Failed Configuration Terminal Command and Router's Buffer Log Reporting

[gerardwest]

Certain users aren't allowed to issue the 'conf t' command on routers. When they attempt to do so they get the message 'command authorization failed.' However, in the router's buffer log the following is stated:

%SYS-5-CONFIG_I: Configured from console by <user> on vty0 <user's ip addr>

If the 'conf t' command failed authorization why would the router report the system was configured?

[Richard Burts]

I am not positive about this but I have an idea that the explanation involves the fact that the buffer log message is generated when someone exits from config mode. I believe that what is happening is that when the person enters the conf t command the router enters config mode, but before the prompt is presented to the person the router checks for authorization. If the authorization is negative then the router generates the error message 'command authorization failed.' and exits config mode which generates the log message that you are seeing.

HTH

Rick

[gerardwest]

Rick,

Your explanation makes sense. Unfortunately it is misleading when one reads the router's buffer log, without doing further investigation. Thanks.