NCM Realtime Change Detection

Hello,

Hopefully someone can assist in answering a few questions I have around NCM realtime change detection?

I have Cisco switches that are managed in NPM/NCM via the Management Vrf address

I also have a log collector service that sits in-between the Cisco Switch and the Solarwinds syslog service (the log collector has been configured to relay the message on) eg Cisco Switch->Log Collector->Solarwinds Syslog Server.

As the syslog rule is using the "Solarwinds.NCM.RTNForwarder.exe" and ${IP_Address} will this take the source of the syslog message as the ${IP_Address} and will it even work as if I have "logging origin-id hostname" the hostname is used in the message and not even the management vrf ip address?

I'm getting the suspicion that this isn't going to work...

Thanks,

Peter

Find more posts tagged with

realtime change detection

rtn

ncm

Accepted answers

All comments

chad.every

It will probably depend how the middle man syslog collector handles the forward. It's common to have this approach and SolarWinds even has their own syslog tool call Kiwi Syslog that can be used in the manner. You'll probably have test what you have and see how it goes.

PeterLyttle

Supposedly it doesn't modify the traffic at all (though I suspect the source address will change, or need to be spoofed) This is the way we used to have it setup Source->Kiwi->NPM but there was no redundancy with Kiwi so switched over to this clustered solution.

bobmarley

Sounds like it should work. If not the Kiwi product Chad.Every mentions is fairly inexpensive and does forward on messages without altering them and keeps the original source address. If you need redundancy buy 2 its cheap.