Send command lines to syslog server

Question

I already can send each Linux command line to my syslog server. Now, I'd like to send each command line inserted onto my Cisco router to syslog server.

Is it possible? If yes, how?

Answer 1

You can send configuration commands to the syslog server with the notify syslog command (Cisco IOS Configuration Fundamentals Command Reference):

archive         ! archive configuration mode
log config      ! change logger configuration mode
logging enable  ! log configuration changes
notify syslog   ! send change notifications to syslog server

Examples

The following example shows how to enable the device to send notifications (in XML format) to the syslog:

Device# configure terminal
!
Device(config)# archive
Device(config-archive)# log config
Device(config-archive-log-config)# notify syslog contenttype xml
Device(config-archive-log-config)# end

You will need to use TACACS to get all commands entered.

Restrictions for Configuration Change Notification and Logging

• Only complete commands input in a configuration mode are logged.
• Commands that are part of a configuration file applied with the copy command are not logged.

Configuration Log

The Configuration Change Notification and Logging feature tracks changes made to the Cisco software running configuration by maintaining a configuration log. This configuration log tracks changes initiated only through the CLI or HTTP. Only complete commands that result in the invocation of action routines are logged. The following types of entries are not logged:

• Commands that result in a syntax error message
• Partial commands that invoke the device help system

For each configuration command that is executed, the following information is logged:

• The command that was executed
• The configuration mode in which the command was executed
• The name of the user that executed the command
• The time at which the command was executed
• A configuration change sequence number
• Parser return codes for the command