My Cisco TACACS event source is still collecting. My admin did a bunch of authentications for me today with it, and I see them in the historic query in the Event Viewer.
But, when I query the Access Control table, there's nothing for over a month. No ESU was run in that time. We never went to Content 2.0 on this, and I'm not sure it's even at 2.0 yet.
What would prevent this from parsing now? One of the NIC services on the D-SRV bad or needs to be restarted?
Just need a quick idea of what to do. This makes no sense.