4

Is there a way to find out what user performed the last configuration on an interface?

I know show users list the current active users on a Cisco switch/router, but I am wondering if there is a command I can use to see who previous performed a config, or filter the logs to see who made a config change.

  • 2
    You can set up a TACACS server to log (and control) every command on a Cisco device. – Ron Trunk Jun 5 at 1:16
7

Adding one more detail to infra's answer. This configuration will log commands to your local router's syslog buffer when config commands are run:

logging buffered 500000
archive
 log config
  record rc
  logging enable
  logging size 1000
  notify syslog contenttype plaintext
  hidekeys

Now, as long as the local syslog buffer is large enough (which is why I added the line with roughly half a megabyte of logging buffer), you will see all commands run as well as the time they were run.

6

You can perform it in Three ways.

  1. TACACS+ Server
  2. SNMP Server(using SNMP trap, can be sent to external SNMP server)
  3. Syslog Server.

Additionally Basic level login details are able store in switch. But that feature is not available in some old version switches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.