Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Who done it? Is it a feature in NCM?

We currently run Rancid, which for a freeware program works great, but very few here, actually just me, know how it works, they just know the frontend. One thing it can't do is tell us who made a change, or when, we just know it was done in the hour previous to the last revision.

Does NCM have the ability to tell you who made the changes? Most of the devices use our Cisco ACS, which logs all connections and changes. Currently we have to look at RANCID then search the ACS logs to see who did what.

Find more posts tagged with

Accepted answers

All comments

rschroeder

I'd like to have this feature, too.

While I'm not familiar with Rancid, you can use Orion's Syslog feature to do a very round-about review of who's logged into a device. It won't tell you what they did, but here's one way to see when a particular user was in:

From your Orion home page, click on Syslog. In the new screen, type in the message pattern *username*, select the time period from the drop down, and click Refresh.

If multiple users are in on the same day, and all have admin rights, you'll have to view the individual logs of the devices to see who was doing what--not a very convenient solution, I know. Hopefully you don't have a generic user account that can be used through AAA. The same goes for NCM--it can do configurations, and can be configured to use a unique NCM account. You'll need to audit the NCM server to see who was logged in, if they used NCM to configure a device.

ACDII

Thats what I thought, using syslog, drawback of that, IOS has very little control over what can be sent to syslog, and having hundreds of devices sending syslog traps would be a nightmare. On ASA devices, syslog traps can be specific, down to a single code if needed, works very well, but IOS doesn't have that ability, at least not yet.