Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Feature Request

In the config compare emails, I think it would be helpful to have the diffs show up with plus and minus a few lines, a bit more like RANCiD:

diff -U4 -r1.38 node.foo.com

      t1-0/1/0:3 {
          description customer-a;
-         disable;
+         enable;
          unit 0 {
              family inet {
                  address 192.168.130.1/30;
              }

Having the diffs show up like this, I feel it's easier to identify what lines in the config have changed. Often, interfaces on a router get enabled or disabled, but it's impossible from the compare emails to tell which interface it was, since this is all that's sent:

disable;      >    enable;

This has the additional benefit of making the emails so much easier to read. I find the current format very difficult to decipher, since the changed lines are word-wrapped.

Find more posts tagged with

Security

feature_request

sql

Database

Accepted answers

All comments

DaveNoonan

I second the request.

bleearg13

In addition to the above feature request, there are a few more which have just come to light and have some serious security implications. We are currently undergoing a PCI Compliance review and the following points came up during our reviewer's inspection of Cirrus. His comments were, "For what this application does, the security on it is seriously lacking". The fact that Cirrus is, as of today, unable to support some of the features below could render Cirrus unusable for us in the future.

1. Cirrus should have the ability to either interact with AD or the local OS user database so more granular permissions can be applied to who has access to Cirrus. Failing that, Cirrus should have the ability to configure multiple usernames for use so that any change can be tied to a particular user instead of just "whomever opened Cirrus on X date".

2. Some more logging should be done whenever changes are made. Yes, the application tracks changes, but only on a manual or scheduled basis. Something should be logged, perhaps to the Solarwinds Event Log, that a change to a particular device was made at a particular date *by* the Cirrus application.

3. Session tracing should be allowable on a per-device basis.

4. The configurations, based upon the type of data they hold, should be stored in the database encrypted.

For those that do not know, PCI Compliance is a mandatory security compliance that any data center or organization must go through if they intend to provide credit card processing and/or the storage of credit card data. It is a compliance sponsored by all major credit card companies. Due to the fact that Cirrus stores configurations for devices within the path of transmitted data (not just the end servers or firewalls), Cirrus needs to meet the standards of compliance.

c01642

SNMPv3 support. Until thats supported i cannot use this software.

Haley

Your feedback from the PCI Compliance review is very helpful. I wanted to address a couple of the concerns posed by the PCI Compliance review.

1. If you have aaa enabled and syslog logging enabled, then you should be able to track which users made configuration changes and when. Within Cirrus, we plan to add permissions and device access limitations in an upcoming release.

2. If you enable real-time configuration change detection within Cirrus, then you will have one location that will log all configuration changes and when they occurred. This setting is available under File->Settings->Real Time Change Dectection and will log all configuration changes. For information on this feature is available at http://www.solarwinds.net/CirrusDocs/CirrusAdministratorGuide.1.53.htm.

3. When you enable Session tracing, a unique file is created for each device. The format of the file will be IP_Address-trace.txt.

4. Cirrus does not play a role in ensuring that the OS server or database server are secure. There are database/storage security products such as Decru, Neoscale, and Imperva that are available to ensure your database/storage servers and their content are secure and encrypted. We do, however, provide users the ability to encrpt the data we feel is most pertient which includes hiding the snmp community strings, usernames, and passwords within the database. This setting is available under the Global Settings.

I hope this helps clarify a couple of the items.

dbatten

Policy Rules

1. Correct the hyper link for "More Information about RegEx Patterns..." I get a 404 error (missing page)

2. Update the help to show all of the the RegEx pattern options with examples

I would like to see an enhancement for creating rules. The present field in not large enough to show all of the pattern matching string.

I would like to see an option (icon) next to the field that opens the pattern field in to a text editor. Preferably a text editor similar to Ultraedit (www.ultraedit.com).

In my environment I need to ensure that ACLs are applied correctly (no issue here); however, we have to ensure they are complete with the lines in the same order. A RegEx pattern works here, except the rule editor does not let you see everything. A text window/view would allow you to layout and scroll through the entire expression--support for column editing would make the expressions easier to read and edit.

Bonus material for other enhancements to Cirrus that use functions from editors for programmers:

Highlighting file type - Have syntex highlighting to distinguish between device commands and variable settings. Also handy for building device templates.
Enhanced the snippits to use "Tags" Tags are common sets of commands that should appear together to work properly.

Cheers,
Dale

ETirado

Hi Harvey,

I'm also going through an audit and the sql admins are telling me that having Cirrus connect with the SA account is a security violation. Apparently they are ok with using SA during the install when the DB is being created, but not for regular access.

We had this same issue with Orion, but the latest revision has fixed it so I don't have to use the SA account to access that DB anymore. Is this possible with Cirrus? If not, do you know if and when this feature will be available?

Thanks for the assistance,

Esteban

vangelar

Another feature that would be handy to have is a button to react to different policy reports. For example, if a node fails on a policy, there should be an option to immediately run a config snipplet to fix it, or run a command script that was previously created.

Also, on the config snipplet pushes, sometimes they error out due to "transmission error", there should be an option to rerun the snipplet for that single device that failed, without having to push it back out to all the devices, or reset up the node listing. Is there a way to export the failure list from a snipplet push to a file? Even that would be helpful.

bleearg13

In the config compare emails, I think it would be helpful to have the diffs show up with plus and minus a few lines, a bit more like RANCiD:

diff -U4 -r1.38 node.foo.com

t1-0/1/0:3 {
description customer-a;
- disable;
+ enable;
unit 0 {
family inet {
address 192.168.130.1/30;
}

Having the diffs show up like this, I feel it's easier to identify what lines in the config have changed. Often, interfaces on a router get enabled or disabled, but it's impossible from the compare emails to tell which interface it was, since this is all that's sent:
disable; > enable;

This has the additional benefit of making the emails so much easier to read. I find the current format very difficult to decipher, since the changed lines are word-wrapped.

Please excuse the caps. I am excited.

THANK YOU, SOLARWINDS, FOR IMPLEMENTING THIS VERY USEFUL FEATURE. IT IS NOW MUCH EASIER TO SEE WHERE IN THE CONFIG A CHANGE WAS MADE!

chris.lapoint

We're really happy you liked it. Please keep the great feedback coming and we'll continue listening!

For those who haven't seen NCM 5.5.2, we've added the ability to show a configurable number of lines before and after a config change in website, reports, and notifications.

Cheers,

-NCM Product Team