diff --git a/tests/tacacs/test_accounting.py b/tests/tacacs/test_accounting.py
index 81b77df6067..c06c07bb63a 100644
--- a/tests/tacacs/test_accounting.py
+++ b/tests/tacacs/test_accounting.py
@@ -39,17 +39,33 @@ def cleanup_tacacs_log(ptfhost, rw_user_client):
     ssh_run_command(rw_user_client, 'sudo truncate -s 0 /var/log/syslog')
 
 
+def host_run_command(host, command):
+    if isinstance(host, PTFHost):
+        return host.command(command)
+    else:
+        return host.shell("sudo {0}".format(command))
+
+
+def flush_log(host, log_file):
+    if "syslog" in log_file:
+        # force flush syslog by reopen log file and write cached data to disk:
+        #   https://man7.org/linux/man-pages/man8/rsyslogd.8.html
+        #   https://man7.org/linux/man-pages/man1/sync.1.html
+        host_run_command(host, "kill -HUP $(cat /var/run/rsyslogd.pid)")
+        host_run_command(host, "sync {0}".format(log_file))
+    else:
+        host_run_command(host, "sync {0}".format(log_file))
+
+
 def wait_for_log(host, log_file, pattern, timeout=20, check_interval=1):
     wait_time = 0
     while wait_time <= timeout:
+        flush_log(host, log_file)
         sed_command = "sed -nE '{0}' {1}".format(pattern, log_file)
-        logger.info(sed_command)  # lgtm [py/clear-text-logging-sensitive-data]
-        if isinstance(host, PTFHost):
-            res = host.command(sed_command)
-        else:
-            res = host.shell(sed_command)
+        logger.debug(sed_command)  # lgtm [py/clear-text-logging-sensitive-data]
+        res = host_run_command(host, sed_command)
 
-        logger.info(res["stdout_lines"])
+        logger.debug(res["stdout_lines"])
         if len(res["stdout_lines"]) > 0:
             return res["stdout_lines"]
 
@@ -94,6 +110,12 @@ def check_local_log_exist(duthost, tacacs_creds, command):
     log_pattern = "/INFO audisp-tacplus.+Accounting: user: {0},.*, command: .*{1},/P" \
                   .format(username, command)
     logs = wait_for_log(duthost, "/var/log/syslog", log_pattern)
+
+    if len(logs) == 0:
+        # print recent logs for debug
+        recent_logs = duthost.command("cat /var/log/syslog | tail -n 500")
+        logger.debug("Found logs: %s", recent_logs)
+
     pytest_assert(len(logs) > 0)
 
     # exclude logs of the sed command produced by Ansible