WirelessPhreak.com

I like to travel, f*ck with technology, and partake in the occasional tropical drink.
I am also a co-host on The NBD Show podcast.
Follow Me

 The question is “why log everything?”

Logging your local SSH sessions can provide valuable information for troubleshooting, record-keeping, security, and auditing purposes. It is recommended to enable session logging as part of your SSH client configuration. Logging can save your bacon, for instance when:

  • The telnet/SSH client buffer is full
  • Something goes wrong
  • You mistakenly close SecureCRT
  • You want to check what you have done


The original guide was posted on Ciscozine.com. It was such a good article I wanted to capture it here and add some Apple screenshots for everyone.

Below the steps to configure it:

1. Open the software.

2. On the top bar click “Options”then “Global Options”.


3. Select “Default Session”, click “Edit Default Settings…”; then select “Log File”.


There are many customization's:Log file name: where to save the log file.
Upon connect: text at the beginning of the file.
Upon disconnect: text at the end of the file.
On each line: text added on each line.

These fields accept several variables; a complete list is shown below:%H – hostname
%S – session name
%Y – four-digit year
%M – two-digit month
%D – two-digit day of the month
%h – two-digit hour
%m – two-digit minute
%s – two-digit seconds
%t – three-digit milliseconds
%% – percent (%)
%envvar% – environment variable (for instance %USERNAME%)

Note: These settings will be applied ONLY on new sessions!

4. If you would apply these settings on the current saved sessions click “File” on the top bar then “Connect…”. Select the devices or the group of devices, right click and select “Properties”. A new window will appear:

 

You can customize each field as you prefer. In my case, I have used the previous settings.

Below an example of a saved session:
19:19:58.965 $ Start recording Test_Switch (192.168.0.10) - 19:19:58
19:19:58.983 $ C
19:19:58.983 $ *
19:19:58.984 $ *
19:19:58.984 $ * Test_Switch
19:19:58.984 $ *
19:19:58.985 $
19:20:00.950 $ Username: Cisco
19:20:00.980 $ Password:
19:20:00.980 $
19:20:48.403 $ Test_Switch#sh ver
19:20:48.620 $ Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(2)SY, RELEASE SOFTWARE (fc4) 19:20:48.620 $ Technical Support: http://www.cisco.com/techsupport
19:20:48.620 $ Copyright (c) 1986-2013 by Cisco Systems, Inc.
19:20:48.620 $ Compiled Wed 04-Sep-13 13:05 by prod_rel_team
19:20:48.620 $
19:20:48.621 $ ROM: System Bootstrap, Version 12.2(17r)SX7, RELEASE SOFTWARE (fc1)
19:20:48.621 $ 19:20:48.621 $ SW-6500-VSS uptime is 23 weeks, 2 hours, 8 minutes
19:20:48.621 $ Uptime for this control processor is 23 weeks, 2 hours, 0 minutes
19:20:48.621 $ System returned to ROM by reload at 12:16:02 UTC Fri May 23 2014 (SP by reload)
19:20:48.622 $ System restarted at 14:20:04 CST Fri May 23 2014
19:20:48.622 $ System image file is "sup-bootdisk:s72033-adventerprisek9-mz.151-2.SY.bin"
19:20:48.622 $ Last reload reason: Admin reload CLI
19:20:48.622 $
19:20:48.622 $
19:20:48.624 $
19:20:48.624 $ This product contains cryptographic features and is subject to United
19:20:48.625 $ States and local country laws governing import, export, transfer and
19:20:48.625 $ use. Delivery of Cisco cryptographic products does not imply
19:20:48.625 $ third-party authority to import, export, distribute or use encryption.
19:20:48.625 $ Importers, exporters, distributors and users are responsible for
19:20:48.626 $ compliance with U.S. and local country laws. By using this product you
19:20:48.626 $ agree to comply with applicable laws and regulations. If you are unable
19:20:48.626 $ to comply with U.S. and local laws, return this product immediately.
19:20:48.626 $
19:20:48.626 $ A summary of U.S. laws governing Cisco cryptographic products may be found at:
19:20:48.626 $ http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
19:20:48.626 $
19:20:48.627 $ If you require further assistance please contact us by sending email to
19:20:48.627 $ [email protected].
19:20:48.627 $
19:20:48.627 $ cisco WS-C6509-E (R7000) processor (revision 1.6) with 983008K/65536K bytes of memory.
19:20:48.627 $ Processor board ID SMC17330086
19:20:48.957 $ SR71000 CPU at 600Mhz, Implementation 0x504, Rev 1.2, 512KB L2 Cache 19:20:48.958 $ Last reset from s/w reset
19:20:48.958 $ 12 Virtual Ethernet interfaces
19:20:48.958 $ 216 Gigabit Ethernet interfaces
19:20:48.958 $ 36 Ten Gigabit Ethernet interfaces
19:20:48.958 $ 1917K bytes of non-volatile configuration memory.
19:20:48.958 $ 19:20:48.959 $ 65536K bytes of Flash internal SIMM (Sector size 512K).
19:20:48.959 $ Configuration register is 0x2102
19:20:48.960 $ 19:20:59.632 $ Test_Switch#
19:22:23.284 $ Test_Switch#exit
19:22:23.585 $ Stop recording Test_Switch (192.168.0.10) - 19:22:23

As you can see, each line start with the time. The “$” is used for two reasons:If you import the log file in Excel or similar, you can use this symbol as a delimiter.
I use the “$” and not the “,” because in some configuration the “,” is present, so it would not be possible to use this symbol like a delimiter.