Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Real-Time Change Detection for Cisco devices

Hello.

I'm having some trouble with RTCD for Cisco routers. The trap viewer is showing trap type: CISCO-CONFIG-MAN-MIB:ciscoConfigManMIBNotifications.1
when the commands "sh run", "conf t" and "wr me" are typed. The trap details show different sources and destinations for each event, and the line:
ccmHistoryEventConfigDestination.478=3
is what I'd like to match. The problem is the incrementing number (478 in this case). Filter conditions do not seem to support regular expressions, so my attempt to use:
ccmHistoryEventConfigDestination.[0-9]+=3
has not worked.

Ideally, I could just use ccmCLIRunningConfigChanged, but the Trap Viewer is not showing this trap type.

Can anyone offer any advice?

By the way, I have checked the documentation, which is not accurate for RTCD using SNMP.

Thanks!

Find more posts tagged with

Accepted answers

sedmo

It looks like it is possible to match on the EventSource and EventDestination OID's. I have attached a picture of my rule that alerts when someone does a config terminal from the command line but does not alert when a config download is requested via snmp.

rules.png

All comments

profzoom1

I am also intrested in getting this to work correctly.

I assumed that this is something that Cirrus did right out of the box and didn't need any sort of setup so now I am trying to get this figured out. Cisco Works does this automatically for us and thought this would take its place.

Could use some help in getting the realtime config changes completely setup from the info needed on the cisco devices (cat 2950 switches and Cisco 2600, 1760 and 2800 routers) to getting the traps setup and alerting me of changes. The documentation provided by Solarwinds is not very helpfull or it is too early in the morning to go through and someone may have an easier way of doing it.

Thanks in advance.

prof.

paulgareau

I'm starting to think that Cirrus does not support config change detection for cisco devices.

Why else would:
- No one from SolarWinds have responded to this thread.
- SolarWinds support not be able to provide instructions for how to do this.

If anyone has figured out how to get this to work, please let me know.

Thanks.

Paul

Haley

The requirements for Cirrus to receive real-time configuration change detections are as follows:

Devices must be configured to send traps or syslog messages to the Cirrus server. Please refer to the device's configuration guide for assistance.
A syslog server or trap receiver that can execute a third party program and pass an IP address must be installed on the Cirrus server (If Orion is installed on the Cirrus server, then you can use either the Orion Syslog Server or Orion Trap Receiver)

The steps for enabling Real-Time Config Change Detection within Cirrus are provided in the Cirrus Admin Guide at http://www.solarwinds.com/CirrusDocs/wwhelp/wwhimpl/js/html/wwhelp.htm.

In short:

Settings within Cirrus.

Open Cirrus.
Click on File > Settings > Real-Time Change Detection and check the box to enable this feature.
Click Config Change Settings in the left pane and type the Windows account credentials you want to use for executing the jobs.
Click Download Options in the left pane, and select the configuration type you want to download and comparison method.
Click Email Addresses in the left pane, and then provide the appropriate email address information. To suppress email notification, leave the email address fields blank. Also enter the appropriate Email Server Details.
Click OK.

Setting up the monitoring receiver (For this example, I am using Orion Syslog Server)

Open Orion Syslog Server and click View > Alerts/Filter Rules.
Click Add New Rule.
Provide the appropriate information on the General tab (appropriate IP Addresses and subnets) and DNS Hostname tab.
Click the Message tab, and then type the message pattern to look for in the Message Type Pattern field. The message pattern will vary by device type. For example, some devices include %SYS-5-CONFIG_I in their syslog messages when indicating a device change so you could enter %SYS-5-CONFIG_I. Please refer to the device's configuration guide for assistance with determining the appropriate message text to use for determining that the trap message is related to a configuration change.
Click the Alert Actions tab, and then click Add New Action.
Select Execute an external program, and then click OK.
Type the following in the Program to execute field: “Path\Configuration Management\ConfigAutoDownload.exe" ${IP} Where Path is the location of the Configuration Management folder. For example, “C:\Program Files\SolarWinds”. If the path contains spaces, enclose the path section of the statement in quotation marks (“).
Click OK.
Ensure the new rule is checked in the Alerts / Filter Rules tab of the Syslog Server Settings window, and then click OK.

paulgareau

Thanks, but I've seen this already and I'm using SNMP. The example for SNMP is incorrect. Please see my original post for more information about the problem I'm having.

profzoom1

I am able to run this report (Configuration Modified Report Last 24 Hours) and receive notice that changes did happen and by the person making the changes so I believe the fist part of setting this up is working.

My big problem is the 14 steps after the first one to make this work.

I can't get this part to work

Open Orion Syslog Server and click View > Alerts/Filter Rules.
Click Add New Rule.
Provide the appropriate information on the General tab (appropriate IP Addresses and subnets) and DNS Hostname tab.
Click the Message tab, and then type the message pattern to look for in the Message Type Pattern field. The message pattern will vary by device type. For example, some devices include %SYS-5-CONFIG_I in their syslog messages when indicating a device change so you could enter %SYS-5-CONFIG_I. Please refer to the device's configuration guide for assistance with determining the appropriate message text to use for determining that the trap message is related to a configuration
- Click the Alert Actions tab, and then click Add New Action.
- Select Execute an external program, and then click OK.
- Type the following in the Program to execute field: “Path\Configuration Management\ConfigAutoDownload.exe" ${IP} Where Path is the location of the Configuration Management folder. For example, “C:\Program Files\SolarWinds”. If the path contains spaces, enclose the path section of the statement in quotation marks (“).
- Click OK.
- Ensure the new rule is checked in the Alerts / Filter Rules tab of the Syslog Server Settings window, and then click OK.

I had thought that this product would work like Cisco works and automatically monitor the configs on a router and when a change was made and saved in NVram that Cirrus would recognize that and alert me. I had thought that is what the sales department had informed of and one of the reasons that we did purchase this product because of the ease of use and trying to train others on how Cisco Works runs.

Please helps with getting this to work other then just copying and pasting the instructions from the SW instructions that DO NOT WORK.

Thanks in advance

prof.