Real-time Change Detection- Help needed

Hi everyone,

I have searched for a while trying to find a resolution on my own, however I really need this working and I could not find any examples of how to set this up and make it work.

The issue I am having is this:

NPM is our Syslog and SNMP Traps server

NPM and NCM live on separate servers

I want to get Realtime Change Detection working on NCM without having to duplicate logs to NCM. Is there a way to let NCM see the Syslog and SNMP Traps that are being collected on NPM?

Please help!

Find more posts tagged with

ncm_realtime_syslog_snmp

Accepted answers

lag

Generally I'm looking for the message type being sys-5-config_I. There may be variations, though, depending on how you exit. The best way to make sure you'll capture the correct event is to generate the message and match the filter rule to the message. Adding/changing a description on an interface is a pretty harmless way to kick off a syslog message. I think the sys-f-config_I message type is Notification level, so you'll want to make sure you're sending syslogs of that level.

All comments

jeff.stewart

How about using psexec to execute the ConfigAutoDownload application remotely?

PinkieT

Thanks Jeff,

It just made sense to go ahead and collect SNMP on NCM (Solved that problem)

Now I have an issue with the RCD and when it sends the notification.

I have the following traps configured:

1.3.6.1.4.1.9.9.43.1.1.6.1.5 equal to 3 (running config)

1.3.6.1.4.1.9.9.43.1.1.6.1.5 equal to 4 (start-up config)

The issue is that it compares the running config and the config I have specified (previous running config) as soon as I type "conf t" rather then when I exit out of global config mode.

Example issue with this:

Another Admin enters global config mode to change something but they decide not to, I receive the alert and the config is backed up- YAY!
They exit and go back in, make a change to something but no alert is sent, because A) they did not write mem they did so with nefarious intentions and knew nothing would get logged or alerted
The next time someone enters global config mode it alerts of the change that happened hours ago, by then it is too late, the damage is done.

Is there a way to tell it not to compare until config mode is exited, so any changes that were made and not written can be detected?

Thanks!

lag

I've found that using syslog instead of TRAPs for RTCD is a much more effective way to go about leveraging this feature.

PinkieT

Thanks Andy,

Can you share with me what variables you are searching for in Syslog for a router?

Are you using the IOS archive log config?

What are you doing about ASAs as far as change logging goes?

Thanks for you help

Mikayla

lag