Username in EEM

Unanswered Question
Mar 20th, 2008
User Badges:

Hi,


I have a simple EEM applet which triggers a syslog message whenever anyone enters enable mode (to be exactly it triggers a syslog message whenever anyone types ena on the cli, so if anyone knows a better way to do it, I would be glad to know how).

So right now I know that somebody entered enable mode, but I don't know who. Is there a variable for the actual username or any other way to get it 'syslogged' in the applet ?


Thanks for your help,

best regards,


Kurt

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Joe Clarke Thu, 03/20/2008 - 06:28
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

There is no EEM variable for username (only command and command count for a CLI event detector). However, you can enable "logging userinfo" (if supported in your IOS). That will tell you when someone enters enable mode:


Mar 20 09:25:47 EDT: %SYS-5-PRIV_AUTH_PASS: Privilege level set to 15 by marcus on vty4 (172.18.254.237)

kb70 Thu, 03/20/2008 - 06:36
User Badges:

Hmm, unfortunatly 'logging userinfo' does'nt seem to be supported in 12.2(18)SXF12 on the 6500 platform :-(

Any other way to get this information logged ?


TIA,


Kurt

Joe Clarke Thu, 03/20/2008 - 06:41
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You can try enabling "login on-success log". That will log to syslog every time one successfully logs in. It should log a message on enable.

kb70 Thu, 03/20/2008 - 07:04
User Badges:

Both of your hints work fine on our 7206 with IOS 12.3, but unfortunatly both are not available in 12.2(18)SXF12 on the 6500.

Anyway, thanks a lot for your help.


Best regards,

Kurt

Joe Clarke Thu, 03/20/2008 - 07:45
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

We're looking to enhance EEM to provide these properties in the future, but that will take time. One sure way to do accounting as to who is becoming enabled is to use a AAA server.

Joe Clarke Thu, 03/20/2008 - 09:11
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

I filed CSCso33352 requesting an enhancement to EEM so that username, vty, host, and privilege level variables could be passed to CLI policies.

Actions

This Discussion