who changed the running-config last - show run has nothin

mobri09mobri09 Posts: 723Users Awaiting Email Confirmation
I need to find out who changed the running-config last on one of our routers.
When i do a show run...nothing is displayed because it looks like someone rebooted the router
after. Any ideas
thx

Comments

  • APAAPA Posts: 959Member
    are you using tacacs or radius authentcation? If so you should have tacacs\radius accounting switched on which gives you an audit trail of who did what last.....

    Otherwise you are pretty much stuck..... possibly use show version to see system up time and verify the system was reload and how long ago.

    Also use show loggin to see the previous commands entered.... but then again if the router was rebooted the buffer would have been cleared.....

    Hope this helps :D

    CCNA | CCNA:Security | CCNP | CCIP
    JNCIA:JUNOS | JNCIA:EX | JNCIS:ENT | JNCIS:SEC
    JNCIS:SP | JNCIP:SP
  • he-manhe-man Posts: 49Member ■■□□□□□□□□
    Nothing is displayed?

    How is that possible? There must be something or the router wouldnt be up surely?

    Router#sh run

    Router# sorry, the config you are looking for has gone! :)
  • scheistermeisterscheistermeister Posts: 748Member
    If you have the router logging to an external syslog server that will tell you when it was rebooted and will tell you where the person changed the config from (ln con 0, vty 0, ect.) If not then I would say you are out of luck if it really was rebooted.
    Give a man fire and he'll be warm for a day. Set a man on fire and he'll be warm for the rest of his life.
  • mobri09mobri09 Posts: 723Users Awaiting Email Confirmation
    thx for the help guys...i could have prob traced it through tacacs..great idea...but i did a show startup-config and found it. Just over looked the basic commands i guess because of the rush...o well its all good
  • mysql1988mysql1988 Posts: 115Member
    if you can't afford a tacas server just use syslog and track "userinfo". The last user that logged on will be logged to the syslog
Sign In or Register to comment.