Is there a way to monitor a user's input on a cisco device?

Clarification: the commands a user have entered as in configuration mode AND normal mode. (especialy normal mode. Configuration mode can be done with "show history").

5 Answers 5


Have a look at this IOSHints post: CLI command logging without TACACS+. And the title seems to imply it can also be done with TACACS+.

  • 2
    TACACS+ is indeed the way the go, but sometimes you don't have a choice. That link you provided to put up the logging through an eventmanager did the trick. Thx :)
    – Bulki
    May 17, 2013 at 13:58

Assuming you are using TACACS+ you can configure:

tacacs-server host x.x.x.x key xxxxx

aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

Also include a line for any other enable levels that you may use.

  • 2
    TACACS+ also has the added benefit of incorporating authentication so you can actually correlate the logged commands to individual user accounts. You will also have persistence the logs since commands are not cleared at the end of each user session.
    – henklu
    May 17, 2013 at 15:16

Since your question is not restricted to IOS: on Cisco ASA devices you can see executed commands in the syslog. They look this way:

May 17 11:45:12 %ASA-5-514008: User 'stefan' executed the 'write memory' command.

So you could filter for such messages, for example using grep and a cron job. Of course you need to have the required severity level set, here 5 for notification.

I used splunk for directly receiving and storing firewall syslog messages, programmed a daily running alert which sends me all ASA syslog lines containing "executed" as a summary email. I did this because I already had splunk in place for monitoring and reporting.


TACACS+ is the preferred method to log CLI commands at any enable level. See the AAA and TACACS commands for configuration. There's open source software if you don't have or can't afford Cisco ACS or similar products.

But for a really cool and rarely used feature, you could have the switch itself run a config diff(erence) on the running-config and startup-config and email the changes or deltas to you!

Here's how I have 4510R switches configured to email config changes. This uses the event manager to do the work.

First, some common settings for the mail server, from, and to addresses.

    event manager environment _email_server a.b.c.d.
    event manager environment _email_from [email protected]
    event manager environment _email_to [email protected]

Then, the actual applet to do the diff. This is fairly self-explanatory.

    event manager applet config_diff_email authorization bypass
    event syslog pattern ".*%SYS-5-CONFIG.*"
    action 1.0 info type routername
    action 1.1 cli command "enable"
    action 1.2 cli command "show archive config diff nvram:/startup-config system:/running-config"
    action 1.3 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Config Change Alert ($_info_routername)" body "$_cli_result"
    action 1.4 syslog msg "Config Change Alert emailed" 

Note that even going into config and not making changes still triggers the diff email. And one downside with this is CPU spike that happens for about 10 seconds while it runs.


I use the following configuration and it logs config commands, as well as a few others like 'enable':

 log config
  logging enable
  notify syslog
  • Does this log non-configuration commands? That's what the OP seems most interested in. May 17, 2013 at 16:48
  • 1
    It doesn't log most non-configuration commands (exec-mode commands) so 'show [...]' won't be logged. But it does log some of them. May 17, 2013 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.