2950 Switch log of startup file change

[tpaprotny]

Is there a log somewhere on a 2950 that would show me when and who(IP Address) changed the startup config file or boot options.

[Craig Balfour]

Yes, if you type "show log" on a switch it should tell you who made a change to the switch.

Eg.

2w6d: %SYS-5-CONFIG_I: Configured from console by craig on vty0 (192.168.100.196)

If you want more details, like which commands were execute and by whom you can use a TACACS+ server with AAA command accounting like Cisco ACS. On your AAA server you would then see accounting logs similar to the following:

04/13/2007 13:51:43 craig Team_NI show running-config 15 shell tty1 1020 192.168.100.196

To enable AAA command accounting you would use the following commands as part of your AAA configuration:

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

[royalblues]

Friend,

Its better to have an authoritative time on the router. NTP is suggested for maintaining this.

It is also better to have these command in place

service timestamps debug datetime msec

service timestamps log datetime msec localtime show-timezone

HTH, rate if it does

Narayan

[tpaprotny]

Many thanks all.