Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Network Configuration Manager - Manage Policy Report Rules

Hello,

I've recently configured the following policy report rule:

The aim of the rule is to check whether proper SYSLOG server is configured on all Cisco devices. Due to different syntax there are two conditions, namely: "logging 10.172.x.x" and "logging host 10.172.x.x" When I go to Policy Report, I can see that in most cases there's a policy violation although SYSSLOG server is present in a configuration. Can anyone tell me what is the reason for that? Thank you in advance!

Find more posts tagged with

Accepted answers

All comments

wesleykparker

I don't see a reason why your rule shouldn't work if it truly is configured as above. I can offer this though. If you use the following string and change your String Type to Regex, you would only need one line. I know sometimes it gets confusing about whether to use AND or OR, especially when doing negative lookups. This singular regex string would cover both cases of string lookups.

^logging (host |)10.172.x.x

If you truly want to figure out why the rule as written isn't working, you'll have to work backwards from your rule and and the configs you are running them against. I assume you've tried using the test feature from within the rule creation screen.

shyde

I have had issues when using string type for matching. Regex never fails for me for matching properly.

If you need a converter and aren't familiar with Regex you can try this: http://www.regexlab.com/wild2regex

I like wesleykparker approached to have one Regex to match both though I haven't done this due to limited experience with Regex so I just use the converter. I find string matching runs into a lot of problems here especially with large multiline code match like a full ACL.

Agree with wesleykparker the test button on the rule configuration page is key. I typical test against text first just copy paste the text that you expect to pass and fail verify that works. Next if that's working but a config file is still not then run it against the config file. If you are using a defined config block and not having success try it without to see if that's the issue. I have had issue when I setup a config block in the past that appeared twice (I didn't realize at first) and in only one of the two the config was present. In my case adjusting that config block fixed it.