History of commands / Syslog

Answered Question
Jun 24th, 2008

Hello,

I am using router 1812

1) How can I find what commands have been entered on a router?

2) How can I log all these commands to a file / syslog?

3) How can I find, let's say, the last 10 login attempts?

thank u

I have this problem too.
0 votes
Correct Answer by michael.leblanc about 8 years 5 months ago

Consider the following:

To enable logging of user information, and the counting of various types of syslog messages:

logging count

logging userinfo

Note: Use "show logging count" to derive benefit of "logging count".

To regulate and log user logins (failed and successful):

login block-for 120 attempts 4 within 120

login on-failure log

login on-success log

To log configuration changes via syslog:

archive

log config

logging enable

notify syslog

hidekeys

Edit: For some reason the post is displayed differently than I pasted it. The four commands under "archive" are sub commands and should be shown as indented.

logging origin-id hostname

logging source-interface

logging

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (2 ratings)
Loading.
Spinu Viorel Thu, 07/03/2008 - 23:40

boath answers helped me a lot...

I have another question...

sh history - shows me the commands entered, but if I logout and then login , history is empty; can I do something about that, like in linux, the history file keeps your commnads there even if u do a relogin. I hope u understand what I want to say.

thanku again

Correct Answer
michael.leblanc Tue, 06/24/2008 - 06:55

Consider the following:

To enable logging of user information, and the counting of various types of syslog messages:

logging count

logging userinfo

Note: Use "show logging count" to derive benefit of "logging count".

To regulate and log user logins (failed and successful):

login block-for 120 attempts 4 within 120

login on-failure log

login on-success log

To log configuration changes via syslog:

archive

log config

logging enable

notify syslog

hidekeys

Edit: For some reason the post is displayed differently than I pasted it. The four commands under "archive" are sub commands and should be shown as indented.

logging origin-id hostname

logging source-interface

logging

Actions

This Discussion