topic Re: Configuration last modified in Network Security

Configuration last modified

1salvarez — Mon, 11 Mar 2019 19:34:53 GMT

Does the ASA keep a log of changes or the users that made them? See the attachment. I'm hoping there's a command that'll show atleast a list of when changes were made.

Re: Configuration last modified

Jennifer Halim — Thu, 13 Jan 2011 22:20:37 GMT

The output of "show version" has a line that shows you when last configuration changes were made. The same as your attached screenshot.

Or, you can also have a syslog to log whenever a user entered any command into the ASA. It's syslog# 111008:

http://www.cisco.com/en/US/docs/security/asa/asa82/system/message/logmsgs.html#wp4769400

If you would like to see the changes or the command that you entered within the same telnet/ssh session, you can issue "show history", and it will list down all the commands that you entered during that session. The history will be lost if you log out of the session. More information on the command reference:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s3.html#wp1463076

Hope that answers your question.

Re: Configuration last modified

1salvarez — Thu, 13 Jan 2011 22:57:34 GMT

We already have a syslog server set up. How do I add 111008.

logging enable
logging timestamp
logging console notifications
logging monitor notifications
logging buffered informational
logging trap informational
logging history warnings
logging asdm informational
logging facility 18
logging host inside 192.X.X.X
logging class auth console emergencies history warnings monitor emergencies trap emergencies

I was hoping the following was the way to go:

ASDM Configuration

This procedure shows an ASDM configuration for Example 2 with the use of the message list.

Choose Event Lists under Logging and click Add in order to create a message list.
Enter the name of the message list in the Name box. In this case my_critical_messages is used. Click Add under Event Class/Severity Filters.
Choose the Event Class and Severity from the drop-down menus.
In this case, choose All and Critical respectively. Click OK when you are done.
Click Add under the Message ID Filters if additional messages are required.
In this case, you need to put in messages with ID 611101-611323.
Put in the ID range in the Message IDs box and click OK.
Go back to the Logging Filters menu and choose Console as the destination.
Click Use event list and choose my_critical_messages from the drop- down menu. Click OK when you are done.
Click Apply after you return to the Logging Filters window.
This completes the ASDM configurations using message list as shown in Example 2.

Re: Configuration last modified

Jennifer Halim — Thu, 13 Jan 2011 23:02:47 GMT

From the configuration of your syslog settings, you should already have syslog 111008 as it is syslog message level 5 (notification).

Re: Configuration last modified

saquib.tandel — Fri, 14 Jan 2011 07:32:56 GMT

Hello

This is just for information.

We got NCM from solarwinds ( Network Configuration Manager ) ; which takes automatic Backup and sends Email Alert when ever there is configuration changes. We deployed this long time back as we didnt manage to get this working using ASDM

If you need more information on NCM check www.solarwinds.com

thanks