12-19-2016 05:04 PM - edited 03-05-2019 07:42 AM
Dear All,
I have a question. Kindly help me on this.
if someone had logged in to gateway (E1) and made changes in gateway, how to identify the person
12-19-2016 10:21 PM
Hi,
Depending on the router model you can enable Router Security audit logs as explained in one of the links below
http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_rout_audit_logs_support_TSD_Island_of_Content_Chapter.html
Manish
- Do rate helpful posts -
12-19-2016 10:47 PM
Hi,
Best and reliable solution is that you check Syslog of your router. Here, you can check that which user logged in and make a change or not?
Regards,
Deepak Kumar
12-19-2016 11:43 PM
Hello,
in addition to the other responses, if you are lucky and the person that made the change was the LAST person to make any changes, check for the lines below in 'show version':
! Last configuration change at 11:12:45 CEST Tue Sep 13 2016 by CGOY
! NVRAM config last updated at 11:12:45 CEST Tue Sep 13 2016 by CGOY
12-20-2016 01:00 AM
You can also setup configuration change notification on the device to allow to see who mades changes and when , its available in ios and ios-xe
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/xe-3s/config-mgmt-xe-3s-book/cm-config-logger.html
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide