On the 13500 appliance I can find user command history, some changed configurations etc in /var/log/messages. As far as I know Audit Logs for Gaia Clish commands are written by the
xpand daemons with
local0 priority to the
/var/log/messages file. For instance>
On the 41K chassis ( R76SP.50 version ) there is commands for audit log such as >
But after running these commands I could not find logs like "cmd by xxx start executing" in audit files and in var/log/messages. Where can I look for audit log, is there a way to find user clish history on 41K appliance?