2950 Switch log of startup file change

Unanswered Question
Apr 13th, 2007

Is there a log somewhere on a 2950 that would show me when and who(IP Address) changed the startup config file or boot options.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Craig Balfour Fri, 04/13/2007 - 03:54

Yes, if you type "show log" on a switch it should tell you who made a change to the switch.


2w6d: %SYS-5-CONFIG_I: Configured from console by craig on vty0 (

If you want more details, like which commands were execute and by whom you can use a TACACS+ server with AAA command accounting like Cisco ACS. On your AAA server you would then see accounting logs similar to the following:

04/13/2007 13:51:43 craig Team_NI show running-config 15 shell tty1 1020

To enable AAA command accounting you would use the following commands as part of your AAA configuration:

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

royalblues Fri, 04/13/2007 - 04:33


Its better to have an authoritative time on the router. NTP is suggested for maintaining this.

It is also better to have these command in place

service timestamps debug datetime msec

service timestamps log datetime msec localtime show-timezone

HTH, rate if it does



This Discussion