Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Automated Config clean up

I am trying to clean up my switch configurations. There are a lot of old outdated ntp servers and snmp trap servers and other stale info with in the configuration. I have been trying to find a way to remove all of these old server then run a script to only have the correct ones. Any ideas or do I need to go through each device and remove them individually ? I wouldnt mind if the new server was list and got removed.

Example would be:

ntp server 1.1.1.1

ntp server 1.2.2.2

ntp server 3.3.3.3

runs the following

no ntp server 1.1.1.1

no ntp server 1.2.2.2

no ntp server 3.3.3.3 --- This is fine if it does this.

ntp server 3.3.3.3

Find more posts tagged with

Accepted answers

cnorborg

I believe I know what you mean, that you want to remove any other NTP server than the one you want defined, regardless of it's IP address. So you don't have an actual list of them sitting there of what other NTP servers there are...

I have a bit of a hack based on the newest NCM that can work for you. This is how you set it up.

In the "STRING MATCHING" section configure it as follows with the IP address of the NTP server you want to be set...

Then, in the "search config file/block" set it up as follows, the "config block end" could probably be "^.*" also (ie: ANYTHING), we are mainly interested in setting the start of the config block to be the line that contains the specific NTP server on that specific line. More on that below...

Now for the magic / hack. Set your remediation script as follows:

The first line is doing a "no" of the "ConfigBlock" start line I mentioned above, which will be set to any NTP server that you DON'T want. It will ignore the NTP server you do want. The second line is optional, setting the NTP server that you do want. If you just want to remove unwanted NTP servers the first line will suffice.

The one drawback of this is if no NTP server is defined at all, the config will be in compliance, you will need another rule to make sure the NTP server you want is defined, but that's quite simple.

This is kind of hacking the new ability to run your script on each config block that is in violation a bit, this feature was never intended to work this way. But my devious mind wanted this for the ability to do things like remove unwanted SNMP communities and such. So, no promise it will always work, but I believe it should work at least in the present. Let me know your results and TEST first on a small subset of devices!!!

Any relation to Mark? :-)

HTH!!

"I'm just working in the coal mines..."

All comments

wluther

rmothersbaugh‌

I would recommend starting with a compliance policy/report.

This will tell you which devices contain, or do not contain, a specific, user specified, string.

From there, you can create a "Fix" to be applied to the devices when found.

Give me a few minutes, and I will find you some links to some examples.

-Will

rmothersbaugh

I am doing them but I dont see a way to remove the old ones with gathering the info from the configuration. I mean I can go through and grab all the server ip address and just make a single script. But i was hoping to do it automatically just in case a person makes a change it would run the policy and remove the added server only.

wluther

rmothersbaugh‌

do you have a list of the other, possible, ntp servers, or are you thinking they could just be anything?

If you have a list of known ntp servers that you do not want to use, then you could create a separate rule for each each server, and then put all of those rules into the same report.

You could then assign a corrective action to those rules that would remove each one, if found.

Example:

Rule ntpserver1:

looks for this line in the config

ntp server 1.1.1.1

and, if found, performs this corrective action to remove it

no ntp server 1.1.1.1

Rule ntpserver2:

looks for this line in the config

ntp server 1.2.2.2

and, if found, performs this corrective action to remove it

no ntp server 1.2.2.2

Rule ntpserver3:

looks for this line in the config

ntp server 3.3.3.3

and, if NOT found, performs this corrective action to add it

ntp server 3.3.3.3

Or, can you just run a script on all of the switches, through the "Configuration Management" section under the NCM tab, that would just "no ntp server", then "ntp server 3.3.3.3"?

How about changing the rule to include a block of text from the config, matching it on the lines before and after "ntp server 3.3.3.3".

This way if it matches the config, you know you only have the 1 entry.

Otherwise, if it doesn't match, and you need it to cover possible ntp servers you may not be aware of, it simply removes everything, and only re-adds the one you need.

As another example, if this is how all of your devices/configs should look, then anything with more than those 3 lines, regardless of server IP, would trigger the policy violation, and then you could remediate with your "no ntp"/"ntp server 3.3.3.3" script.

ntp clock-period 36029396

ntp server 3.3.3.3

end

I hope I am not too far off base on this with you, but I do know I am not the best explainer.

-Will

cnorborg

I have a bit of a hack based on the newest NCM that can work for you. This is how you set it up.

In the "STRING MATCHING" section configure it as follows with the IP address of the NTP server you want to be set...

Now for the magic / hack. Set your remediation script as follows:

The one drawback of this is if no NTP server is defined at all, the config will be in compliance, you will need another rule to make sure the NTP server you want is defined, but that's quite simple.

Any relation to Mark? :-)

HTH!!

"I'm just working in the coal mines..."

cvachovecj

Hmm, interesting use case for the block inspection. I'm curious to see if it works.

Jiri

wluther

cvachovecj‌

cnorborg‌ usually seems to know what he is talking about, at least all of the times he has helped me. If he says it works, I would bet it does.

Seems like this could be a useful tool, whether intended or not. Maybe SolarWinds can implement it into the system as its own feature/purpose.

cvachovecj

Of course cnorborg‌ knows what he is talking about. (I nominated him for the MVP status as a recognition.) I appreciate that he found a use case that I didn't have in mind when we implemented this enhancement.

What I meant by being curious if it works is the fact that sometimes, configs contain different kinds of whitespace, so tuning a regex rule so that it works unviversally may need some playing around.

Jiri

rmothersbaugh

I will test this today and let you know thanks,.

rmothersbaugh

WORKED LIKE A CHAMP

you have made my life much easier thanks

Thanks

cvachovecj

Excellent! cnorborg‌ is our star!

I must admit I didn't realize until today that the block remediation enhancement of NCM 7.4 could be used for thing like this.

Jiri

cnorborg

Have to keep you guys on your toes!! :-) Teach you how to use your product once in awhile... :-D

Hopefully this will illustrate how we need this type of feature. Not only to check that something exists (ie: NTP server, SNMP community, etc), or that something specific doesn't exist (ie: "public" or "private" SNMP community), but that it would also be nice to know that nothing beyond what we specified exists. ie: no new NTP servers, no new SNMP communities... Would be nice to have this without having to hack at it a bit!!