TACACS+ is the preferred method to log CLI commands at any enable level whether performing show command or making config changes. See AAA and TACACS commands for more information. There’s open source software if you don’t have or can’t afford Cisco ACS or similar products that can do TACACS and RADIUS.
But for a really cool and rarely used feature, you could have the switch itself run a config diff(erence) on the running-config and startup-config and email the changes or deltas to you! Code snippet here.