Is there a way to find out what user performed the last configuration on an interface?

I know show users list the current active users on a Cisco switch/router, but I am wondering if there is a command I can use to see who previous performed a config, or filter the logs to see who made a config change.

  • 2
    You can set up a TACACS server to log (and control) every command on a Cisco device.
    – Ron Trunk
    Jun 5, 2019 at 1:16
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 20:28

2 Answers 2


Adding one more detail to infra's answer. This configuration will log commands to your local router's syslog buffer when config commands are run:

logging buffered 500000
 log config
  record rc
  logging enable
  logging size 1000
  notify syslog contenttype plaintext

Now, as long as the local syslog buffer is large enough (which is why I added the line with roughly half a megabyte of logging buffer), you will see all commands run as well as the time they were run.


You can perform it in Three ways.

  1. TACACS+ Server
  2. SNMP Server(using SNMP trap, can be sent to external SNMP server)
  3. Syslog Server.

Additionally Basic level login details are able store in switch. But that feature is not available in some old version switches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.