Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

NCM - Real-Time Change Detection

Hi I am currently using the RTCD to trigger switch configs to be downloaded when there is a change. Therefore, it was really easy to then setup the notifications for RTCD when a change happens. The issue that I am running into is that it appears that the RTCD will notify on EVERY single device that detects a config change. I was wondering if there was a way for me to use the tool to limit it to only certain switches and get notified on just those switches instead of everything. Thanks in advance!

Find more posts tagged with

Accepted answers

All comments

wluther

kcai You should be able to do this within the syslog filter you initially created to take action on the real time changes.

I think you should even be able setup various, different, syslog rules, if you were so inclined, each one triggering/filtering on its own specific criteria.

Each rule would still execute the same SolarWinds.NCM.RTNForwarder.exe program, and should work exactly the same...

I hope this helps...

Thank you,

-Will

kcai

Hi @wluther, in the web console in Config Downloads & Notifications part of RTCD there is a section where you check whether you want to monitor the running configs or startup configs and then below that is picking between last downloaded config file or baseline config file as the baseline for comparing against newer config files. Are both these options available in the syslog viewer? Maybe I just wasn't looking hard enough... I want monitor the running configs and compare it against the last downloaded config file as the baseline for comparing against newer config files.

Thanks a ton for your help!

wluther

kcai Ah, so you still want to be able to see ALL of the RTC changes for ALL of the devices, but only want to get emails on a specific subset of those devices?

kcai

Yeah, so for example I have a core distribution switch that I wanted to get notified by when changes are made to its configs. When changes are made I want to get emailed on that device of how its running configs compare to its previously downloaded configs (All devices will auto download when configurations are made). So I want to be emailed on a specific subset of devices with the nice fancy diff format, but all devices configs will be downloaded. I saw that I could setup notifications using the syslog viewer when config changes were made, but I couldn't see where to specify the monitoring and set baseline stuff that the web console provides. Does that make sense??

Thanks!

wluther

kcai Do y'all use custom properties? There was a post, a long time ago, in a thread far far away, that used a custom property field on the devices to determine who to send the notification to. Maybe you can add some sort of "RTCN" custom property value, set to the same email address as you currently have configured in the "Email Notification Options and Defaults". They used the custom property macro in the "To:" field of the change detection email settings. If you did this, then maybe it would only send emails out for the devices that had a valid value for the custom property... If I find the post, I will link it here.

-Will

kcai

We do use custom properties! I'm not too familiar with macros though. Maybe, if you can find the post it will provides some instructions on how to use macros?

wluther

kcai Here is the link to the post, to which I was previously referring.

Re: Config Change Detection Notifications to Specific Email Addresses

-Will

cnorborg

The one really nice thing about SWQL is you are only looking at the database, unless you get into actually programming with CRUD. So no worries about "touching" the database with this method.

That being said, custom SWQL for alerts can be a bit tricky, you need to play with it for sure. The main difference between the two is the macro-method as you mentioned would still send out an email for every node, you would just set it up that for some it would go to a dead-end mailbox, directly to the /dev/null in other words. The custom alert, if done right, should only generate an email for those that you want one done for and ignore the rest.