Cisco Secure Firewall ASA · Event 111008
ASA 111008: An administrator ran a command on the firewall
The ASA recorded a command someone typed. This is your configuration change audit trail — and it is also where you find out that somebody turned logging off, because the command that does it is itself recorded here, right before the silence.
Also written as %ASA-5-111008ASA 111008User executed the commandasa configuration change log
- How oftenFires regularly
- Vendor calls it%ASA-5 (Notification)
- Logsyslog
What it means for you
For an analyst
Two things worth knowing. First, this records configuration-mode commands; show commands and other EXEC-level activity need 'logging enable' plus the relevant command privilege settings to appear, so an empty 111008 history does not mean nobody was on the box. Second, treat commands touching logging, aaa, ssh, http and access-list as a category of their own — 'no logging host' or 'logging buffered disable' are recorded here and then nothing else is, which makes the last 111008 before a gap disproportionately informative.
The fields that decide it
Everything else in the log line is context.
- User
- The account that ran the command. On an ASA using local accounts this may well be a shared 'admin', which is exactly why the AAA configuration matters.
- The command text
- What was typed, recorded verbatim. Certain commands deserve their own attention.
-
no logging …Logging being reduced or disabled. Whatever follows will not be recorded. -
aaa authentication … or username …Authentication or accounts being changed. A new username on a firewall is a significant event. -
ssh … or http …The management allow-list being widened. -
access-list …A rule change. Ordinary in a change window and not ordinary outside one. -
copy running-config startup-configThe change being made permanent. Its absence means the change disappears at the next reload. -
clear …Counters or connections being cleared, which can also clear evidence. - Timing against your change process
- Not a field, but the strongest filter available. Commands inside an approved window are routine; the same commands at 2am on a Sunday are not.
- Correlation with 605005
- The login that preceded the command, which supplies the source address that this message does not carry.
Common questions
Does ASA 111008 record every command?
No. It records configuration commands. EXEC-level commands such as show and clear are not captured by default — that needs 'logging enable' together with command privilege configuration, and on many ASAs it was never set up. An empty 111008 history therefore proves nothing about who was on the device or what they looked at.
Why does ASA 111008 not show the source address?
Because it records the command and the account, not the session. The address is in the 605005 login-permitted message for the same user around the same time. Joining the two is the standard way to attribute a configuration change to a place as well as a person, and it is a good argument for keeping both message IDs at a level that reaches your log server.
How do I use ASA 111008 to detect tampering?
Watch for a small set of command prefixes rather than the whole stream: anything starting 'no logging', changes to aaa or username, and changes to the ssh or http allow-lists. Also watch for gaps — because the command that disables logging is itself logged, the last 111008 before an unexplained silence tells you what happened.
An administrator made a change but it disappeared after a reload. Why?
Because 'copy running-config startup-config' was never run. The ASA keeps a running configuration and a startup configuration, and changes only survive a reload if they are written. Looking for that command in the 111008 stream after a change is a quick way to confirm whether the change was made permanent.
Read next
- Usually comes before ASA 605005: Someone logged in to manage the firewall The management login that put the administrator in a position to run this command.
- Usually comes before ASA 710003: Something tried to manage the firewall itself Management access being refused, the failure case of the same access path.
- Usually comes before Cisco ASA 113005: VPN authentication was rejected AAA authentication being rejected before any command could be run.
- Usually comes after Cisco ASA 106023: Traffic denied by an access-list The denies that result once an access-list change made here takes effect.
- The equivalent of Event 1102: The audit log was cleared Clearing a Windows event log — the same intent in a different product, and worth recognising as a pattern rather than a platform quirk.
Vendor documentation
Last reviewed 6 September 2026