This case study examines the csutil.exe, a very useful utility that comes with the CS ACS software. Csutil.exe is in the following location:
For example, C:\Program Files\CiscoSecure ACS v3.2\utils\
The command syntax is as follows:
CSUtil.exe [-q] [-c] [-d] [-g] [-i filename] [[-p] -l filename] [-e - number] [-b filename] [-r filename] [-f] [-n] [-u] [-y] [-listUDV] [-addUDV slotfilename] [- delUDV slot]
To run this utility, some options require you to stop the services. To do this, use the net stop command. Example 13-12 shows the CSAuth service stopped with the net stop command.
Example 13-12. Stopping the CSAuth Service
Csutil.exe has many options/arguments for different purposes. Table 13-5 summarizes the options.
Back Up and Restore the CS ACS Database
Database backup and restore can be accomplished from the GUI and by browsing to the System Configuration option. However, due to csadmin failure, GUI access may be unavailable. Besides, if performing backup/restore requires an external script, using csutil.exe is very handy. When performing the backup function, services will automatically be stopped, which means no user authentication occurs during the backup. You are prompted for confirmation. You may use the quiet mode to bypass this confirmation. The backup will contain the following information:
If a component of the backup is empty, a Backup Failed notice will be displayed for that component only. To uninstall or upgrade, copy the backup file to a safe location; otherwise it will be removed. The command syntax for database backup is as follows:
C:\Program Files\CiscoSecure ACS v3.2\csutil -b filename
Example 13-13 shows the sample output of a database backup.
Example 13-13. Sample Run of Database Backup
If you restore the CS ACS database, services will automatically be stopped. You can restore user and group information or system configuration or both. Note that you can restore data only to the same version of CS ACS as the backup file, which means that this is not a system upgrade path. The following is the syntax used for database restore:
C:\> csutil r [users|config|all] filename
Example 13-14 shows an example of database restore.
Example 13-14. Sample Run of Database Restore
Creating a Dump Text File
A dump text file contains only the user and group information. This is useful for troubleshooting user profile issues. Cisco support may be able to load a dump file from your dump file to view user configuration to troubleshoot any possible configuration issue. Before creating a dump file, you need to manually stop the CSAuth service with the following command:
C:\> net stop CSAuth
Note that no user authentication takes place while the service is stopped. You must start the service manually with net start CSAuth once you are finished creating the dump. Command syntax to create dump file is as follows:
csutil d filename
Example 13-15 shows a sample run of the creation of a dump file.
Example 13-15. A Sample Run of Dump Text File Creation
To load the dump file into CS ACS, first stop the CSAuth service, which means that user authentication will be stopped during that time. Loading a dump file will replace existing data. You can use the -p option to reset password aging counters. The syntax to use for loading the dump file is as follows:
csutil p l filename
Example 13-16 shows a sample run of a creation of a dump.txt file.
Example 13-16. Sample Run of Dump.txt File Creation