Is there a way to find out what user performed the last configuration on an interface?

Question

Is there a way to find out what user performed the last configuration on an interface?

I know show users list the current active users on a Cisco switch/router, but I am wondering if there is a command I can use to see who previous performed a config, or filter the logs to see who made a config change.

Answer 1

Adding one more detail to infra's answer. This configuration will log commands to your local router's syslog buffer when config commands are run:

logging buffered 500000
archive
 log config
  record rc
  logging enable
  logging size 1000
  notify syslog contenttype plaintext
  hidekeys

Now, as long as the local syslog buffer is large enough (which is why I added the line with roughly half a megabyte of logging buffer), you will see all commands run as well as the time they were run.

Answer 2

You can perform it in Three ways.

1. TACACS+ Server
2. SNMP Server(using SNMP trap, can be sent to external SNMP server)
3. Syslog Server.

Additionally Basic level login details are able store in switch. But that feature is not available in some old version switches.