Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Real-Time Change Detection

I'll be honest that I searched a little but not a lot for the answer to this but I'm hoping someone can help. We are mainly interested in receiving real-time change notifications for only our routers. We create daily change reports for all devices. It appears that the RTCD within NCM is either on or off but I can't specify for it to only be applied to specific devices. I've created some syslog alerts that can notify me that a change has been made on a router but can't provide me with the actual changes like the RTCD notification does. Is there a way for me to use the Syslog alerts to kick off the same "run once" job that the RTCD uses so I can generate the same e-mail for only routers. Or does someone else have a solution using NCM to do the same thing for only specific devices? I certainly think it would be a nice option within RTCD to only select specific devices.

Find more posts tagged with

Accepted answers

All comments

slbrodbeck

There are a few ways to do this I think.

In the Syslog Rule editor, on the general tab, there is a Source IP Address field. You can put in here the IP addresses of the devices. This list can get rather long if you aren't careful.

My solution would be to suggest setting up another syslog server service and have only those devices that you want to capture messages to send them there. Then have it kick off the RTCD event that. You can have multiple syslog server entries per Cisco device. The downside is you probably would need to have another server to run this on.

tkelly

I see what you're saying here but it seems like an awefully unnecessary way of doing things. We actually have our syslogs sent to two servers now so it would be an option. I think my only solution would be to only receive the router syslogs to Solarwinds so that RTCD would key off that but that doesn't seem like a real solution to me. I do generate alerts now through the Syslog Alerts but it doesn't include the actual change comparison that RTCD does. Since RTCD just creates a run once job it would almost seem like that is something I should be able to do using the syslog alerts. Thank you for your response.

ecornwell

There are a couple other options as well depending on how you name your devices and how you setup the logging facility. If you have your devices in DNS and use a special naming pattern for your routers then you could use that as a filter option. Also, you could use the different facility levels in syslog to help seperate your devices. When we first setup syslog we decieded that switches would report on one facility and routers on another. It has worked rather well for us so far.