Can we check audit-trail history after reloading the Aruba Controller

Aruba Employee

Environment         This applies to all Aruba controllers running version AOS 6.3 and above.

 

Prior to AOS 6.3 once the controller was rebooted we cannot see the audit-trail history. The entries would be flushed out.

From AOS 6.3 even after rebooting the controller, we can see the previous run commands(though limited in count).

The below output was run on a 3600 series controller running AOS 6.4.1.0.


======================snipped==========================

(CTRL-E) #show version
Aruba Operating System Software.
ArubaOS (MODEL: Aruba3600), Version 6.4.1.0

Switch uptime is 2 hours 4 minutes 14 seconds
Reboot Cause: User reboot (Intent:cause:register 78:86:50)

(CTRL-E) #show clock
Sat Aug 23 18:55:53 PDT 2014 

(CTRL-E) #show audit-trail history

Aug 20 09:11:38  cli[1562]: USER:admin@10.20.25.33 COMMAND:<write memory > -- command executed successfully
Aug 20 09:14:14  cli[1562]: USER:admin@10.20.25.33 COMMAND:<boot system partition 0 > -- command executed successfully
Aug 20 09:14:18  cli[1562]: USER:admin@10.20.25.33 COMMAND:<write memory > -- command executed successfully
Aug 20 09:14:27  cli[1562]: USER:admin@10.20.25.33 COMMAND:<reload>
Aug 22 12:04:22  cli[1562]: USER:admin@10.20.25.33 COMMAND:<process  restart  "trapd>
Aug 22 16:00:38  cli[1562]: USER:admin@10.162.110.231 COMMAND:<no paging > -- command executed successfully
Aug 22 16:00:38  cli[1562]: USER:admin@10.162.110.231 COMMAND:<encrypt disable > -- command executed successfully
Aug 23 10:17:28  cli[1562]: USER:admin@10.20.25.33 COMMAND:<web-server > -- command executed successfully
Aug 23 15:40:40  cli[1562]: USER:admin@10.20.25.33 COMMAND:<no wlan ssid-profile "test" > -- command execution failed
Aug 23 15:40:55  cli[1562]: USER:admin@10.20.25.33 COMMAND:<no wlan virtual-ap "test" > -- command execution failed
Aug 23 15:40:59  cli[1562]: USER:admin@10.20.25.33 COMMAND:<wlan virtual-ap "test" > -- command executed successfully
Aug 23 15:41:02  cli[1562]: USER:admin@10.20.25.33 COMMAND:<wlan virtual-ap "test" no ssid-profile > -- command executed successfully
Aug 23 15:41:15  cli[1562]: USER:admin@10.20.25.33 COMMAND:<no wlan ssid-profile "test" > -- command executed successfully
Aug 23 15:41:19  cli[1562]: USER:admin@10.20.25.33 COMMAND:<no wlan virtual-ap "test" > -- command execution failed
Aug 23 15:41:58  cli[1562]: USER:admin@10.20.25.33 COMMAND:<aaa profile "radius" > -- command executed successfully
Aug 23 15:42:02  cli[1562]: USER:admin@10.20.25.33 COMMAND:<aaa profile "radius" initial-role "authenticated" > -- command executed successfully
Aug 23 15:42:09  cli[1562]: USER:admin@10.20.25.33 COMMAND:<write memory > -- command executed successfully
Aug 23 15:42:23  cli[1562]: USER:admin@10.20.25.33 COMMAND:<no wlan ssid-profile "radius" > -- command executed successfully
Aug 23 15:42:27  cli[1562]: USER:admin@10.20.25.33 COMMAND:<no wlan ssid-profile "testing" > -- command executed successfully
Aug 23 15:42:41  cli[1562]: USER:admin@10.20.25.33 COMMAND:<encrypt disable > -- command executed successfully
Aug 23 15:48:26  cli[1562]: USER:admin@10.20.25.33 COMMAND:<aaa user delete all > -- command executed successfully
Aug 23 15:51:37  cli[1562]: USER:admin@10.20.25.33 COMMAND:<boot system partition 0 > -- command executed successfully
Aug 23 15:51:42  cli[1562]: USER:admin@10.20.25.33 COMMAND:<write memory > -- command executed successfully
Aug 23 15:51:50  cli[1562]: USER:admin@10.20.25.33 COMMAND:<reload>
===========================================================================================


The above output is just a snipped version. There are more outputs that could be found while running the command in a live environment.

Version history
Revision #:
3 of 3
Last update:
‎11-12-2014 04:25 PM
Updated by:
 
Labels (1)
Contributors
Tags (1)
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: 
Is this a frequent problem?

Request an official Aruba knowledge base article to be written by our experts.