who changed the running-config last - show run has nothin

mobri09

I need to find out who changed the running-config last on one of our routers.
When i do a show run...nothing is displayed because it looks like someone rebooted the router
after. Any ideas
thx

APA

are you using tacacs or radius authentcation? If so you should have tacacs\radius accounting switched on which gives you an audit trail of who did what last.....

Otherwise you are pretty much stuck..... possibly use show version to see system up time and verify the system was reload and how long ago.

Also use show loggin to see the previous commands entered.... but then again if the router was rebooted the buffer would have been cleared.....

Hope this helps

he-man

Nothing is displayed?

How is that possible? There must be something or the router wouldnt be up surely?

Router#sh run

Router# sorry, the config you are looking for has gone!

scheistermeister

If you have the router logging to an external syslog server that will tell you when it was rebooted and will tell you where the person changed the config from (ln con 0, vty 0, ect.) If not then I would say you are out of luck if it really was rebooted.

mobri09

thx for the help guys...i could have prob traced it through tacacs..great idea...but i did a show startup-config and found it. Just over looked the basic commands i guess because of the rush...o well its all good

mysql1988

if you can't afford a tacas server just use syslog and track "userinfo". The last user that logged on will be logged to the syslog