Skip to main content

 

Cisco Meraki Documentation

Organization Change Log

Overview

The Organization > Monitor > Change Log page displays changes made in any network within the current Organization since it was created, in the last 12 months in the EU, or in the last two years in the rest of the world. This includes configuration changes made to all types of devices, not just administrative changes to the Dashboard. Each time a change is made an event in the Change Log will be generated that includes the following information:

  • Time:  Time the change was made in UTC.
  • Admin:  The username of the administrator who made the changes.
  • Network:  The Dashboard network in which the change was made.
  • SSID:  The SSID that was altered, if no changes were made to an SSID then this field will remain blank.
  • Page:  The Dashboard menu page where the changes were made.
  • Label:  The configuration section or option that was changed. If the change affected only specific devices or ports, that information will be listed here.
  • Old Value:  The value of the option prior to the change.
  • New Value:  The value of the option after the change. 

Learn more with these free online training courses on the Networking Learning Hub:

Sign in with your Cisco SSO or create a free account to start training.

Filtering the Change Log

The Change Log can also be filtered to display only specific events from the history by typing into the Search bar located at the top of the Change Log or by selecting the Filter option for a specific entry. For example, it can be filtered to only show changes made by a specific Administrator, or only to changes made on a specific piece of hardware. Currently the Change Log can be filtered by:

  • Admin
  • Network
  • SSID
  • Page
  • Label
  • Old Value
  • New Value

At this time the Change Log cannot be filtered by date, however the most recent events are listed first by default. The image below shows a Change Log that has been filtered to only show events generated by one Administrator.

Change log View.png

Cisco Secure Connect - Unified Organization Change Log

The Organization > Monitor > Change log page of the Meraki dashboard includes data from integrated Cisco platforms. This consolidation of data provides a unified and enriched logging experience.

The Cisco Secure Connect Change log data includes the following information:

  • Time: Time the change was made in Coordinated Universal Time (UTC).
  • Admin: The username of the administrator who made the changes (Note: "Unknown User" indicates a system user/activity).
  • Network: The dashboard network in which the change was made.
  • SSID: This field will remain blank.
  • Page: This field will remain blank for Secure Connect configuration changes.
  • Label: The configuration section or option that was changed.
  • Old value: The value of the option prior to the change.
  • New value: The value of the option after the change.

For more information about the Cisco Meraki Change log page, refer to the Organization Change Log documentation.

Example 

In this illustration, the Change log table has been refined using the "Secure Connect" filter to showcase the supplementary data sourced from integrated Cisco platforms.

All changes to Secure Connect appear in the Meraki Organization change log. Logs take about 5min to sync from Umbrella to Meraki. Some changes are made via the integrated Umbrella cloud security, and these are attributed using one of two methods: 

  1. Changes made by the API key - attributed to the user who created the API key.
  2. Changes made by the Admin user - attributed to the user who has logged into Meraki Dashboard.

All changes made directly on Umbrella pages are attributed to the user who is logged into the Umbrella dashboard.

Note: Umbrella maintains its own changelog, and the name reflected in each platform will match the user's name in that platform. Typically they will be the same due to Admin Sync, but can differ if the name is changed directly in the Umbrella platform.

  • Meraki Changelog shows Meraki Name
  • Umbrella Changelog shows Umbrella Name

Typical user screenshot in umbrella vs meraki dashboard changelog. Different user screenshot in umbrella vs meraki dashboard changelog.

Changes made to the following pages will be logged as follows: 

Page Logging Method

Applications

User who created the API key

Browser Access

User who created the API key

Remote VPN Access User who has logged into Meraki Dashboard

Endpoint Posture

User who has logged into Meraki Dashboard

Cloud Firewall

IPS: User who created the API key
FW Rule: User who has logged into Meraki Dashboard

API Keys

User who created the API key
Admin Sync

User Added: User who has logged into Meraki Dashboard

User Synced: Management API

 

  • Was this article helpful?