Tracking user creation events on a switch

[Vic48]

Can EEM be used to track user creation on a switch?

[Mark Malone]

Hi
What do you mean by user creation ? you can track what users have ran and what commands they have invoked through archive commands
you could also do it through EEM but archive is easier

https://itknowledgeexchange.techtarget.com/cisco/tracking-configuration-changes-with-the-cisco-ios-built-in-using-the-archive-command/

[Vic48]

An example would be when the command below is entered to create a user:

gss1.example.com(config)# username user_1 password newpwd

I would like to have logging log that a user User 1 has been created.

[Mark Malone · Accepted solution]

yes the archiving will provide that , anything that's created in general config and who was logged in

as per the doc link i provided below

For each configuration command that is executed, the following information will be logged:

• The command that was executed
• The configuration mode in which the command was executed
• The name of the user that executed the command
• The time at which the command was executed
• A configuration change sequence number
• Parser return codes for the command

Here is a sample of how you configure it:

Router(config)# archive
Router(config-archive)# log config (enters config logging mode)
Router(config-archive-log-config)# logging enable (turns on running config change logging)
Router(config-archive-log-config)# logging size 500 (remembers the last 500 commands entered – 100 are default)
Router(config-archive-log-config)# hidekeys (hides passwords from being shown / logged)
Router(config-archive-log-config)# notify syslog (optional – exports changes to syslog server)

[Vic48]

Very good stuff. Thanks!

[Georg Pauwen]

Hello,

on a side note, you could compare the running to the startup config and have EEM notify you with an email displaying the username that has been added. It kind of builds on what Mark posted. If you enable the archving:

1. enable

2. configure terminal

3. archive

4. log config

5. logging enable

6. logging size entries

7. hidekeys

8. notify syslog

9. end

Each tme a user is added, it will generate a syslog message similar to this:

*Feb 26 09:52:28.129: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:!config: USER TABLE MODIFIED

You could use that to run an EEM script. The show archive command  will show the difference between the startup and the running config and notify you by email

event manager applet USER_ADD
event syslog occurs 1 pattern "USER TABLE MODIFIED"
action 1.0 cli command "enable"
action 2.0 cli command "show archive config differences nvram:startup-config system:running-config | include username"
action 3.0 mail to "user@company.com" from "user@company.com" server "x.x.x.x" subject "User added:" body "$_cli_result"

[Vic48]

Neat. Thanks!