Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Has anyone ever created an alarm for a firmware change on any hardware device? mainly Cisco ASA, Palo Alto, Cisco NEXUS?

dretzkho

I need this for staying safe, when someone change the firmware on a device I want to get an Alarm & Mail

Thanks and greets

Find more posts tagged with

Accepted answers

stuartd

Hah - I hadn't even spotted that here is an out of the box alert.

If looking for the SWQL behind that creates that alert then simply click the little down facing arrow and then click on Show SWQL.

Which in this case gives:

All comments

stuartd

So we do something for HA on Fortinet Firewalls that looks at a specific object (a custom poller as it happens) and if the state has changed then the alarm triggers.

So like a lot of our alerts, this trigger is evaluated every minute and the condition must exist for 2m. The condition is basically checking to see if the CustomPoller state is different than it was in the the last 10minutes. I had help with crafting this SWQL as it was beyond me, but pretty sure the History.Statuses>1 just means is it different than last time I checked.

I'm thinking you could just adapt this to look at the IOS Version table or similar one of choice

Anyway, the SWQL for this is:

SELECT CustomPollerAssignmentOnNode.Uri, CustomPollerAssignmentOnNode.DisplayName 

FROM Orion.NPM.CustomPollerAssignmentOnNode AS CustomPollerAssignmentOnNode

INNER JOIN
(
SELECT
CustomPollerAssignmentID
, Count(DISTINCT RawStatus) AS Statuses

FROM Orion.NPM.CustomPollerStatistics

WHERE
Datetime>Addminute(-30,GETUTCDATE())
GROUP BY CustomPollerAssignmentID
) AS History
ON CustomPollerAssignmentOnNode.CustomPollerAssignmentID=History.CustomPollerAssignmentID

WHERE
CustomPollerAssignmentOnNode.CustomPollername='Fortigate_HA_State_Change'
AND History.Statuses>1

HTH.

dretzkho

Hi,

thanks for your reply. What I am looking for is an alert like this, coming out-of-the-box:

If someone know which SQL-query is behind "IOS Version has changed" or from another alert "IOS Image Family Change", I could adapt this alert.

greets

stuartd

Hah - I hadn't even spotted that here is an out of the box alert.

If looking for the SWQL behind that creates that alert then simply click the little down facing arrow and then click on Show SWQL.

Which in this case gives:

dretzkho

OMG You saved my day!

I am really looking for this and did not find it... I know this when I build a report, but there it is:

In the meantime I found this query, the "WhyReload" Entry is interesting too.

SELECT TOP 1000 ChassisID, ChassisSerialNumberString, NvRAMUsed, RomVersion, RomSysVersion, ProcessorRAM, RomID, WhyReload, LastDiscovery, FirstDiscovery, Missing
FROM NCM.CiscoChassis

I will try to find a way for the other Vendor's - If I am succesfull, I will share it here.