How to show date/time in 'show archive log' ???

[voip7372]

We have a 9407 switch (CAT9K_IOSXE), Version 17.6.5) at one of our offices and due to some issues we've been having there, I wanted to get more detailed logs to see what changes are being made in the switch (and by who/what). We have a Forescout implementation and that device will log in to the switch and change the VLAN assigned to the port based on various details related to the machine that connects to the port. So, I'm wanting to find out the date/time when Forescout is making changes (I can see when Forescout logs in because the login name is unique for Forescout - it's not the same one we as admins use).  Anyway, I added the config below to the switch and that works great for showing me the exact commands that are being executed, but unfortunately, it doesn't log the date/time when the changes happened. Is there any way to enable the date/time info to be logged as well?

Here's existing config:
config t
archive
log config
logging enable
logging size 1000
hidekeys

And I view the info in those logs with this command:
show archive log config all

Here's an example of some changes I see, but as you can see, there's no date/time listed for the changes:
24219 0 forescout@vty0 |interface GigabitEthernet1/0/8
24220 0 forescout@vty0 | switchport access vlan 20
24221 0 forescout@vty0 | exit
24222 0 forescout@vty0 |interface GigabitEthernet1/0/8
24223 0 forescout@vty0 | shutdown
24224 0 forescout@vty0 | exit
24225 0 forescout@vty0 |interface GigabitEthernet1/0/8
24226 0 forescout@vty0 | switchport access vlan 20
24227 0 forescout@vty0 | exit
24228 0 forescout@vty0 |interface GigabitEthernet1/0/8
24229 0 forescout@vty0 | no shutdown
24230 0 forescout@vty0 | exit
24231 0 forescout@vty0 |interface GigabitEthernet1/0/8
24232 0 forescout@vty0 | shutdown
24233 0 forescout@vty0 | exit
24234 0 forescout@vty0 |interface GigabitEthernet1/0/8
24235 0 forescout@vty0 | no shutdown
24236 0 forescout@vty0 | exit

[Flavio Miranda]

@voip7372 

You can use this commands

• service sequence-numbers

• service timestamps log datetime

• service timestamps log datetime [localtime] [msec] [show-timezone]

• service timestamps log uptime

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-1/configuration_guide/sys_mgmt/b_171_sys_mgmt_9300_cg/configuring_system_message_logs.html

[voip7372]

Are you saying that if I use those commands, I can then see the date/time of the changes when I do 'show archive log config all'?

Or would that only apply to the 'show logging'?

Ideally, I'd like to avoid using the 'show archive log'.  If possible, I'd love to see those details in the normal 'show logging' view. Currently, we can only see when ports go up and down, when an account logs in and basic things like that...and when the account makes a change, it only shows up sort of like 'SYS-5-CONFIG_I: Configured from console by forescout on vty0 (x.x.x.x)'  We get no details on the actual command that was entered. If there was a way to show the actual commands that were entered in the 'show logging' view, that's really all I need.

Example of what we see now in the show logging::
Sep 30 22:41:24.456: %SYS-5-CONFIG_I: Configured from console by forescout on vty0 (x.x.x.x)
Sep 30 22:41:25.325: %SYS-5-CONFIG_I: Configured from console by forescout on vty0 (x.x.x.x)
Sep 30 22:41:27.107: %LINK-5-CHANGED: Interface GigabitEthernet1/0/8, changed state to administratively down
Sep 30 22:41:28.107: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/8, changed state to down
Sep 30 22:41:30.927: %SYS-5-CONFIG_I: Configured from console by forescout on vty0 (x.x.x.x)
Sep 30 22:41:32.717: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/8, changed state to down
Sep 30 22:41:36.852: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/8, changed state to up
Sep 30 22:41:37.852: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/8, changed state to up

[Flavio Miranda]

I believe in the show logging command but need to run the command and check

[David Ruess]

Hello,

I don't see an option to even display timestamps, let alone set them in the archive configuration. Another option would be to send logs/AAA commands to a log server. So, whenever Forescout made a change the AAA logging would send that info to a central server. Not really what you need and is more involved, but the archive config set looks very limited.

-David

[voip7372]

We do have the logs sent to a server to store these (I think it's in our SolarWinds product), but I personally haven't gone looking for those in SolarWinds but I suspect it'll just show the generic info that's in the 'show logging' view. Maybe it does show more, but I'd have to find out from others on my team. My idea was just to make it so I could quicky check the switch to see what's going on if I had all the details I needed there, rather than going somewhere else to look for it. It's just quicker/easier to find it on the switch if it's not a big project and just a simple issue of me wanting to see what's been changed very recently in the switch and only need to look at the switch to find what I need. If possible.

[David Ruess]

I agree it would be easier to just check it all in one place but I didnt see any other config related to the archive command when configuring it. I saw a forum entry from 2020 and it was asking/complaining about the same thing so I dont believe that feature has been implemented. 

As far as the generic info from logging I believe you are correct. I was alluding to more AAA logging. If I understand it the Accounting is the commands entered by an account if AAA is configured. You may be able to parse those logs/debugs either on the device or where AAA logging is sent, again if configured.

-David

[alancelliott · Accepted solution]

If you don't have a need to use "show archive log config all" you can enable the sending of the archive logs to syslog, here's an example:

archive
log config
logging enable
logging size 250
notify syslog

Then in your log:

#show logging | inc PARSER
*Oct 2 14:54:41.075: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:notify syslog
*Oct 2 14:54:47.319: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:notify syslog contenttype plaintext
*Oct 2 14:54:56.312: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:no notify syslog contenttype plaintext
*Oct 2 14:54:58.355: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:notify syslog
*Oct 2 14:55:07.569: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:logging buffered debugging
*Oct 2 2024 14:55:33.826 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:service timestamps log datetime year localtime msec show-timezone
*Oct 2 2024 15:05:55.956 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:interface GigabitEthernet1/0/2
*Oct 2 2024 15:05:57.798 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:switchport host
*Oct 2 2024 15:06:00.654 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:switchport access vlan 10
*Oct 2 2024 15:06:05.042 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:switchport access vlan 20

Hope that helps.

[voip7372]

That looks like what I need. I'll give it a try.  Thanks

[voip7372]

OK, this worked and gets me the basics of what I want to see, but adding that command 'notify syslog' seems to have reset something with regarding to showing the date and time in the 'show logging' command. Here's an example of what it's showing now. How can I correct that? Notice how it shows '1y9w' instead of a date and time.  Before that change, the 'show logging' view would start each line with the date and time, for example: Oct 2 13:50:24.019:

Also, this won't interfere with anything we already had configured to send logs to our SolarWinds servers, will it? Just want to make sure I don't break that. 

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1 logged command:interface GigabitEthernet1/0/40
1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1 logged command:shutdown
1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1 logged command:no shutdown

[voip7372 · Accepted solution]

Ah, I figured it out. Not sure why, but I had to add this back to the switch to get the date/time to appear in the show logging command:  service timestamps log datetime msec

Here's my complete config related to this topic and my notes (written for my understanding). Hopefully it's useful to others. Thanks for your help!

Config:	Notes:
config t
archive	Enter the archive config
log config	Configure the logging section of Archive
notify syslog	This will put the logs of changes being made into the 'show logging' section
logging enable	Enable the archive to save config changes
logging size 1000	Log no more than 1,000 config changes (default is only 100)
hidekeys	Hide any passwords that were typed into any commands
service timestamps log datetime msec	Add this again to be sure the date/time info will appear in the 'show logging' command.
show logging | inc PARSER	Show just the logs related to commands being entered
show archive log config all	Show the contents of the archive related to any logging that was saved (config changes)
clear archive log config	Use this command to delete/clear all the log messages in the 'archive log'

And here's an example output after I made a few test changes to see how the logs look:

9407core#show logg

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:shutdown

1y9w: %LINK-5-CHANGED: Interface GigabitEthernet1/0/40, changed state to administratively down

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:no shutdown

1y9w: %SYS-5-CONFIG_I: Configured from console by admin1 on vty1 (x.x.x.x)

1y9w: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/40, changed state to down

Oct  2 16:35:13.808: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:service timestamps log datetime msec

Oct  2 16:35:16.161: %SYS-5-CONFIG_I: Configured from console by admin1 on vty1 (x.x.x.x)

Oct  2 16:35:23.917: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:interface GigabitEthernet1/0/40

Oct  2 16:35:26.308: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:shutdown

Oct  2 16:35:28.307: %LINK-5-CHANGED: Interface GigabitEthernet1/0/40, changed state to administratively down

Oct  2 16:35:28.887: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:no shutdown

Oct  2 16:35:30.093: %SYS-5-CONFIG_I: Configured from console by admin1 on vty1 (x.x.x.x)

Oct  2 16:35:30.886: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/40, changed state to down

9407core#show logging | inc PARSER

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:notify syslog

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:interface GigabitEthernet1/0/29

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:description 2-5 - Test

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:no description

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:description 2-5

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:interface GigabitEthernet1/0/40

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:shutdown

1y9w: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:no shutdown

Oct  2 16:35:13.808: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:service timestamps log datetime msec

Oct  2 16:35:23.917: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:interface GigabitEthernet1/0/40

Oct  2 16:35:26.308: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:shutdown

Oct  2 16:35:28.887: %PARSER-5-CFGLOG_LOGGEDCMD: User:admin1  logged command:no shutdown

9407core#show archive log config all

idx   sess           user@line      Logged command

1     0      admin1@vty1     |!exec: enable

2     0      admin1@vty1     |!exec: enable

3     0      admin1@vty1     |!exec: enable

4     0      admin1@vty1     |!exec: enable

5     0      admin1@vty1     |service timestamps log uptime

6     0      admin1@vty1     |!exec: enable

7     0      admin1@vty1     |archive

8     0      admin1@vty1     | log config

9     0      admin1@vty1     |  notify syslog

10     0      admin1@vty1     |interface GigabitEthernet1/0/29

11     0      admin1@vty1     | description 2-5 - Test

12     0      admin1@vty1     | no description

13     0      admin1@vty1     | description 2-5

14     0      admin1@vty1     |interface GigabitEthernet1/0/40

15     0      admin1@vty1     | shutdown

16     0      admin1@vty1     | no shutdown

17     0      admin1@vty1     |service timestamps log datetime msec

18     0      admin1@vty1     |interface GigabitEthernet1/0/40

19     0      admin1@vty1     | shutdown

20     0      admin1@vty1     | no shutdown

9407core#