Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Editing Policies under Complaince

I am reviewing the Cisco Audits, and found that it is failing under logging. When I click on the i I notice the command it is searching for is logging 10.10.10.1. Well all our routers/switches are configured as logging host 192.168.x.x. I have not been able to locate where I can edit the actual command in the policy, just how to apply the policy. A search of the forum turned up nothing on this.

Find more posts tagged with

Accepted answers

All comments

rschroeder

You may find the information you seek here:

Go to Admin > Settings > NCM Settings
Click on the Manage Rules tab
On the far right, search for "logging"
Find the Rule called "Logging to Syslog Server and select it and edit it

Change the String from "logging 10.10.10.1" to whatever you logging destination server's IP address is.
Go to the bottom and click Submit.

Go back to Admin > Settings > NCM Settings
Select the Cisco Policy Report
Click Update Selected
When the Update is complete, Click View Report to see that your change correctly reflects the status of your equipment.

Hopefully you'll find that particular Cisco Policy line item is no longer in violation for your devices. If it IS in violation, then you may have some Cisco devices that aren't using the 192.168.x.x address that you expect them to use.

Swift Packets!

Rick Schroeder

ACDII

Thats exactly what I was looking for, Thanks,.

rschroeder

I'm glad this is what you needed, ACDII‌.

If you find my answer was correct, please set my response as the Correct Answer (it'll slide me 5 Thwack Points, which are always appreciated!).

Have a great weekend!

Rick S.

rschroeder

There is an additional option I didn't go into--Remediation Script. If you wish, and if you trust your scripting and NCM's work, you can set up an automatic remediation script that can fix (or seriously mess-up) all of your configurations.

NCM can search for your string and if it's not found, it can add it into your configurations automatically.

All you need do is enter in the Remediation script you need. For example, if your desired string isn't found, then NCM could automatically perform the following if you entered it into the Remediation Script section:

conf t

logging 192.168.10.20

end

Just keep in mind that NCM would apply this to EVERY device that the policy references. That's OK if all your devices use the same script syntax, and if they all must point at the same syslog server.

But I've found that there are some subtle (or not-so-subtle) differences between the required Cisco syntax in ASA's, IOS, IOS-XE, NX-OS, Wireless Controllers, etc. The command that works for one may not work at all in all the others. Worse, depending on the command, I wouldn't be surprised to learn one command that's good for some OS's could actually cause problems when applied to others.

I'll leave that for you to work out. I've used the logging command safely, and when it doesn't work on one OS or on the WLC's, it's not a big deal. I just let those fail, and deal with them manually. But be forewarned about applying it across multiple platforms or OS's. Before doing so I recommend you first test/verify the command is valid on all the versions and platforms and OS's.

Yours,

Rick S.

CourtesyIT

ACDII Also, keep in mind that Cisco not only uses a single space, but may use multiple spaces or tabs between keywords. Depending on your IOS,NXOS,XE-OS. I find it best to correct the issue then cut and paste from the Cisco CLI into the audit criteria.

One more thing.

Logging (IP Address) or logging host (IP Address)

The keyword host may or may not be present.

ACDII

I don't see where I can set it as the answer, just mark as helpful. In any case it worked as I had hoped it would. Removed 61 devices from the audit.

rschroeder

As long as it helped get your reports looking correct, that's the main thing.

ACDII

Well, since writing this post and letting Orion NCM do its thing, so far most of the false readings have gone away. I don't trust my scripting, mainly since I don't know where to even begin! LOL Once I get a grasp on it, then I can let Orion do the updates. For now it is 100% more than what we had prior.