Courseiva
SystemGlobal Config

archive log config

The 'archive log config' command enables logging of configuration changes on a Cisco IOS device, allowing administrators to track who made what changes and when for auditing and troubleshooting purposes.

Definition: archive log config is a Cisco IOS global config command. The 'archive log config' command enables logging of configuration changes on a Cisco IOS device, allowing administrators to track who made what changes and when for auditing and troubleshooting purposes.

Overview

The 'archive log config' command is a powerful tool for configuration change management and auditing on Cisco IOS devices. It enables logging of all configuration changes made to the device, including who made the change, what was changed, and when. This command is essential for network administrators who need to track configuration modifications for compliance, security, or troubleshooting purposes.

By enabling configuration logging, the device stores a record of every configuration command entered in global configuration mode, along with a timestamp and the username (if AAA authentication is configured). This log can be viewed using the 'show archive log config all' command. The underlying concept is that network devices are critical infrastructure, and unauthorized or accidental configuration changes can lead to outages or security breaches.

The 'archive log config' command provides a historical record that helps in identifying the root cause of issues, reverting changes, and holding administrators accountable. It is typically used in environments with multiple administrators or where change management processes are enforced. Alternatives include using syslog to capture configuration changes, but the archive log is more granular and specific to configuration commands.

This command fits into the broader network workflow as part of a configuration management strategy, often combined with periodic backups and version control. Important IOS behavior: the logging is buffered in memory and can be exported to a remote server using 'archive log config notify syslog'. The command requires privilege level 15 (enable mode) to configure.

Enabling this logging does not impact the running configuration directly but consumes memory for the log buffer. The log size can be configured with 'archive log config logging size <entries>'. The command is available in IOS 12.3(2)T and later.

For CCNA and CCNP candidates, understanding this command is crucial for network maintenance and troubleshooting scenarios.

Syntax·Global Config
archive log config

When to Use This Command

  • Tracking configuration changes made by multiple network engineers to identify who introduced a misconfiguration.
  • Complying with security audit requirements that mandate logging of all configuration changes on network devices.
  • Rolling back to a previous configuration by reviewing logged changes before a known good state.
  • Monitoring unauthorized configuration changes in a production network to quickly detect and respond to security breaches.

Parameters

ParameterSyntaxDescription
logging enablelogging enableEnables the configuration logging feature. Without this, no changes are logged. Must be entered under 'archive log config' mode.
logging size <entries>logging size <1-1000>Specifies the maximum number of log entries stored in memory. Default is 100. Valid range is 1 to 1000. When the log is full, oldest entries are overwritten.
notify syslognotify syslogSends configuration change notifications to syslog servers. Useful for centralized logging. Must be enabled separately.
hidekeyshidekeysHides sensitive keys (like enable secret) from the log output. Recommended for security.

Command Examples

Enable Configuration Change Logging

archive log config logging enable logging size 200 notify syslog hidekeys
Router(config-archive-log-cfg)# logging enable
Router(config-archive-log-cfg)# logging size 200
Router(config-archive-log-cfg)# notify syslog
Router(config-archive-log-cfg)# hidekeys
Router(config-archive-log-cfg)# exit
Router(config)# end
Router# show archive log config all

 idx   sess      user@line      Logged commands
 ---- ---------- -------------- ------------------------------------------------
   1    1        admin@console  logging enable
   2    1        admin@console  logging size 200
   3    1        admin@console  notify syslog
   4    1        admin@console  hidekeys
   5    2        admin@vty0     interface GigabitEthernet0/1
   6    2        admin@vty0     ip address 192.168.1.1 255.255.255.0
   7    2        admin@vty0     no shutdown

The output shows the configuration change log. 'idx' is the sequence number of the logged command. 'sess' is the session ID (increments per login session). 'user@line' shows the username and connection type (console or vty). 'Logged commands' lists the exact commands entered. This example shows admin making changes via console (sessions 1) and later via Telnet/SSH (vty0, session 2).

View Configuration Change Log Summary

show archive log config summary
Configuration log is enabled
Maximum logging buffer size: 200
Current logging buffer size: 7
Number of config log entries: 7
Logging to syslog: enabled
Hidekeys: enabled

This output provides a summary of the logging configuration. 'Maximum logging buffer size' is the configured limit. 'Current logging buffer size' shows how many entries are currently stored. 'Number of config log entries' is the total logged commands. 'Logging to syslog' indicates if syslog notifications are enabled. 'Hidekeys' shows whether sensitive commands (like passwords) are hidden from the log.

Understanding the Output

When you use 'show archive log config all', the output displays a table with columns: idx (sequential index of each logged command), sess (session identifier that increments with each new login session), user@line (username and connection type, e.g., admin@console for console or admin@vty0 for remote access), and Logged commands (the exact configuration commands entered). The log helps track who made changes and in what order. A high number of entries from a single session might indicate bulk changes.

If 'hidekeys' is enabled, commands containing passwords (like 'username secret' or 'enable secret') are replaced with '***' for security. The syslog notification sends these logs to a syslog server for centralized monitoring. In a real network, you would use this to audit changes, especially after an outage or security incident.

Good values include consistent user entries and expected changes; bad values include unknown users, unexpected changes, or a sudden spike in log entries indicating possible unauthorized activity.

Configuration Scenarios

Enable Configuration Logging with Syslog Notification

A network administrator needs to track all configuration changes on a core router for compliance. Changes must be logged locally and sent to a central syslog server for long-term storage.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0) Syslog Server (192.168.1.100)

Steps

  1. 1.Step 1: Enter global configuration mode: Router> enable
  2. 2.Step 2: Enter archive configuration mode: Router# configure terminal
  3. 3.Step 3: Enable configuration logging: Router(config)# archive
  4. 4.Step 4: Enable logging: Router(config-archive)# log config
  5. 5.Step 5: Set log size to 500 entries: Router(config-archive-log-cfg)# logging enable
  6. 6.Step 6: Enable syslog notification: Router(config-archive-log-cfg)# logging size 500
  7. 7.Step 7: Hide sensitive keys: Router(config-archive-log-cfg)# notify syslog
  8. 8.Step 8: Configure syslog server: Router(config-archive-log-cfg)# hidekeys
  9. 9.Step 9: Exit and verify: Router(config-archive-log-cfg)# end
Configuration
! Full IOS config block
archive
 log config
  logging enable
  logging size 500
  notify syslog
  hidekeys
!

Verify: Use 'show archive log config all' to view all logged changes. Expected output shows timestamp, user, and command. Also check syslog server for notifications.

Watch out: If AAA is not configured, the username field will show 'default' instead of the actual user. Ensure AAA authentication is set up for accurate user tracking.

Review Configuration Changes After an Outage

After a network outage, the administrator suspects a recent configuration change caused the issue. They need to review the log of configuration changes to identify the culprit.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Router> enable
  2. 2.Step 2: View the configuration log: Router# show archive log config all
  3. 3.Step 3: Look for changes around the time of the outage. Note the timestamp and user.
  4. 4.Step 4: If the log is large, use 'show archive log config all | include <keyword>' to filter.
  5. 5.Step 5: To see the exact configuration session, use 'show archive log config session <session-number>'.
  6. 6.Step 6: If needed, revert the change by entering the inverse command.
Configuration
! No configuration needed; this scenario uses show commands.
Router# show archive log config all

Verify: The output should list entries with sequence number, timestamp, user, and the command executed. Example: '1 00:01:23 UTC Mon Mar 1 2021 admin: configure terminal' then '2 00:01:25 UTC Mon Mar 1 2021 admin: interface GigabitEthernet0/0' etc.

Watch out: The log is stored in RAM and lost on reload unless exported. Ensure you have syslog or backup mechanisms for persistent storage.

Troubleshooting with This Command

When troubleshooting network issues, the 'archive log config' command is invaluable for identifying recent configuration changes that may have caused problems. Healthy output shows a chronological list of configuration commands with timestamps and usernames. Problem indicators include missing entries (if logging was not enabled), entries with 'default' user (indicating no AAA), or gaps in timestamps (suggesting a reload or log overflow).

Focus on the 'User' field to see who made changes; if multiple users have access, this helps pinpoint responsibility. Common symptoms that this command helps diagnose include sudden routing changes, interface flapping, ACL changes causing connectivity loss, or unexpected NAT behavior. For example, if OSPF neighbors go down, check the log for changes to router-id or network statements.

The step-by-step diagnostic flow: 1) Identify the time of the issue. 2) Use 'show archive log config all' and look for entries around that time. 3) Note any configuration commands that modify routing, interfaces, or security policies. 4) Correlate with other show commands like 'show running-config | section <feature>' to see current state. 5) If a change is found, consider reverting it. To correlate with other commands, use 'show logging' for syslog messages that may indicate the same change. For example, a syslog message like '%SYS-5-CONFIG_I: Configured from console by admin' corresponds to an archive log entry.

Also, 'show history' shows the last few commands entered, but the archive log provides a persistent record. For deeper analysis, export the log to a TFTP server using 'copy archive: tftp:' for offline review. Remember that the archive log only captures commands entered in configuration mode; it does not capture 'enable' or 'show' commands.

If you suspect a user gained unauthorized access, check the log for unusual times or users. In summary, the archive log is a first-stop tool for change-related troubleshooting.

CCNA Exam Tips

1.

CCNA exam tip 1: Remember that 'archive log config' is used to log configuration changes, not to archive configurations (that's 'archive path' and 'archive' commands).

2.

CCNA exam tip 2: The 'hidekeys' option is critical for security; it prevents passwords from being displayed in the log. The exam may test that this is enabled by default or recommended.

3.

CCNA exam tip 3: Know that 'logging enable' must be issued under 'archive log config' to start logging; without it, no changes are recorded.

4.

CCNA exam tip 4: The 'notify syslog' command sends logs to a syslog server; the exam might ask how to integrate with centralized logging.

Common Mistakes

Mistake 1: Forgetting to issue 'logging enable' after entering 'archive log config' mode, resulting in no changes being logged.

Mistake 2: Not using 'hidekeys' and exposing sensitive passwords in the log output, which can be a security risk.

Mistake 3: Setting the logging buffer size too small, causing older entries to be overwritten before they are reviewed.

archive log config vs show logging

Both 'archive log config' and 'show logging' involve logging on Cisco IOS devices, but they serve different purposes: one captures configuration changes for auditing, while the other displays system event messages. They are often confused because both are used for monitoring and troubleshooting, but operate at different levels of logging.

Aspectarchive log configshow logging
ScopeLogs configuration changes (CLI commands)Displays system event logs (syslog messages)
Configuration ModeGlobal configuration modePrivileged EXEC mode
PersistencePersists in running-config; saved to startup-configOutput is ephemeral; buffer cleared on reload
Primary PurposeAudit and track who made config changesMonitor system events and troubleshoot
Output DetailsLists user, command, timestamp of each config changeShows buffer contents, logging settings, stats
Output TypeLogged to archive file or displayed with 'show archive log config all'Real-time display of syslog messages

Use archive log config when you need to audit and track configuration modifications, especially in multi-admin environments.

Use show logging when you need to view recent syslog messages for troubleshooting network events or system errors.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the 'archive log config' command is supported with the same syntax. However, IOS-XE also supports the 'configuration logging' feature under 'archive' with additional options like 'persistent' to store logs in flash. The output format is similar but may include additional fields like 'source' (e.g., console, vty).

In NX-OS, the equivalent command is 'config logging' under 'configure terminal'. The syntax is 'config logging enable' and 'config logging size <size>'. NX-OS also supports 'config logging server <server>' for syslog.

The output is viewed with 'show config log'. For ASA firewalls, there is no direct equivalent; configuration changes are logged via syslog messages (e.g., %ASA-5-111008). ASA uses 'logging enable' and 'logging buffer' for general logging, but not a dedicated config log.

In IOS-XR, the command is 'commit' and 'show configuration commit list' for change tracking. IOS-XR uses a commit-based model, so changes are logged as commits. The 'archive log config' command is not available in IOS-XR.

Differences between IOS versions: In 12.x, the command was introduced; in 15.x, it became more robust with 'hidekeys' and 'notify syslog'. In 16.x (IOS-XE), it remains similar. Always check the specific platform documentation for any syntax variations.

Related Commands

show logging

Displays the state of system logging (syslog) on the device, including buffer contents, logging configuration, and statistics, used for troubleshooting and monitoring system events.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions