How config changes logged? [7:20968]
Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see updowns etc.. Best regards, Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=20968&t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
How config changes logged? [7:20968]
Configuration changes are logged, but not what commands were changed. The
configuration change log messages are severity 5 (notification), so if your
logging only shows warnings and higher, you won't see the notifications.
Example of a notification...
.Sep 24 10:25:39 EST: %SYS-5-CONFIG_I: Configured from console by vty0
(1.2.99.2)
As you can see, it doesn't show what was changed or who changed it (beyond
an IP address - I think with tacacs implemented you will see the user), but
at least it shows the time.
JMcL
- Forwarded by Jenny Mcleod/NSO/CSDA on 26/09/2001 03:43 pm -
"Cisco
Breaker" To:
[EMAIL PROTECTED]
Subject: How config changes logged?
[7:20968]
Sent
by:
nobody@groupst
udy.com
25/09/2001
06:00
pm
Please
respond
to
"Cisco
Breaker"
Hi everyone?
Does anybody know how to view the last time the config changed or how to
view which commands added at what time to a router? I tried show log I only
see updowns etc..
Best regards,
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=21106&t=20968
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+ aaa accounting connection default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ AAA accounting will solve this problem. However, you will have t setup a TACACS server and an accounting file. >From: "Cisco Breaker" >Reply-To: "Cisco Breaker" >To: [EMAIL PROTECTED] >Subject: How config changes logged? [7:20968] >Date: Tue, 25 Sep 2001 04:00:47 -0400 > >Hi everyone? > >Does anybody know how to view the last time the config changed or how to >view which commands added at what time to a router? I tried show log I only >see misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=20973&t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
My problem is to view this type of info without TACACS, with show commands. Best regards, ""Sean Young"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > aaa accounting exec default start-stop group tacacs+ > aaa accounting commands 0 default start-stop group tacacs+ > aaa accounting commands 1 default start-stop group tacacs+ > aaa accounting commands 15 default start-stop group tacacs+ > aaa accounting network default start-stop group tacacs+ > aaa accounting connection default start-stop group tacacs+ > aaa accounting system default start-stop group tacacs+ > > AAA accounting will solve this problem. However, you will have t setup a > TACACS server and an accounting file. > > >From: "Cisco Breaker" >Reply-To: "Cisco Breaker" >To: > [EMAIL PROTECTED] >Subject: How config changes logged? [7:20968] > >Date: Tue, 25 Sep 2001 04:00:47 -0400 > >Hi everyone? > >Does anybody > know how to view the last time the config changed or how to >view which > commands added at what time to a router? I tried show log I only >see > misconduct and Nondisclosure violations to [EMAIL PROTECTED] > > > > Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=20975&t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
You are trying to solve a somewhat complex problem with a simplistic solution. It is not possible, IMHO. >From: "Cisco Breaker" >Reply-To: "Cisco Breaker" >To: [EMAIL PROTECTED] >Subject: Re: How config changes logged? [7:20968] >Date: Tue, 25 Sep 2001 06:58:11 -0400 > >My problem is to view this type of info without TACACS, with show commands. > >Best regards, > > >""Sean Young"" wrote in message >[EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > > aaa accounting exec default start-stop group tacacs+ > > aaa accounting commands 0 default start-stop group tacacs+ > > aaa accounting commands 1 default start-stop group tacacs+ > > aaa accounting commands 15 default start-stop group tacacs+ > > aaa accounting network default start-stop group tacacs+ > > aaa accounting connection default start-stop group tacacs+ > > aaa accounting system default start-stop group tacacs+ > > > > AAA accounting will solve this problem. However, you will have t setup a > > TACACS server and an accounting file. > > > > >From: "Cisco Breaker" >Reply-To: "Cisco Breaker" >To: > > [EMAIL PROTECTED] >Subject: How config changes logged? [7:20968] > > >Date: Tue, 25 Sep 2001 04:00:47 -0400 > >Hi everyone? > >Does anybody > > know how to view the last time the config changed or how to >view which > > commands added at what time to a router? I tried show log I only >see > > misconduct and Nondisclosure violations to [EMAIL PROTECTED] > > > > > > > > Get your FREE download of MSN Explorer at http://explorer.msn.com misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=20991&t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
It shoulf be in your logg if you enable logg buff: C7507MIX# C7507MIX# conf t Enter configuration commands, one per line. End with CNTL/Z. C7507MIX(config)#^Z C7507MIX#sh logg Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns) Console logging: level debugging, 111 messages logged Monitor logging: level debugging, 16 messages logged Buffer logging: level debugging, 112 messages logged Logging Exception size (65536 bytes) Trap logging: level informational, 79 message lines logged Log Buffer (65536 bytes): Sep 25 16:33:01: %SYS-5-CONFIG_I: Configured from console by vty0 (172.28.56.48) C7507MIX# C7507MIX# Dave Cisco Breaker wrote: > > Hi everyone? > > Does anybody know how to view the last time the config changed or how to > view which commands added at what time to a router? I tried show log I only > see updowns etc.. > > Best regards, -- David Madland Sr. Network Engineer CCIE# 2016 Qwest Communications Int. Inc. [EMAIL PROTECTED] 612-664-3367 "Emotion should reflect reason not guide it" Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=21020&t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
Thanks for the answers . Best regards, ""Cisco Breaker"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Hi everyone? > > Does anybody know how to view the last time the config changed or how to > view which commands added at what time to a router? I tried show log I only > see updowns etc.. > > Best regards, Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=21034&t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
If you have tacacs, you can also find out the last person who make the configuration changes. Here is the output: Current configuration : 5076 bytes ! ! Last configuration change at 22:05:18 EDT Sat Sep 22 2001 by learn_cisco ! NVRAM config last updated at 22:04:33 EDT Sat Sep 22 2001 ! version 12.1 no parser cache >From: "MADMAN" >Reply-To: "MADMAN" >To: [EMAIL PROTECTED] >Subject: Re: How config changes logged? [7:20968] >Date: Tue, 25 Sep 2001 12:52:40 -0400 > >It shoulf be in your logg if you enable logg buff: > >C7507MIX# >C7507MIX# conf t >Enter configuration commands, one per line. End with CNTL/Z. >C7507MIX(config)#^Z >C7507MIX#sh logg >Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 >flushes, > 0 overruns) > Console logging: level debugging, 111 messages logged > Monitor logging: level debugging, 16 messages logged > Buffer logging: level debugging, 112 messages logged > Logging Exception size (65536 bytes) > Trap logging: level informational, 79 message lines logged > >Log Buffer (65536 bytes): > >Sep 25 16:33:01: %SYS-5-CONFIG_I: Configured from console by vty0 >(172.28.56.48) >C7507MIX# >C7507MIX# > > Dave > >Cisco Breaker wrote: > > > > Hi everyone? > > > > Does anybody know how to view the last time the config changed or how to > > view which commands added at what time to a router? I tried show log I only > > see updowns etc.. > > > > Best regards, >-- >David Madland >Sr. Network Engineer >CCIE# 2016 >Qwest Communications Int. Inc. >[EMAIL PROTECTED] >612-664-3367 > misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=21038&t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: How config changes logged? [7:20968]
Jenny,
You are correct in that with TACACS, the username will be shown in the log.
Shahram
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
[EMAIL PROTECTED]
Sent: Wednesday, September 26, 2001 12:08 AM
To: [EMAIL PROTECTED]
Subject: How config changes logged? [7:20968]
Configuration changes are logged, but not what commands were changed. The
configuration change log messages are severity 5 (notification), so if your
logging only shows warnings and higher, you won't see the notifications.
Example of a notification...
.Sep 24 10:25:39 EST: %SYS-5-CONFIG_I: Configured from console by vty0
(1.2.99.2)
As you can see, it doesn't show what was changed or who changed it (beyond
an IP address - I think with tacacs implemented you will see the user), but
at least it shows the time.
JMcL
- Forwarded by Jenny Mcleod/NSO/CSDA on 26/09/2001 03:43 pm -
"Cisco
Breaker" To:
[EMAIL PROTECTED]
Subject: How config changes logged?
[7:20968]
Sent
by:
nobody@groupst
udy.com
25/09/2001
06:00
pm
Please
respond
to
"Cisco
Breaker"
Hi everyone?
Does anybody know how to view the last time the config changed or how to
view which commands added at what time to a router? I tried show log I only
see updowns etc..
Best regards,
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=21228&t=20968
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: How config changes logged? [7:20968]
If you create a local username and the configure the line or console port to
login local you router will log the user name as well
1w1d: %SYS-5-CONFIG_I: Configured from console by dwaynes on vty0
(192.168.x.x)
D'Wayne Saunders
-Original Message-
From: Shahram Esfahani [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 27, 2001 07:53
To: [EMAIL PROTECTED]
Subject: RE: How config changes logged? [7:20968]
Jenny,
You are correct in that with TACACS, the username will be shown in the log.
Shahram
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
[EMAIL PROTECTED]
Sent: Wednesday, September 26, 2001 12:08 AM
To: [EMAIL PROTECTED]
Subject: How config changes logged? [7:20968]
Configuration changes are logged, but not what commands were changed. The
configuration change log messages are severity 5 (notification), so if your
logging only shows warnings and higher, you won't see the notifications.
Example of a notification...
.Sep 24 10:25:39 EST: %SYS-5-CONFIG_I: Configured from console by vty0
(1.2.99.2)
As you can see, it doesn't show what was changed or who changed it (beyond
an IP address - I think with tacacs implemented you will see the user), but
at least it shows the time.
JMcL
- Forwarded by Jenny Mcleod/NSO/CSDA on 26/09/2001 03:43 pm -
"Cisco
Breaker" To:
[EMAIL PROTECTED]
Subject: How config changes logged?
[7:20968]
Sent
by:
nobody@groupst
udy.com
25/09/2001
06:00
pm
Please
respond
to
"Cisco
Breaker"
Hi everyone?
Does anybody know how to view the last time the config changed or how to
view which commands added at what time to a router? I tried show log I only
see updowns etc..
Best regards,
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=21231&t=20968
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
