RE: How config changes logged? [7:20968]
Jenny, You are correct in that with TACACS, the username will be shown in the log. Shahram -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, September 26, 2001 12:08 AM To: [EMAIL PROTECTED] Subject: How config changes logged? [7:20968] Configuration changes are logged, but not what commands were changed. The configuration change log messages are severity 5 (notification), so if your logging only shows warnings and higher, you won't see the notifications. Example of a notification... .Sep 24 10:25:39 EST: %SYS-5-CONFIG_I: Configured from console by vty0 (1.2.99.2) As you can see, it doesn't show what was changed or who changed it (beyond an IP address - I think with tacacs implemented you will see the user), but at least it shows the time. JMcL - Forwarded by Jenny Mcleod/NSO/CSDA on 26/09/2001 03:43 pm - Cisco Breaker To: [EMAIL PROTECTED] Subject: How config changes logged? [7:20968] Sent by: nobody@groupst udy.com 25/09/2001 06:00 pm Please respond to Cisco Breaker Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see updowns etc.. Best regards, Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=21228t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: How config changes logged? [7:20968]
If you create a local username and the configure the line or console port to login local you router will log the user name as well 1w1d: %SYS-5-CONFIG_I: Configured from console by dwaynes on vty0 (192.168.x.x) D'Wayne Saunders -Original Message- From: Shahram Esfahani [mailto:[EMAIL PROTECTED]] Sent: Thursday, September 27, 2001 07:53 To: [EMAIL PROTECTED] Subject: RE: How config changes logged? [7:20968] Jenny, You are correct in that with TACACS, the username will be shown in the log. Shahram -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, September 26, 2001 12:08 AM To: [EMAIL PROTECTED] Subject: How config changes logged? [7:20968] Configuration changes are logged, but not what commands were changed. The configuration change log messages are severity 5 (notification), so if your logging only shows warnings and higher, you won't see the notifications. Example of a notification... .Sep 24 10:25:39 EST: %SYS-5-CONFIG_I: Configured from console by vty0 (1.2.99.2) As you can see, it doesn't show what was changed or who changed it (beyond an IP address - I think with tacacs implemented you will see the user), but at least it shows the time. JMcL - Forwarded by Jenny Mcleod/NSO/CSDA on 26/09/2001 03:43 pm - Cisco Breaker To: [EMAIL PROTECTED] Subject: How config changes logged? [7:20968] Sent by: nobody@groupst udy.com 25/09/2001 06:00 pm Please respond to Cisco Breaker Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see updowns etc.. Best regards, Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=21231t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+ aaa accounting connection default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ AAA accounting will solve this problem. However, you will have t setup a TACACS server and an accounting file. From: Cisco Breaker Reply-To: Cisco Breaker To: [EMAIL PROTECTED] Subject: How config changes logged? [7:20968] Date: Tue, 25 Sep 2001 04:00:47 -0400 Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=20973t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
My problem is to view this type of info without TACACS, with show commands. Best regards, Sean Young wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+ aaa accounting connection default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ AAA accounting will solve this problem. However, you will have t setup a TACACS server and an accounting file. From: Cisco Breaker Reply-To: Cisco Breaker To: [EMAIL PROTECTED] Subject: How config changes logged? [7:20968] Date: Tue, 25 Sep 2001 04:00:47 -0400 Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=20975t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
You are trying to solve a somewhat complex problem with a simplistic solution. It is not possible, IMHO. From: Cisco Breaker Reply-To: Cisco Breaker To: [EMAIL PROTECTED] Subject: Re: How config changes logged? [7:20968] Date: Tue, 25 Sep 2001 06:58:11 -0400 My problem is to view this type of info without TACACS, with show commands. Best regards, Sean Young wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+ aaa accounting connection default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ AAA accounting will solve this problem. However, you will have t setup a TACACS server and an accounting file. From: Cisco Breaker Reply-To: Cisco Breaker To: [EMAIL PROTECTED] Subject: How config changes logged? [7:20968] Date: Tue, 25 Sep 2001 04:00:47 -0400 Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=20991t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
It shoulf be in your logg if you enable logg buff: C7507MIX# C7507MIX# conf t Enter configuration commands, one per line. End with CNTL/Z. C7507MIX(config)#^Z C7507MIX#sh logg Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns) Console logging: level debugging, 111 messages logged Monitor logging: level debugging, 16 messages logged Buffer logging: level debugging, 112 messages logged Logging Exception size (65536 bytes) Trap logging: level informational, 79 message lines logged Log Buffer (65536 bytes): Sep 25 16:33:01: %SYS-5-CONFIG_I: Configured from console by vty0 (172.28.56.48) C7507MIX# C7507MIX# Dave Cisco Breaker wrote: Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see updowns etc.. Best regards, -- David Madland Sr. Network Engineer CCIE# 2016 Qwest Communications Int. Inc. [EMAIL PROTECTED] 612-664-3367 Emotion should reflect reason not guide it Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=21020t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
Thanks for the answers . Best regards, Cisco Breaker wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see updowns etc.. Best regards, Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=21034t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: How config changes logged? [7:20968]
If you have tacacs, you can also find out the last person who make the configuration changes. Here is the output: Current configuration : 5076 bytes ! ! Last configuration change at 22:05:18 EDT Sat Sep 22 2001 by learn_cisco ! NVRAM config last updated at 22:04:33 EDT Sat Sep 22 2001 ! version 12.1 no parser cache From: MADMAN Reply-To: MADMAN To: [EMAIL PROTECTED] Subject: Re: How config changes logged? [7:20968] Date: Tue, 25 Sep 2001 12:52:40 -0400 It shoulf be in your logg if you enable logg buff: C7507MIX# C7507MIX# conf t Enter configuration commands, one per line. End with CNTL/Z. C7507MIX(config)#^Z C7507MIX#sh logg Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns) Console logging: level debugging, 111 messages logged Monitor logging: level debugging, 16 messages logged Buffer logging: level debugging, 112 messages logged Logging Exception size (65536 bytes) Trap logging: level informational, 79 message lines logged Log Buffer (65536 bytes): Sep 25 16:33:01: %SYS-5-CONFIG_I: Configured from console by vty0 (172.28.56.48) C7507MIX# C7507MIX# Dave Cisco Breaker wrote: Hi everyone? Does anybody know how to view the last time the config changed or how to view which commands added at what time to a router? I tried show log I only see updowns etc.. Best regards, -- David Madland Sr. Network Engineer CCIE# 2016 Qwest Communications Int. Inc. [EMAIL PROTECTED] 612-664-3367 misconduct and Nondisclosure violations to [EMAIL PROTECTED] Get your FREE download of MSN Explorer at http://explorer.msn.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=21038t=20968 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
