topic Logging Commands to Syslog in Network Access Control

Logging Commands to Syslog

Pete89 — Sun, 10 Mar 2019 23:58:27 GMT

Hello,

We use RANCID to monitor changes to all our Cisco gear. Once an hour RANCID does a diff on the last running-config. If it detects a change, it notifies me of the changes on the router/switch. This works great, but it does not record WHO made the changes.

So I am looking for a way to log to syslog any commands issued by a particular user. This can be done correct?

Thanks,

Pedro

Re: Logging Commands to Syslog

Panos Kampanakis — Wed, 24 Feb 2010 18:58:21 GMT

You can use AAA accounting for it.

I hope it helps.

Re: Logging Commands to Syslog

Pete89 — Wed, 24 Feb 2010 19:00:26 GMT

What I am not sure of is if you can do aaa acounting to syslog and if you can do it on a per user basis.

Re: Logging Commands to Syslog

Panos Kampanakis — Wed, 24 Feb 2010 19:15:56 GMT

I doubt you can do accounting to syslog (send commands).

Re: Logging Commands to Syslog

cciesec2011 — Thu, 25 Feb 2010 23:41:22 GMT

If you are using IOS 12.4 or higher, you can use the following commands:

archive
log config
hidekeys

It will send whatever changes and whoever changes the configs to syslog.

I myself prefer AAA accounting but the above method will work just as well.

Re: Logging Commands to Syslog

Pete89 — Mon, 01 Mar 2010 14:18:16 GMT

Thanks for answering my post!

IOS 12.4 or higher? Is that a typo? Isnt 12.2 the latest? I tried these commands on one of my switches and I still dont see anything in syslog.