Your Cisco devices don’t automatically log someone getting into your network and changing your Cisco router and switch configurations. But with a few simple commands, you can configure your Cisco routers and switches to monitor and log configuration changes when they occur. You can set this up on the routers and switches themselves, as well as on your network appliances, such as a LEM appliance. Enabling configuration change monitoring and logging on your Cisco routers and switches lets you know if unauthorized configuration changes occur on your network.
By configuring your Cisco devices to monitor and log changes, you’re telling the devices log every command that changes the router’s or switch’s configuration. (Show commands, for example, are not logged, because they don’t change the router’s configuration.)
Perform the following steps to enable configuration change monitoring on Cisco devices: