Configuration Change Audit - WLC 9800

[ariask93]

Hey Guys!

It is there any option to implement something like this in a WLC C9800 IOS-XE 17.9.5a. Community Cisco , I try to implement but, it doesn't catch when someone change something from WEB-UI, It only catch loggin action in WEB-UI. Actually we dont have ISE, only a Syslog.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215523-quick-start-guide-on-what-logs-and-debug.html

check this 

maybe 

web server log can help you

MHM

[ariask93]

Thanks! I have checked before that information, but It's Not what I looking for, I just want to catch the particular logs when someone connect to the WLC via WEB-UI and modify something in the configuration, or via CLI. What ISE do, unfortunately I don't have an ISE on the network right now

[MHM Cisco World]

For router we use below and I think it also work for wlc cli

Router(config)# archive
Router(config-archive)# log config (enters config logging mode)
Router(config-archive-log-config)# logging enable (turns on running config change logging)
Router(config-archive-log-config)# logging size 500 (remembers the last 500 commands entered – 100 are default)
Router(config-archive-log-config)# hidekeys (hides passwords from being shown / logged)
Router(config-archive-log-config)# notify syslog (optional – exports changes to syslog server)

MHM

[ariask93]

Yes! that work, I already have that. But doesn't work for changes made by WEB_UI/HTTP on the WLC.

[MHM Cisco World]

But any change in gui will be translated into change in cli.

The only thing that missing is using monitor/display.

MHM