jonashauge Thanks!
That's how it is configured on our MX device:
[edit system syslog]
file User-Commands {
interactive-commands any;
archive size 5m files 100 no-world-readable;
[edit system accounting]
events [ login change-log interactive-commands ];
destination {
tacplus {
server {
1.1.1.1 {
secret "$9$ZGj.5n6A0OR9AvLxNY2"; ## SECRET-DATA
single-connection;
source-address 2.2.2.2;