diff --git a/napalm_logs/config/eos/USER_ENTER_CONFIG_MODE.yml b/napalm_logs/config/eos/USER_ENTER_CONFIG_MODE.yml
new file mode 100644
index 00000000..f3deacc0
--- /dev/null
+++ b/napalm_logs/config/eos/USER_ENTER_CONFIG_MODE.yml
@@ -0,0 +1,15 @@
+messages:
+  # 'error' should be unique and vendor agnostic.
+  - error: USER_ENTER_CONFIG_MODE
+    tag: SYS-5-CONFIG_E
+    values:
+      user: (\w+)
+      vterm: (\w+) 
+      ip4: ([\w\d:\.]+)
+    line: ': Enter configuration mode from console by {user} on {vterm} ({ip4})'
+    model: NO_MODEL
+    mapping:
+      variables: {}
+      static:
+        users//user//{user}//action//enter_config_mode: True
+
diff --git a/napalm_logs/config/eos/USER_EXITED_CONFIG_MODE.yml b/napalm_logs/config/eos/USER_EXITED_CONFIG_MODE.yml
new file mode 100644
index 00000000..c8424595
--- /dev/null
+++ b/napalm_logs/config/eos/USER_EXITED_CONFIG_MODE.yml
@@ -0,0 +1,16 @@
+messages:
+  # 'error' should be unique and vendor agnostic.
+  - error: USER_EXIT_CONFIG_MODE
+    tag: SYS-5-CONFIG_I
+    values:
+      source: (\w+)
+      user: (\w+)
+      vterm: (\w+) 
+      ip4: ([\w\d:\.]+)
+    line: 'Configured from {source} by {user} on {vterm} ({ip4})'
+    model: NO_MODEL
+    mapping:
+      variables: {}
+      static:
+        users//user//{user}//action//exit_config_mode: True
+
diff --git a/napalm_logs/config/eos/USER_WRITE_CONFIG.yml b/napalm_logs/config/eos/USER_WRITE_CONFIG.yml
new file mode 100644
index 00000000..ef2363a7
--- /dev/null
+++ b/napalm_logs/config/eos/USER_WRITE_CONFIG.yml
@@ -0,0 +1,14 @@
+messages:
+  - error: USER_WRITE_CONFIG
+    tag: SYS-5-CONFIG_STARTUP
+    values:
+      user: (\w+)
+      vterm: (\w+) 
+      ip: ([\w\d:\.]+)
+      path: ([\w\:\-\/]+)
+    line: 'Startup config saved from {path} by {user} on {vterm} ({ip})'
+    model: NO_MODEL
+    mapping:
+      variables: {}
+      static:
+        users//user//{user}//action//write_config: True
diff --git a/tests/config/eos/USER_ENTER_CONFIG_MODE/default/syslog.msg b/tests/config/eos/USER_ENTER_CONFIG_MODE/default/syslog.msg
new file mode 100644
index 00000000..17eb4da6
--- /dev/null
+++ b/tests/config/eos/USER_ENTER_CONFIG_MODE/default/syslog.msg
@@ -0,0 +1 @@
+<165>Oct 23 12:20:55 GeorgeSwitch ConfigAgent: %SYS-5-CONFIG_E: Enter configuration mode from console by admin on vty3 (127.0.0.1)
diff --git a/tests/config/eos/USER_ENTER_CONFIG_MODE/default/yang.json b/tests/config/eos/USER_ENTER_CONFIG_MODE/default/yang.json
new file mode 100644
index 00000000..49504c5f
--- /dev/null
+++ b/tests/config/eos/USER_ENTER_CONFIG_MODE/default/yang.json
@@ -0,0 +1,32 @@
+{
+	"host": "GeorgeSwitch",
+	"yang_message": {
+		"users": {
+			"user": {
+				"admin": {
+					"action": {
+						"enter_config_mode": true
+					}
+				}
+			}
+		}
+	},
+	"message_details": {
+		"facility": 20,
+		"pri": "165",
+		"processName": "ConfigAgent",
+		"host": "GeorgeSwitch",
+		"tag": "SYS-5-CONFIG_E",
+		"time": "12:20:55",
+		"date": "Oct 23",
+		"message": ": Enter configuration mode from console by admin on vty3 (127.0.0.1)",
+		"severity": 5
+	},
+	"timestamp": 1540297255,
+	"error": "USER_ENTER_CONFIG_MODE",
+	"ip": "127.0.0.1",
+	"facility": 20,
+	"os": "eos",
+	"yang_model": "NO_MODEL",
+	"severity": 5
+}
diff --git a/tests/config/eos/USER_EXIT_CONFIG_MODE/default/syslog.msg b/tests/config/eos/USER_EXIT_CONFIG_MODE/default/syslog.msg
new file mode 100644
index 00000000..28e1a023
--- /dev/null
+++ b/tests/config/eos/USER_EXIT_CONFIG_MODE/default/syslog.msg
@@ -0,0 +1 @@
+<165>Oct 23 12:23:41 GeorgeSwitch ConfigAgent: %SYS-5-CONFIG_I: Configured from console by admin on vty3 (127.0.0.1)
diff --git a/tests/config/eos/USER_EXIT_CONFIG_MODE/default/yang.json b/tests/config/eos/USER_EXIT_CONFIG_MODE/default/yang.json
new file mode 100644
index 00000000..b1f1028c
--- /dev/null
+++ b/tests/config/eos/USER_EXIT_CONFIG_MODE/default/yang.json
@@ -0,0 +1,32 @@
+{
+	"host": "GeorgeSwitch",
+	"yang_message": {
+		"users": {
+			"user": {
+				"admin": {
+					"action": {
+						"exit_config_mode": true
+					}
+				}
+			}
+		}
+	},
+	"message_details": {
+		"facility": 20,
+		"pri": "165",
+		"processName": "ConfigAgent",
+		"host": "GeorgeSwitch",
+		"tag": "SYS-5-CONFIG_I",
+		"time": "12:23:41",
+		"date": "Oct 23",
+		"message": ": Configured from console by admin on vty3 (127.0.0.1)",
+		"severity": 5
+	},
+	"timestamp": 1540297421,
+	"error": "USER_EXIT_CONFIG_MODE",
+	"ip": "127.0.0.1",
+	"facility": 20,
+	"os": "eos",
+	"yang_model": "NO_MODEL",
+	"severity": 5
+}
diff --git a/tests/config/eos/USER_WRITE_CONFIG/default/syslog.msg b/tests/config/eos/USER_WRITE_CONFIG/default/syslog.msg
new file mode 100644
index 00000000..ae6fc907
--- /dev/null
+++ b/tests/config/eos/USER_WRITE_CONFIG/default/syslog.msg
@@ -0,0 +1 @@
+<165>Oct 23 12:22:50 GeorgeSwitch ConfigAgent: %SYS-5-CONFIG_STARTUP: Startup config saved from system:/running-config by admin on vty3 (127.0.0.1).
diff --git a/tests/config/eos/USER_WRITE_CONFIG/default/yang.json b/tests/config/eos/USER_WRITE_CONFIG/default/yang.json
new file mode 100644
index 00000000..cbe89145
--- /dev/null
+++ b/tests/config/eos/USER_WRITE_CONFIG/default/yang.json
@@ -0,0 +1,32 @@
+{
+	"host": "GeorgeSwitch",
+	"yang_message": {
+		"users": {
+			"user": {
+				"admin": {
+					"action": {
+						"write_config": true
+					}
+				}
+			}
+		}
+	},
+	"message_details": {
+		"facility": 20,
+		"pri": "165",
+		"processName": "ConfigAgent",
+		"host": "GeorgeSwitch",
+		"tag": "SYS-5-CONFIG_STARTUP",
+		"time": "12:22:50",
+		"date": "Oct 23",
+		"message": ": Startup config saved from system:/running-config by admin on vty3 (127.0.0.1).",
+		"severity": 5
+	},
+	"timestamp": 1540297370,
+	"error": "USER_WRITE_CONFIG",
+	"ip": "127.0.0.1",
+	"facility": 20,
+	"os": "eos",
+	"yang_model": "NO_MODEL",
+	"severity": 5
+}