: 0 MB\n<\/span><span> Max Number Of Records: 100\n<\/span><span> Records Used: 30\n<\/span><span>gRPC Accounting Queue:\n<\/span><span> Grpc services:\n<\/span><span> GNMI: 80002 sent, 0 dropped, 0 truncated\n<\/span><span> GNOI: 0 sent, 0 dropped, 0 truncated\n<\/span><span> GNSI: 4 sent, 0 dropped, 4 truncated\n<\/span><span>...\n<\/span><span>Cmd Accounting Queue:\n<\/span><span> Cmd services:\n<\/span><span> Shell: 0 sent, 0 dropped, 0 truncated\n<\/span><span> Cli: 23 sent, 0 dropped, 0 truncated\n<\/span><span> Netconf: 0 sent, 0 dropped, 0 truncated\n<\/span><span>...\n<\/span><span>Client Stats:\n<\/span><span> Number Of Clients: 1\n<\/span><span> History Truncation Events: 0\n<\/span><span> Record Requests: 4\n<\/span><span> Record Responses: 80029\n<\/span><span>Collectors:\n<\/span><span> Collector Statistics:\n<\/span><span> IP: 192.168.122.1\n<\/span><span> Port: 25906\n<\/span><span> Total: Records: 80029, Drops: 0\n<\/span><span> Grpc Service Records:\n<\/span><span> gNMI: Records: 80002, Drops: 0\n<\/span><span> gNSI: Records: 4, Drops: 0\n<\/span><span> Cmd Service Records:\n<\/span><span> CLI: Records: 23, Drops: 0\n<\/span><\/code><\/pre>\n<p>What to check:<\/p>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>Section<\/th>\n<th>What to look for<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">History Buffer<\/strong><\/td>\n<td><code>Total Records<\/code> should be non-zero. <code>Total History Truncation<\/code> should be <code>0<\/code> \u2014 non-zero means Records were lost.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">Queue Counters<\/strong><\/td>\n<td><code>dropped<\/code> and <code>truncated<\/code> Counters per Service. Non-zero drops mean the queue overflowed.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">Client Stats<\/strong><\/td>\n<td><code>Number Of Clients<\/code> \u2265 1. <code>Record Responses<\/code> should match what the Collector received.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">Collector Statistics<\/strong><\/td>\n<td>Per-Collector Records and Drops \u2014 confirms delivery to each connected Collector.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Also verify AAA-level Accounting:<\/p>\n<pre><code><span>show aaa accounting statistics\n<\/span><\/code><\/pre>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">CLI auditing gaps on 25.3.1.<\/strong> Two related observations operators should plan around:<\/p>\n<ul>\n<li><code>show aaa accounting statistics<\/code> is decoupled from gNSI Acctz \u2014 the AAA view stays at <code>GNMI\/GNSI\/GNOI\/GRIBI\/P4RT: 0<\/code> regardless of how many records AcctzStream emits. The only authoritative view of streamed records is <code>show gnsi acctz statistics<\/code> plus the stream itself.<\/li>\n<li>SSH <code>show<\/code> commands do <strong style=\"color: rgb(26, 26, 26)\">not<\/strong> produce <code>CommandService<\/code> records (only a single <code>SESSION_STATUS_LOGIN<\/code> per session). Per-command Acctz logging for SSH-driven CLI is a gap on this build; structured CLI auditing still relies on TACACS+ AAA.<\/li>\n<\/ul>\n<\/blockquote>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Cleanup: stop the Collector<\/h3>\n<p>Press <code>Ctrl+C<\/code> in the grpcurl terminal to stop the stream. The server cleans up the Collector session automatically. Verify with:<\/p>\n<pre><code><span>show gnsi acctz statistics\n<\/span><\/code><\/pre>\n<p><code>Number Of Clients<\/code> should drop by 1.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">grpcurl Debugging Aids<\/h3>\n<pre><code><span><span># Describe the RPC and its streaming semantics<\/span>\n<\/span><span>grpcurl -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> describe gnsi.acctz.v1.AcctzStream.RecordSubscribe\n<\/span><span><span># Show the RecordRequest message template<\/span>\n<\/span><span>grpcurl -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> -msg-template describe gnsi.acctz.v1.RecordRequest\n<\/span><span><span># Show the RecordResponse message structure<\/span>\n<\/span><span>grpcurl -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_ACCTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> -msg-template describe gnsi.acctz.v1.RecordResponse\n<\/span><\/code><\/pre>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">Monitoring with YANG Telemetry<\/h2>\n<p>The OpenConfig YANG model <strong style=\"color: rgb(26, 26, 26)\"><code>openconfig-gnsi-acctz<\/code><\/strong> exposes Counters for both the Collector side and the Record production side.<\/p>\n<blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">On 25.3.1:<\/strong> the device advertises <code>openconfig-gnsi-acctz, 0.2.0<\/code> (not the upstream <code>0.4.0<\/code>), and every operational path under <code>\/system\/aaa\/acctz<\/code> and <code>\/system\/aaa\/accounting<\/code> returns <code>NotFound<\/code>. Use <code>show gnsi acctz statistics<\/code> until the gNMI side lands. The only programmatic signal currently available is the per-RPC counter row for <code>\/gnsi.acctz.v1.AcctzStream\/RecordSubscribe<\/code> under <code>openconfig-gnsi-authz:authz-policy-counters<\/code>.<\/p>\n<\/blockquote>\n<p><strong style=\"color: rgb(26, 26, 26)\">Client Counters<\/strong> (base: <code>\/system\/grpc-servers\/grpc-server[name=&lt;server&gt;]\/acctz\/state\/counters<\/code>):<\/p>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th>YANG path (relative to base)<\/th>\n<th>What it tells<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>...\/record-requests<\/code><\/td>\n<td>Total RecordRequest messages received from Collectors<\/td>\n<\/tr>\n<tr>\n<td><code>...\/record-responses<\/code><\/td>\n<td>Total RecordResponse messages sent to Collectors<\/td>\n<\/tr>\n<tr>\n<td><code>...\/history-istruncated<\/code><\/td>\n<td>How many times a request hit a timestamp older than the buffer \u2014 Records were lost<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong style=\"color: rgb(26, 26, 26)\">Source Record Counters<\/strong> (base: <code>\/system\/aaa\/accounting\/acctz\/source-records\/source-record[service=&lt;SVC&gt;][type=&lt;TYPE&gt;]\/state\/counters<\/code>):<\/p>\n<table class=\"english-numbers\">\n<thead>\n<tr>\n<th><code>[service]<\/code><\/th>\n<th><code>[type]<\/code><\/th>\n<th>What it counts<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>CMD_SERVICE<\/code><\/td>\n<td><code>CLI<\/code><\/td>\n<td>CLI command Records<\/td>\n<\/tr>\n<tr>\n<td><code>CMD_SERVICE<\/code><\/td>\n<td><code>SHELL<\/code><\/td>\n<td>Shell Records<\/td>\n<\/tr>\n<tr>\n<td><code>CMD_SERVICE<\/code><\/td>\n<td><code>NETCONF<\/code><\/td>\n<td>NETCONF Records<\/td>\n<\/tr>\n<tr>\n<td><code>CMD_SERVICE<\/code><\/td>\n<td><code>RESTCONF<\/code><\/td>\n<td>RESTCONF Records<\/td>\n<\/tr>\n<tr>\n<td><code>CMD_SERVICE<\/code><\/td>\n<td><code>WEBUI<\/code><\/td>\n<td>WebUI Records<\/td>\n<\/tr>\n<tr>\n<td><code>GRPC_SERVICE<\/code><\/td>\n<td><code>GNMI<\/code><\/td>\n<td>gNMI Records<\/td>\n<\/tr>\n<tr>\n<td><code>GRPC_SERVICE<\/code><\/td>\n<td><code>GNOI<\/code><\/td>\n<td>gNOI Records<\/td>\n<\/tr>\n<tr>\n<td><code>GRPC_SERVICE<\/code><\/td>\n<td><code>GNSI<\/code><\/td>\n<td>gNSI Records<\/td>\n<\/tr>\n<tr>\n<td><code>GRPC_SERVICE<\/code><\/td>\n<td><code>GRIBI<\/code><\/td>\n<td>gRIBI Records<\/td>\n<\/tr>\n<tr>\n<td><code>GRPC_SERVICE<\/code><\/td>\n<td><code>P4RT<\/code><\/td>\n<td>P4RT Records<\/td>\n<\/tr>\n<tr>\n<td><code>SESSION_SERVICE<\/code><\/td>\n<td><code>LOGIN<\/code><\/td>\n<td>Login event Records<\/td>\n<\/tr>\n<tr>\n<td><code>SESSION_SERVICE<\/code><\/td>\n<td><code>LOGOUT<\/code><\/td>\n<td>Logout event Records<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Each combination exposes a <code>...\/records<\/code> counter. Assemble the full path by substituting <code>[service]<\/code> and <code>[type]<\/code> into the base above.<\/p>\n<p>Subscribe to <code>history-istruncated<\/code> to detect when the Circular Buffer is overflowing \u2014 that means Records are being lost before the Collector picks them up. If this Counter keeps climbing, increase <code>grpc aaa accounting queue-size<\/code> \/ <code>grpc aaa accounting history-memory<\/code> or add Collector capacity.<\/p>\n<p>The Source Record Counters broken down by Service type give a real-time picture of which Management Plane interfaces are most active \u2014 useful for capacity planning and security monitoring.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">Quick Telemetry check with gnmic<\/h3>\n<p>Verify the Acctz Counters with a gNMI Get (<a href=\"https:\/\/gnmic.openconfig.net\/\" style=\"color: rgb(0, 102, 204)\">gnmic<\/a>):<\/p>\n<pre><code><span>gnmic <span>-a<\/span> <span>\"<span>${XR}<\/span>\"<\/span> <span>--insecure<\/span> <span>-u<\/span> <span>\"<span>${XR_USER}<\/span>\"<\/span> <span>-p<\/span> <span>\"<span>${XR_PASS}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> get <span>--path<\/span> <span>\"\/system\/grpc-servers\/grpc-server\/acctz\/state\/counters\/record-responses\"<\/span> <span>\\<\/span>\n<\/span><span> <span>--path<\/span> <span>\"\/system\/grpc-servers\/grpc-server\/acctz\/state\/counters\/history-istruncated\"<\/span>\n<\/span><\/code><\/pre>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">Things to watch out for<\/h2>\n<ul>\n<li><strong style=\"color: rgb(26, 26, 26)\">Buffer overflow:<\/strong> the Circular Buffer is finite. When the <code>Total History Truncation<\/code> Counter in <code>show gnsi acctz statistics<\/code> is non-zero, the Collector fell behind. Increase <code>queue-size<\/code> and <code>history-memory<\/code>, or add Collector bandwidth. <em>(On 25.3.1 NCS-540, <code>history_istruncated<\/code> in the response is not a reliable signal \u2014 see the History and the Circular Buffer section.)<\/em><\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Audit-log secrecy:<\/strong> denied <code>gNMI Set<\/code> records carry the full proposed payload as base64 protobuf in <code>protoVal<\/code>. Encrypt the Audit pipe end-to-end and assume any <code>protoVal<\/code> may contain secrets the caller tried to write before they were blocked.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Two records per unary RPC (25.3.1):<\/strong> every unary gRPC RPC produces two near-identical Acctz records. Plan Collector capacity and per-RPC alerting around 2\u00d7 fan-out for unary RPCs (streaming RPCs still produce a single record with <code>payloadIstruncated: true<\/code>).<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Record size:<\/strong> large gRPC payloads (gNMI Set with big configs, gRIBI AFT entries) produce large Records. Plan Collector storage accordingly. GRIBI logging is especially verbose \u2014 the proto comments recommend keeping it off by default in Authorization Policy.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Truncation fields:<\/strong> both <code>cmd_istruncated<\/code> and <code>payload_istruncated<\/code> signal that the originating service, middleware, or receiver hit an implementation limit. Automation should check these flags and log a warning.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Stuck Collectors:<\/strong> if the server&#8217;s output buffer to a Collector stays full for too long, the server disconnects that Collector (similar to BGP send-hold-timer behavior). New Records are dropped until the Collector reconnects and starts consuming again.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Command expansion:<\/strong> for CLI and Shell Records, abbreviated commands are expanded to their full form (<code>sh ver det | gr foo<\/code> \u2192 <code>show version detail | grep foo<\/code>). Arguments known to the lexicon are expanded; unrecognized tokens remain as-is.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Security:<\/strong> Collectors must be authenticated and network-isolated like any Management Plane traffic. Sensitive payloads (Private Keys rotated via <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Certz<\/a> \/ <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-credentialz-ssh-credential-rotation-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Credentialz<\/a>) are redacted in the Record.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Parallel channels:<\/strong> syslog and TACACS+ may remain as parallel Audit channels. Acctz does not replace them \u2014 it adds structured, gRPC-native Accounting alongside them.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">AcctzStream vs Acctz:<\/strong> <code>AcctzStream<\/code> (server-streaming) is the working implementation. The deprecated bidirectional <code>Acctz<\/code> may appear in Reflection but returns <code>Unimplemented<\/code> when called. Always use <code>AcctzStream.RecordSubscribe<\/code>.<\/li>\n<\/ul>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">Conclusion<\/h2>\n<p>Acctz closes the visibility gap between traditional AAA Accounting and gRPC-first operations. Every CLI command, NETCONF edit, and gRPC RPC gets a structured Record with Session, Authentication, and Authorization detail \u2014 streamable in real time to remote Collectors. With <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Certz<\/a> and <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-credentialz-ssh-credential-rotation-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Credentialz<\/a> handling Authentication, <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">Authz<\/a> and <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/securing-gnmi-with-pathz\" style=\"color: rgb(0, 102, 204)\">Pathz<\/a> handling Authorization, and Acctz completing Accounting, all three pillars of the AAA model are covered on IOS XR.<\/p>\n<ul>\n<li>Acctz <strong style=\"color: rgb(26, 26, 26)\">streams<\/strong> structured Accounting Records to Collectors \u2014 CLI, Shell, NETCONF, RESTCONF, WebUI, gNMI, gNOI, gNSI, gRIBI, P4RT, Login\/Logout.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">Timestamp <code>0<\/code><\/strong> replays the entire Circular Buffer. Current time means &#8220;only new Records.&#8221;<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">RecordResponse<\/strong> carries Session metadata, Authentication details, Authorization outcome, and per-Service payloads (with sensitive material redacted).<\/li>\n<li>Each Record includes <strong style=\"color: rgb(26, 26, 26)\">AuthzDetail<\/strong> (PERMIT\/DENY) \u2014 compliance pipelines can track Authorization decisions alongside the activity itself.<\/li>\n<li>Configure buffer capacity with <code>grpc aaa accounting queue-size<\/code> (default 40, max 512) and <code>grpc aaa accounting history-memory<\/code> (default 40 MB, max 400 MB).<\/li>\n<li>Prefer <strong style=\"color: rgb(26, 26, 26)\">AcctzStream<\/strong> (24.4.1+) over the deprecated bidirectional <code>Acctz<\/code>; confirm on-device with <strong style=\"color: rgb(26, 26, 26)\">Reflection<\/strong>.<\/li>\n<li>YANG Telemetry via <code>openconfig-gnsi-acctz<\/code> tracks Collector consumption, buffer overflow, and per-Service Record production.<\/li>\n<\/ul>\n<p><strong style=\"color: rgb(26, 26, 26)\">What to do next:<\/strong> All five gNSI services \u2014 Authentication (<a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Certz<\/a>, <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-credentialz-ssh-credential-rotation-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Credentialz<\/a>), Authorization (<a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">Authz<\/a>, <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/securing-gnmi-with-pathz\" style=\"color: rgb(0, 102, 204)\">Pathz<\/a>), and Accounting (Acctz) \u2014 are now covered. Return to the <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/introducing-gnsi-grpc-native-aaa-for-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">series overview<\/a> for the full picture.<\/p>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">References<\/h2>\n<ol>\n<li>XRdocs \u2014 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/AcctZ\" style=\"color: rgb(0, 102, 204)\">AcctZ<\/a><\/li>\n<li>OpenConfig \u2014 <a href=\"https:\/\/github.com\/openconfig\/gnsi\/blob\/main\/acctz\/acctz.proto\" style=\"color: rgb(0, 102, 204)\"><code>acctz.proto<\/code><\/a>, <a href=\"https:\/\/github.com\/openconfig\/gnsi\/blob\/main\/acctz\/README.md\" style=\"color: rgb(0, 102, 204)\"><code>acctz\/README.md<\/code><\/a><\/li>\n<li>OpenConfig \u2014 <a href=\"https:\/\/www.netconfcentral.org\/modules\/openconfig-gnsi-acctz\/2024-12-24\/source\/raw\/\" style=\"color: rgb(0, 102, 204)\"><code>openconfig-gnsi-acctz<\/code> YANG model v0.4.0<\/a><\/li>\n<li>Cisco IOS XR \u2014 <a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/iosxr\/cisco8000\/programmability\/b-programmability-configuration-guide-cisco8000\/m-grpc-fundamentals-and-authentication.html\" style=\"color: rgb(0, 102, 204)\">Programmability Configuration Guide: gRPC Applications and Configuration<\/a> (gNSI Acctz Logging + AcctzStream sections)<\/li>\n<li>Cisco IOS XR \u2014 <a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/iosxr\/cisco8000\/programmability\/b-programmability-cr-cisco8000\/grpc-commands.html\" style=\"color: rgb(0, 102, 204)\">Programmability Command Reference: gRPC commands<\/a> (<code>grpc aaa accounting history-memory<\/code>, <code>grpc aaa accounting queue-size<\/code>, <code>show gnsi acctz statistics<\/code>)<\/li>\n<li>Series \u2014 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/introducing-gnsi-grpc-native-aaa-for-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">gNSI on IOS XR overview<\/a><\/li>\n<\/ol>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700\">Appendix: RecordResponse field tree<\/h2>\n<p>Full proto structure for reference. The <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-acctz-management-plane-accounting-on-cisco-ios-xr#recordresponse-structure\" style=\"color: rgb(0, 102, 204)\">RecordResponse Structure<\/a> section above highlights the four key categories.<\/p>\n<pre><code><span>RecordSubscribe(RecordRequest) \u2192 stream RecordResponse\n<\/span><span>\u2502\n<\/span><span>\u251c\u2500\u2500 RecordRequest\n<\/span><span>\u2502 \u2514\u2500\u2500 timestamp: google.protobuf.Timestamp\n<\/span><span>\u2502 (0 = \"send all available Records\")\n<\/span><span>\u2502\n<\/span><span>\u2514\u2500\u2500 stream RecordResponse\n<\/span><span> \u251c\u2500\u2500 session_info (SessionInfo)\n<\/span><span> \u2502 \u251c\u2500\u2500 local_address \/ local_port\n<\/span><span> \u2502 \u251c\u2500\u2500 remote_address \/ remote_port\n<\/span><span> \u2502 \u251c\u2500\u2500 ip_proto (6=TCP, 17=UDP)\n<\/span><span> \u2502 \u251c\u2500\u2500 channel_id\n<\/span><span> \u2502 \u251c\u2500\u2500 tty (console0, vty0, pty0)\n<\/span><span> \u2502 \u251c\u2500\u2500 status (LOGIN, LOGOUT, ONCE, ENABLE, IDLE, OPERATION)\n<\/span><span> \u2502 \u251c\u2500\u2500 user (UserDetail)\n<\/span><span> \u2502 \u2502 \u251c\u2500\u2500 identity (username, SPIFFE ID)\n<\/span><span> \u2502 \u2502 \u251c\u2500\u2500 role (privilege level, user group)\n<\/span><span> \u2502 \u2502 \u2514\u2500\u2500 ssh_principal\n<\/span><span> \u2502 \u2514\u2500\u2500 authn (AuthnDetail)\n<\/span><span> \u2502 \u251c\u2500\u2500 type (PASSWORD, SSHKEY, SSHCERT, TLSCERT, PAP, CHAP)\n<\/span><span> \u2502 \u251c\u2500\u2500 status (SUCCESS, FAIL, ERROR)\n<\/span><span> \u2502 \u2514\u2500\u2500 cause\n<\/span><span> \u251c\u2500\u2500 timestamp\n<\/span><span> \u251c\u2500\u2500 history_istruncated: bool\n<\/span><span> \u251c\u2500\u2500 service_request (oneof)\n<\/span><span> \u2502 \u251c\u2500\u2500 cmd_service (CommandService)\n<\/span><span> \u2502 \u2502 \u251c\u2500\u2500 service_type (SHELL, CLI, WEBUI, RESTCONF, NETCONF)\n<\/span><span> \u2502 \u2502 \u251c\u2500\u2500 cmd, cmd_istruncated\n<\/span><span> \u2502 \u2502 \u251c\u2500\u2500 cmd_args[], cmd_args_istruncated\n<\/span><span> \u2502 \u2502 \u2514\u2500\u2500 authz (AuthzDetail: PERMIT\/DENY + detail)\n<\/span><span> \u2502 \u2514\u2500\u2500 grpc_service (GrpcService)\n<\/span><span> \u2502 \u251c\u2500\u2500 service_type (GNMI, GNOI, GNSI, GRIBI, P4RT)\n<\/span><span> \u2502 \u251c\u2500\u2500 rpc_name (\"\/gnmi.gNMI\/Set\", etc.)\n<\/span><span> \u2502 \u251c\u2500\u2500 payload (proto_val or string_val)\n<\/span><span> \u2502 \u251c\u2500\u2500 payload_istruncated\n<\/span><span> \u2502 \u2514\u2500\u2500 authz (AuthzDetail: PERMIT\/DENY + detail)\n<\/span><span> \u251c\u2500\u2500 component_name\n<\/span><span> \u2514\u2500\u2500 task_ids[]\n<\/span><\/code><\/pre>\n<hr>\n<div title=\"\u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0644 \u0627\u06cc\u0646 \u0628\u062e\u0634\" style=\"display: flex\"><svg width=\"14\" height=\"14\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\"><\/svg><\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The Problem Certz authenticates clients through TLS. Authz decides which gRPC Services a user can call. Pathz controls which gNMI Paths they can touch.\u2026<\/p>\n","protected":false},"author":1,"featured_media":240,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[111,238,240,69,243,37],"tags":[],"class_list":["post-243","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-automation-en","category-gnsi-en","category-grpc-en","category-iosxr-en-en","category-programmability-en","category-security-en"],"_links":{"self":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/posts\/243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/comments?post=243"}],"version-history":[{"count":1,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/posts\/243\/revisions"}],"predecessor-version":[{"id":245,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/posts\/243\/revisions\/245"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/media\/240"}],"wp:attachment":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/media?parent=243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/categories?post=243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/tags?post=243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}