Unlike my technical articles about configurations, protocols and so on, in this tutorial I will explain how to log automatically all SecureCRT sessions. For those that are unaware, SecureCRT is one of the best SSH/telnet client.
The question is “why save everything?”
In my opinion, a good approach to work with many devices (network, security, …) is to save everything (show command, configuration command and so on..). This method gives several benefits, for instance when:
- The telnet/SSH client buffer is full
- Something goes wrong
- You mistakenly close SecureCRT
- You want to check what you have done
Below the steps to configure it:
1. Open the software.
2. On the top bar click “Options”then “Global Options”.
3. Select “Default Session”, click “Edit Default Settings…”; then select “Log File”.
There are many customizations:
- Log file name: where to save the log file.
- Upon connect: text at the beginning of the file.
- Upon disconnect: text at the end of the file.
- On each line: text added on each line.
These fields accept several variables; a complete list is shown below:
- %H – hostname
- %S – session name
- %Y – four-digit year
- %M – two-digit month
- %D – two-digit day of the month
- %h – two-digit hour
- %m – two-digit minute
- %s – two-digit seconds
- %t – three-digit milliseconds
- %% – percent (%)
- %envvar% – environment variable (for instance %USERNAME%)
Note: These settings will be applied ONLY on new sessions!
4. If you would apply these settings on the current saved sessions click “File” on the top bar then “Connect…”. Select the devices or the group of devices, right click and select “Properties”. A new window will apppers:
You can customize each field as you prefer. In my case, I have used the previous settings.
Below an example of a saved session file “D:\SecureCRT logs\2014-10-31\Ciscozine_test (172.16.3.210) — 19-19.log”:
19:19:58.965 § Start recording Ciscozine_test (172.16.3.210) - 19:19:58 19:19:58.983 § C 19:19:58.983 § * 19:19:58.984 § * 19:19:58.984 § * Ciscozine_test 19:19:58.984 § * 19:19:58.985 § 19:20:00.950 § Username: ciscozine 19:20:00.980 § Password: 19:20:00.980 § 19:20:48.403 § Ciscozine_test#sh ver 19:20:48.620 § Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(2)SY, RELEASE SOFTWARE (fc4) 19:20:48.620 § Technical Support: http://www.cisco.com/techsupport 19:20:48.620 § Copyright (c) 1986-2013 by Cisco Systems, Inc. 19:20:48.620 § Compiled Wed 04-Sep-13 13:05 by prod_rel_team 19:20:48.620 § 19:20:48.621 § ROM: System Bootstrap, Version 12.2(17r)SX7, RELEASE SOFTWARE (fc1) 19:20:48.621 § 19:20:48.621 § SW-6500-VSS uptime is 23 weeks, 2 hours, 8 minutes 19:20:48.621 § Uptime for this control processor is 23 weeks, 2 hours, 0 minutes 19:20:48.621 § System returned to ROM by reload at 12:16:02 UTC Fri May 23 2014 (SP by reload) 19:20:48.622 § System restarted at 14:20:04 CST Fri May 23 2014 19:20:48.622 § System image file is "sup-bootdisk:s72033-adventerprisek9-mz.151-2.SY.bin" 19:20:48.622 § Last reload reason: Admin reload CLI 19:20:48.622 § 19:20:48.622 § 19:20:48.624 § 19:20:48.624 § This product contains cryptographic features and is subject to United 19:20:48.625 § States and local country laws governing import, export, transfer and 19:20:48.625 § use. Delivery of Cisco cryptographic products does not imply 19:20:48.625 § third-party authority to import, export, distribute or use encryption. 19:20:48.625 § Importers, exporters, distributors and users are responsible for 19:20:48.626 § compliance with U.S. and local country laws. By using this product you 19:20:48.626 § agree to comply with applicable laws and regulations. If you are unable 19:20:48.626 § to comply with U.S. and local laws, return this product immediately. 19:20:48.626 § 19:20:48.626 § A summary of U.S. laws governing Cisco cryptographic products may be found at: 19:20:48.626 § http://www.cisco.com/wwl/export/crypto/tool/stqrg.html 19:20:48.626 § 19:20:48.627 § If you require further assistance please contact us by sending email to 19:20:48.627 § [email protected]. 19:20:48.627 § 19:20:48.627 § cisco WS-C6509-E (R7000) processor (revision 1.6) with 983008K/65536K bytes of memory. 19:20:48.627 § Processor board ID SMC17330086 19:20:48.957 § SR71000 CPU at 600Mhz, Implementation 0x504, Rev 1.2, 512KB L2 Cache 19:20:48.958 § Last reset from s/w reset 19:20:48.958 § 12 Virtual Ethernet interfaces 19:20:48.958 § 216 Gigabit Ethernet interfaces 19:20:48.958 § 36 Ten Gigabit Ethernet interfaces 19:20:48.958 § 1917K bytes of non-volatile configuration memory. 19:20:48.958 § 19:20:48.959 § 65536K bytes of Flash internal SIMM (Sector size 512K). 19:20:48.959 § Configuration register is 0x2102 19:20:48.960 § 19:20:59.632 § Ciscozine_test# 19:22:23.284 § Ciscozine_test#exit 19:22:23.585 § Stop recording Ciscozine_test (172.16.3.210) - 19:22:23
As you can see, each line start with the time. The “§” is used for two reasons:
- If you import the log file in Excel or similar, you can use this symbol as a delimiter.
- I use the “§” and not the “,” because in some configuration the “,” is present, so it would not be possible to use this symbol like a delimiter.
Great article!! Thanks
Very interesting post and well explained. Thank you
very cool
to save you from typying all this
C:SecureCRT logs%Y-%M-%D%S (%H) — %h-%m.log
Start recording %S (%H) – %h:%m:%s
Stop recording %S (%H) – %h:%m:%s
%h:%m:%s.%t §
Thank you for your post.
I just have one issue with this:
I can not save the settings when I change the file location to: C:SecureCRT logs%Y-%M-%D%S (%H) — %h-%m.log
I get: Invalid log file path specified.
How can I make this work?
thank bro :x
cool! thank you very much man!
Hello,
Does any know if there is a way to set the preferred logging options and enable logging as the default?
Thanks!