Logging all commands run on a router or switch

[jristo]

We have a requirement to have authentication on a device (which can be handled by the ACS) but we also require that any commands entered on a device be logged somehow.

How would one go about doing this?

[gjackson]

AAA command accounting should work for this. You would log at level 1 to capture all the commands. For more info, see:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7aa.html

Hope this Helps

[dpncisco]

Or even level 0, if you want downgraded all vty lines to level 0

"line vty 0 15"

"privilege level 0"

This helps to prohibit show commands on level 1.

To see a list of all commands use

"terminal full-help". You will see how really powerfull level 1 is.