Description

This article provides the required configuration to keep track of any command that is executed on the SRX.

Symptoms

In many scenarios, a history of the configuration or operational commands that are executed on the SRX must be maintained. It might also be useful to log the users who executed the commands and when the command was executed.

Solution

To log all of the configuration and operational commands, make the following configuration at the [edit system syslog] hierarchy level:

[edit system syslog]
root@SRX# show
   file interactive-commands {
      interactive-commands info;
      match UI_CMDLINE_READ_LINE;
}

If the requirement is to log only configuration changes (and not operational commands), use the following configuration:

[edit system syslog]
root@SRX# show
    file log-configuration-commands {
       change-log info;
}

Verification:

We logged in to the SRX as root user and executed a few commands that included the set, deactivate, delete, and show operations. All of these operations, along with the username and timestamp, are logged under the file named interactive-commands :

root@SRX# run show log interactive-commands
Jun 24 12:12:51 SRX clear-log[90213]: logfile cleared
Jun 24 12:12:58 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'show system syslog '
Jun 24 12:13:05 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'show system services '
Jun 24 12:13:12 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'set system services ftp '
Jun 24 12:13:15 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'set system services telnet '
Jun 24 12:13:18 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'set system services ssh '
Jun 24 12:13:22 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'commit '
Jun 24 12:13:54 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'run show log interactive-commands '
Jun 24 12:17:26 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'delete system services ssh '
Jun 24 12:17:43 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'edit system services '
Jun 24 12:17:48 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'deactivate telnet '
Jun 24 12:17:50 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'top '
Jun 24 12:17:51 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'commit '
Jun 24 12:19:42 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'set interfaces ge-0/0/5 unit 0 family inet address 1.1.1.1/24 '
Jun 24 12:19:44 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'commit '
Jun 24 12:20:21 SRX mgd[5348]: UI_CMDLINE_READ_LINE: User 'root', command 'run show log interactive-commands '

As mentioned above, the file log-configuration-commands contains the history of only the configuration changes made to the device, along with the username and timestamp:

root@SRX# run show log log-configuration-commands
Jun 24 12:13:12 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' set: [system services]
Jun 24 12:13:12 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' set: [system services ftp]
Jun 24 12:13:15 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' set: [system services telnet]
Jun 24 12:13:18 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' set: [system services ssh]
Jun 24 12:17:26 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' delete: [system services ssh]
Jun 24 12:17:48 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' deactivate: [system services telnet]
Jun 24 12:19:42 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' set: [interfaces ge-0/0/5 unit 0]
Jun 24 12:19:42 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' set: [interfaces ge-0/0/5 unit 0 family inet]
Jun 24 12:19:42 SRX mgd[5348]: UI_CFG_AUDIT_OTHER: User 'root' set: [interfaces ge-0/0/5 unit 0 family inet address 1.1.1.1/24]