configuration changes in router

SHAIHAN JAFFREY · ‎05-28-2008

I have 3560 routers which are administered by different administrators. How do i know that the last configuration changes have been made by which administrator.

PAUL TRIVINO · ‎05-28-2008

If there are some form of individual UserIDs, at the top of the "sh run" you'll see something like this:

Current configuration : 39911 bytes

!

! Last configuration change at 10:23:39 PDT Wed May 21 2008 by ptrivino

! NVRAM config last updated at 13:48:24 PDT Wed May 21 2008 by ptrivino

!

If there is only a single userIDn defined you won't be able to tell who is who.

HTH

Paul

SHAIHAN JAFFREY · ‎05-28-2008

sorry first of all i would correct my question its not 3560 its 3800 series router.

Although there are indiv user id's but not getting this output by sh run:

!

! Last configuration change at 10:23:39 PDT Wed May 21 2008 by ptrivino

! NVRAM config last updated at 13:48:24 PDT Wed May 21 2008 by ptrivino

!

PAUL TRIVINO · ‎05-28-2008

If I'm not mistaken, youwon't see this if there have been no changes since a reboot. The 3845 on my desk, which as had no changes since the reboot, shows:

NETNORWRT01#sh run

Building configuration...

Current configuration : 5801 bytes

!

version 12.4

Paul

Edison Ortiz · ‎05-28-2008

If you are not getting the output, it means the clock in the router is not set.

If you type show clock and the time is displayed preceded by "*", then you must either manually set the time or configure NTP.

Once the time is displayed without the "*", the output in 'show run' should contain the information you are looking for, after a change is made in the config.

In order to populate the username portion of the above output, the user needed to authenticate to the device with a individual account via TACACS, RADIUS or Local authentication.

HTH,

__

Edison

Please rate helpful posts

anthony.king · ‎05-28-2008

Set up individual logins for each user via aaa or local login. Then set up syslogging or snmp management so you can maintain an audit trail on an external device. If you set up aaa, you could use the accounting feature as well.

Richard Burts · ‎05-28-2008

It may not be obvious but the key to getting those entries at the beginning of show run is that the router must know what time it is. The easy solution is to run NTP on the router and let the router sync to some NTP server (an internal NTP source if you have something internal already running NTP or use an external NTP source from the Internet (there are many of them available).

I would also suggest that if you want a really more robust and reliable way to track who is making changes that you should configure aaa accounting and use it to generate records that reflect the config commands and who entered them.

HTH

Rick

HTH

Rick