Reporting information about changes to the running configuration

Syslog can be used for sending notifications to a remote syslog server about changes made to the running configuration. The notifications in the syslog messages are sent in ASCII format and contain this information:

  • Notice-Type: Describes the syslog notification as a “running config change”.

  • Event-ID: Identifier for the running config change event that occurred on the switch.

  • Config-Method: The source for the running config change.

  • Device-Name: The managed device.

  • User-Name: User who made the running config change.

  • Remote-IP-Address: IP address of a remote host from which the user is connected.


no logging notify <running-config-change> [transmission-interval <0-4294967295>

Enables sending the running configuration change notifications to the syslog server.

The no form of the command disables sending the running configuration changes to the syslog server.

Default: Disabled

<running-config-change >

Mandatory option for the notify parameter. Specifies the type of notification to send.

transmission-interval <0-4294967295>

Specifies the time interval (in seconds) between the transmission of two consecutive notifications. Running config changes occurring within the specified interval will not generate syslog notifications.

A value of zero means there is no limit; a notification is sent for every running config change.

Default: Zero

Sending running config changes to the syslog server

switch(config)# logging notify running-config-change
transmission-interval 10