{"id":160,"date":"2009-07-08T11:58:25","date_gmt":"2009-07-08T10:58:25","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=160"},"modified":"2009-07-08T11:58:25","modified_gmt":"2009-07-08T10:58:25","slug":"configuration-change-tracking","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=160","title":{"rendered":"Configuration change tracking"},"content":{"rendered":"<p>This has been available since IOS 12.3(4)T\/12.2(25)S. For each configuration command that is executed, the following information will be logged:<\/p>\n<p>\u2022 The command that was executed<br \/>\n\u2022 The configuration mode in which the command was executed<br \/>\n\u2022 The name of the user that executed the command<br \/>\n\u2022 The time at which the command was executed<br \/>\n\u2022 A configuration change sequence number<br \/>\n\u2022 Parser return codes for the command<\/p>\n<p>You can have this information stored in a local buffer or sent to a syslog server.\u00a0 Here&#8217;s a basic configuration that will get you going:<\/p>\n<p><!--more--><\/p>\n<p>Router(config)#\u00a0<strong>archive<\/strong><br \/>\nRouter(config-archive)#\u00a0<strong>log config<\/strong> (enters config logging mode)<br \/>\nRouter(config-archive-log-config)#\u00a0<strong>logging enable<\/strong> (turns on running config change logging)<br \/>\nRouter(config-archive-log-config)#\u00a0<strong>logging size 500<\/strong> (remembers the last 500 commands entered &#8211; 100 are default)<br \/>\nRouter(config-archive-log-config)#\u00a0<strong>hidekeys<\/strong> (hides passwords from being shown \/ logged)<br \/>\nRouter(config-archive-log-config)#\u00a0<strong>notify syslog<\/strong> (optional &#8211; exports changes to syslog server)<\/p>\n<p>Watch this: this is an example of what the logging looks like in action:<\/p>\n<pre>CH_NAME_RTR# <strong>show archive log config all<\/strong><\/pre>\n<pre> idx\u00a0\u00a0 sess\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 user@line\u00a0\u00a0\u00a0\u00a0\u00a0 Logged command<\/pre>\n<pre>\u00a0\u00a0\u00a0 1\u00a0\u00a0\u00a0\u00a0 1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 darenmatthews@vty0\u00a0\u00a0\u00a0\u00a0 |\u00a0 logging enable<\/pre>\n<pre>\u00a0\u00a0\u00a0\u00a02\u00a0\u00a0\u00a0\u00a0 1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 darenmatthews@vty0\u00a0\u00a0\u00a0\u00a0 |\u00a0 logging size 200<\/pre>\n<pre>\u00a0\u00a0 \u00a03\u00a0\u00a0\u00a0\u00a0 2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 darenmatthews@vty0\u00a0\u00a0\u00a0\u00a0 |hostname CH_NAME_RTR<\/pre>\n<pre>\u00a0\u00a0\u00a0 4\u00a0\u00a0\u00a0\u00a0 2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 darenmatthews@vty0\u00a0\u00a0\u00a0\u00a0 |enable secret *****\u00a0 (this is hidden because of <strong>hidekeys<\/strong> command)<\/pre>\n<pre>\u00a0\u00a0\u00a0 5\u00a0\u00a0\u00a0\u00a0 2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 darenmatthews@vty0\u00a0\u00a0\u00a0\u00a0 |interface FastEthernet0\/0<\/pre>\n<pre>\u00a0\u00a0\u00a0\u00a06\u00a0\u00a0\u00a0\u00a0 2\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0darenmatthews@vty0\u00a0\u00a0\u00a0\u00a0 | bandwidth 100000<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>This has been available since IOS 12.3(4)T\/12.2(25)S. For each configuration command that is executed, the following information will be logged: \u2022 The command that was executed \u2022 The configuration mode in which the command was executed \u2022 The name of the user that executed the command \u2022 The time at which the command was executed [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[83],"tags":[3],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/160"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=160"}],"version-history":[{"count":1,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/160\/revisions"}],"predecessor-version":[{"id":161,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/160\/revisions\/161"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=160"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}