Configuration Change Notification and Logging

Change notification is a nice feature on Cisco IOS devices that lets you keep track of the changes that have been made to your configuration. It can even track the user who made these changes and it can send this information to a syslog server.

This is one of those features that is very useful when something suddenly doesn’t work anymore and everyone tells you that “nobody made any changes”.

Configuration

Let’s look at a Cisco router where we enable this feature:

Router(config)#archive
Router(config-archive)#log config
Router(config-archive-log-cfg)#logging enable

First you should use the archive command and then enter the log config section. Use the logging enable command and the router will keep track of the configuration changes. There’s a number of other items that are useful to configure however:

Router(config-archive-log-cfg)#logging size 1000

By default your router will keep 100 entries in the configuration log but we can increase it to 1000 using the logging size command. All the changes will be kept locally on your router but we can send it to the syslog server if we want:

Router(config-archive-log-cfg)#notify syslog

Last but not least, it might be a good idea not to store any passwords in the configuration change logs. You can use the following command to disable this:

Router(config-archive-log-cfg)#hidekeys

Verification

Whenever you make a change to the configuration you will see the following message on your console:

Router#configure terminal
Router(config)#interface loopback 0
Router(config-if)#
%PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:interface loopback 0 

You can see the change that was made (interface loopback 0) and the user that did this (console). Let’s make some more changes to the configuration of this router:

Router(config-if)#shutdown
Router(config-if)#no shutdown

You will see these changes on the console:

Router#
%PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:shutdown 

%PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:no shutdown 

We can also use some show commands to verify what changes have been made:

Router#show archive log config all
 idx   sess           user@line      Logged command
    1     1        console@console  |  logging enable 
    2     1        console@console  |  logging size 1000
    3     1        console@console  |  notify syslog 
    4     1        console@console  |  hidekeys 
    5     1        console@console  |  interface loopback 0  
    6     1        console@console  | shutdown 
    7     1        console@console  | no shutdown 

Above you find all the commands that I typed in the console so far. If you want to re-use some of the commands that you found then there’s a useful command for you to use:

Router#show archive log config all provisioning 
archive 
 log config 
  logging enable 
  logging size 1000
  notify syslog 
  hidekeys 
interface loopback 0  
 shutdown 
 no shutdown 

This gives you the logged configuration changes in the same format as you can find them in the running configuration. What about passwords in my configuration? I used the hidekeys command so they shouldn’t be visible…let’s find out if this is true. I’ll configure an enable secret:

Router(config)#enable secret Cisco123

Your console will show this:

Router#
%PARSER-5-CFGLOG_LOGGEDCMD: User:console  logged command:enable secret ***** 

It’s masking the secret so it’s not giving away any information. You’ll find the same thing in the overview of commands:

Router#show archive log config all | include secret 
    8     2        console@console  |enable secret ***** 

hostname Router
!
ip cef
!
archive
 log config
  logging enable
  logging size 1000
  notify syslog contenttype plaintext
  hidekeys
!
end

I hope this tutorial has been helpful to you, if you have any changes feel free to leave a comment!

Configuration Archive and Rollback on Cisco IOS

Cisco IOS routers and switches are able to create ‘snapshots’ of their configuration using the archive feature. Cisco calls these snapshots ‘configuration archives’ and they are very useful as it allows you to store multiple versions of your configuration.

The configuration archive can be created every time you save your running configuration or you can create one based on a time schedule, for example each 24 hours or so.

When you have multiple snapshots you can use a show command to see the difference between the configurations and easily restore (rollback) to a previous version.

Let’s take a look at the configuration shall we?

Configuration

First we need to configure where we want to store our configuration archives. When you use the path command you can see what options we have:

Router(config)#archive 
Router(config-archive)#path ?
  flash:  Write archive on flash: file system
  ftp:    Write archive on ftp: file system
  http:   Write archive on http: file system
  https:  Write archive on https: file system
  pram:   Write archive on pram: file system
  rcp:    Write archive on rcp: file system
  scp:    Write archive on scp: file system
  slot0:  Write archive on slot0: file system
  tftp:   Write archive on tftp: file system

Normally an external location would be a good idea but to keep things simple I will use the flash memory of my router:

Router(config-archive)#path flash:router-backup

Each configuration archive file will start with “router-backup” in the filename. Besides the destination we also have to choose when we want to create a configuration archive. For example, whenever the running-config is saved as the startup-config might be a good idea to create a backup:

Router(config-archive)#write-memory

I will also configure a schedule, for example to create a configuration archive each 24 hours:

Router(config-archive)#time-period 1440

1440 minutes means we’ll create a snapshot each 24 hours. Everything is now in place, let’s see if it is working.

Verification

We can use the show archive command to see how many snapshots we have. At the moment no snapshots were made so the list is empty:

Router#show archive 
There are currently 1 archive configurations saved.
The next archive file will be named flash:router-backup-1
 Archive #  Name
   0        
   1        
   2        
   3        
   4        
   5        
   6        
   7        
   8        
   9        
   10        
   11        
   12        
   13        
   14      

Now we will save the running-config and thanks to the write-memory command it will also create a configuration archive:

Router#copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]
Verifying checksum...  OK (0xDCF1)

When we look again at the show archive command we’ll see our first configuration archive:

Router#show archive 
There are currently 2 archive configurations saved.
The next archive file will be named flash:router-backup-2
 Archive #  Name
   0        
   1       flash:router-backup-1 <- Most Recent
   2        
   3        
   4        
   5        
   6        
   7        
   8        
   9        
   10        
   11        
   12        
   13        
   14   

As configured you can see that it has been stored on the flash of the router:

Router#show flash: 

System CompactFlash directory:
File  Length   Name/status
  1   840      router-backup-1  
[904 bytes used, 16776308 available, 16777212 total]
16384K bytes of ATA System CompactFlash (Read/Write)

Having extra backups feels great! Before we are going to recover one I’ll show you how you can compare different archives. I’ll make some changes to the running-config so that we’ll end up with two different configuration archives:

Router(config)#interface loopback0
Router(config-if)#ip address 1.1.1.1 255.255.255.0

We’ll save the running-config to the startup-config so that another archive is created:

Router#copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]
Verifying checksum...  OK (0xDCF1)

Let’s find out if we have another snapshot:

Router#show archive 
There are currently 3 archive configurations saved.
The next archive file will be named flash:router-backup-3
 Archive #  Name
   0        
   1       flash:router-backup-1 
   2       flash:router-backup-2 <- Most Recent
   3        
   4        
   5        
   6        
   7        
   8        
   9        
   10        
   11        
   12        
   13        
   14  

So we now have two configuration archives but we don’t know the differences between them. IOS tells us that the second one is the latest version but this doesn’t always mean that it’s the best configuration that we have. Luckily there’s a command that tells us exactly the difference between the two files:

Router#show archive config differences flash:router-backup-1 flash:router-backup-2
Contextual Config Diffs:
+interface Loopback0
 +ip address 1.1.1.1 255.255.255.0

The + symbol tells us that the second file has some additional lines. I created that loopback interface so it’s showing up here with the IP address. If you see a – symbol then it means those lines have been removed.

Now we can replace our running configuration and select one of our snapshots like this:

Router#configure replace flash:router-backup-1 list 
This will apply all necessary additions and deletions
to replace the current running configuration with the
contents of the specified configuration file, which is
assumed to be a complete configuration, not a partial
configuration. Enter Y if you are sure you want to proceed. ? [no]: yes/pre>

Rollback:Acquired Configuration lock.
!Pass 1

!List of Commands:
no interface Loopback0
end

Total number of passes: 1
Rollback Done

Router#
%PARSER-6-EXPOSEDLOCKRELEASED: Exclusive configuration lock released from terminal '0' -Process= "Exec", ipl= 0, pid= 92
%LINK-5-CHANGED: Interface Loopback0, changed state to administratively down

The router tells us which commands it has executed in order to rollback to the configuration that we selected. In my example it has removed the loopback 0 interface.

That’s all I wanted to show you for now, I hope this has been a useful tutorial for you! If you have any questions feel free to leave a comment.