diff --git a/doc/basic.texi b/doc/basic.texi
index 0f7bec9..4485665 100644
--- a/doc/basic.texi
+++ b/doc/basic.texi
@@ -185,6 +185,13 @@
 millisecond accuracy.
 @end deffn
 
+@deffn Command {log commands} {}
+This command enables the logging of all commands typed by a user to
+all enabled log destinations.  The note that logging includes full
+command lines, including passwords.  Once set, command logging can only
+be turned off by restarting the daemon.
+@end deffn  
+
 @deffn Command {service password-encryption} {}
 Encrypt password.
 @end deffn
diff --git a/lib/vty.c b/lib/vty.c
index e4510f8..ff013cf 100644
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -90,6 +90,7 @@
 /* Integrated configuration file path */
 char integrate_default[] = SYSCONFDIR INTEGRATE_DEFAULT_CONFIG;
 
+static int do_log_commands = 0;
 
 /* VTY standard output function. */
 int
@@ -401,12 +402,13 @@
   int ret;
   vector vline;
   const char *protocolname;
-  char *cp;
+  char *cp = NULL;
 
   /*
    * Log non empty command lines
    */
-  cp = buf;
+  if (do_log_commands)
+    cp = buf;
   if (cp != NULL)
     {
       /* Skip white spaces. */
@@ -434,7 +436,7 @@
       snprintf(prompt_str, sizeof(prompt_str), cmd_prompt (vty->node), vty_str);
 
       /* now log the command */
-      zlog(NULL, LOG_NOTICE, "%s%s", prompt_str, buf);
+      zlog(NULL, LOG_ERR, "%s%s", prompt_str, buf);
     }
   /* Split readline string up into the vector */
   vline = cmd_make_strvec (buf);
@@ -2938,6 +2940,17 @@
   return CMD_SUCCESS;
 }
 
+/* vty login. */
+DEFUN (log_commands,
+       log_commands_cmd,
+       "log commands",
+       "Logging control\n"
+       "Log all commands (can't be unset without restart)\n")
+{
+  do_log_commands = 1;
+  return CMD_SUCCESS;
+}
+
 /* Display current configuration. */
 static int
 vty_config_write (struct vty *vty)
@@ -2970,6 +2983,9 @@
         vty_out (vty, " anonymous restricted%s", VTY_NEWLINE);
     }
   
+  if (do_log_commands)
+    vty_out (vty, "log commands%s", VTY_NEWLINE);
+     
   vty_out (vty, "!%s", VTY_NEWLINE);
 
   return CMD_SUCCESS;
@@ -3091,6 +3107,7 @@
   install_element (CONFIG_NODE, &service_advanced_vty_cmd);
   install_element (CONFIG_NODE, &no_service_advanced_vty_cmd);
   install_element (CONFIG_NODE, &show_history_cmd);
+  install_element (CONFIG_NODE, &log_commands_cmd);
   install_element (ENABLE_NODE, &terminal_monitor_cmd);
   install_element (ENABLE_NODE, &terminal_no_monitor_cmd);
   install_element (ENABLE_NODE, &no_terminal_monitor_cmd);