In a TACACS+ accounting REQUEST, what do the START, STOP and WATCHDOG flags mean, and which combinations are legal?

## Why a record set needs a lifecycle at all A typed command is instantaneous, but much of what device-administration accounting describes is not: a shell task that lasts an afternoon, a connection that stays up overnight. If a record were only written at the end, an auditor reading the log during the event would see nothing, and a task that never ends would never appear at all. TACACS+ therefore gives the accounting REQUEST a small lifecycle, carried in one flags byte at the head of the body. Note which flags these are. TACACS+ has four unrelated fields called flags — the 12-byte header's flags byte with `TAC_PLUS_UNENCRYPTED_FLAG := 0x01` and `TAC_PLUS_SINGLE_CONNECT_FLAG := 0x04`, the authentication REPLY flags, the CONTINUE flags, and this one. The three bits below live in the **accounting body**, not in the header. ## The three bits | Flag | Value | What the record asserts | |---|---|---| | `TAC_PLUS_ACCT_FLAG_START` | `0x02` | a task has begun | | `TAC_PLUS_ACCT_FLAG_STOP` | `0x04` | a task has ended | | `TAC_PLUS_ACCT_FLAG_WATCHDOG` | `0x08` | a task that began earlier is still running | The watchdog record is the interesting one, because it is the only record type whose meaning changes depending on what else is set beside it. ## The combination table 1. **START alone** — the task began. For command accounting this is usually the whole story, because the specification's obligation on a client configured to log all commands is a start accounting packet per command. 2. **STOP alone** — the task ended. This is the record that carries the closing data: `stop_time`, `elapsed_time`, a `reason`, and counters such as `bytes` or `paks` where they apply. 3. **WATCHDOG alone** — the task is still running, and **nothing else**. The server must ignore any arguments such a record carries, so a client cannot smuggle an update into a bare watchdog. 4. **WATCHDOG together with START** — the task is still running **and** this update carries additional or updated arguments. This is the combination to reach for when something about a live task has changed and the server should see the new values. 5. **START together with STOP** — invalid. They are mutually exclusive. 6. **STOP together with WATCHDOG** — invalid. A task cannot be simultaneously finished and still running. When a client asks for an invalid combination the server must respond `TAC_PLUS_ACCT_STATUS_ERROR := 0x02`. That is a protocol-level refusal of a malformed request, not a judgement about the action the record described — accounting has no negative verdict to give, because it adjudicates nothing. ## What each record is good for when you read the log back - A **start** record establishes that something began, with a timestamp and the identity of whoever began it. - A **watchdog** record proves liveness at a moment in between, which is what stops a twelve-hour task looking like a gap in the trail. - A **stop** record is the one that makes the pair a closed interval. Without it you know a task started and nothing more. - A start with no stop is therefore **ambiguous, not empty**: the task may still be running, the device may have been reloaded mid-task, or the stop record may have been lost. ## The failure that actually shows up The realistic production reading problem is not a malformed flags byte — a device implementation gets that right or it does not. It is a log full of start records whose stops never arrived, usually because the task outlived the device's own state or the record could not be delivered. Reading that log honestly means treating an unclosed start as an open question, and this is exactly where a watchdog record earns its place: it tells you the task was alive at a known later moment, which narrows the window a reviewer has to account for. A second, quieter trap is assuming a watchdog is free to update the record. It is not, unless START is set with it. A device that emits bare watchdogs carrying revised arguments is emitting arguments the server is required to discard, and the operator will find the record never changed.