Is there a way to monitor a user's input on a cisco device?
Clarification: the commands a user have entered as in configuration mode AND normal mode. (especialy normal mode. Configuration mode can be done with "show history").
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Have a look at this IOSHints post: CLI command logging without TACACS+. And the title seems to imply it can also be done with TACACS+.
Since your question is not restricted to IOS: on Cisco ASA devices you can see executed commands in the syslog. They look this way:
May 17 11:45:12 192.168.0.1 %ASA-5-514008: User 'stefan' executed the 'write memory' command.
So you could filter for such messages, for example using
grep and a cron job. Of course you need to have the required severity level set, here 5 for notification.
I used splunk for directly receiving and storing firewall syslog messages, programmed a daily running alert which sends me all ASA syslog lines containing "executed" as a summary email. I did this because I already had splunk in place for monitoring and reporting.
TACACS+ is the preferred method to log CLI commands at any enable level. See the AAA and TACACS commands for configuration. There's open source software if you don't have or can't afford Cisco ACS or similar products.
But for a really cool and rarely used feature, you could have the switch itself run a config diff(erence) on the running-config and startup-config and email the changes or deltas to you!
Here's how I have 4510R switches configured to email config changes. This uses the event manager to do the work.
First, some common settings for the mail server, from, and to addresses.
event manager environment _email_server a.b.c.d. event manager environment _email_from email@example.com event manager environment _email_to firstname.lastname@example.org
Then, the actual applet to do the diff. This is fairly self-explanatory.
event manager applet config_diff_email authorization bypass event syslog pattern ".*%SYS-5-CONFIG.*" action 1.0 info type routername action 1.1 cli command "enable" action 1.2 cli command "show archive config diff nvram:/startup-config system:/running-config" action 1.3 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Config Change Alert ($_info_routername)" body "$_cli_result" action 1.4 syslog msg "Config Change Alert emailed"
Note that even going into config and not making changes still triggers the diff email. And one downside with this is CPU spike that happens for about 10 seconds while it runs.