I've configured this as per the Cirrus docs but it doesn't seem to be working, this is whats being received in the Syslog server 03:45 PM 192.168.xx.xx Notice 34: 022487: %SYS-5-CONFIG_I: Configured from console by johill on vty0 (192.168.xx.xx) 03:43 PM 192.168.xx.xx Notice 33: 022486: %SYS-5-CONFIG_I: Configured from console by johill on vty0 (192.168.xx.xx) Everything is exactly as it should be. Any help would be much appreciated. Thanks Jon

Unfortunately, this didn't make 5.0. This is still scheduled for a later release.

I know this is an older post but I was wondering if the ability to get notified of who made the change along with the change was added it 5.0 or if it is still scheduled in a later release.

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Real-Time Change Detection Problem

jonchill

I've configured this as per the Cirrus docs but it doesn't seem to be working, this is whats being received in the Syslog server

03:45 PM	192.168.xx.xx	Notice	34: 022487: %SYS-5-CONFIG_I: Configured from console by johill on vty0 (192.168.xx.xx)
03:43 PM	192.168.xx.xx	Notice	33: 022486: %SYS-5-CONFIG_I: Configured from console by johill on vty0 (192.168.xx.xx)

Everything is exactly as it should be.

Any help would be much appreciated.

Thanks

Jon

Find more posts tagged with

cirrus

backup_configuration

Accepted answers

All comments

Haley

What information is displayed in the Real-Time Config Change Detection log? You can determine the location of the log by selecting File->Settings->Real-Time Change Detection->Config Change Settings. You will also want to ensure that you have double quotes around the entire path to the file, for example, "C:\Program Files\SolarWinds\Configuration Management\ConfigAutoDownload.exe" 10.199.1.8, and ensure your Syslog Message Pattern has astericks around the message.

rizwan2392

hi haley,

im also having the same problem. I have configured syslog server for specific devices which are added into cirus as well. Now the probelm is syslog server does trigger but cirus does not generate real time change notification email.

what could be the possible cause? i have double quoted the path as u mentioned above, yet it dosent seem to work. can you help me out in this regard??

-- Rizwan

rizwan2392

hi, finally the notification started working. but now im having the problem that in the email that is sent by cirus, it shows the changes that have been made but does not shows the user/IP Address through which user logged into the device to make changes.

Is there any option that is missing or what else?

Haley

The current Cirrus Configuration Manager Real-Time Config Change Detection pulls the IP address from the Syslog Message, downloads the config, compares it to the last config or baseline config (depending on your setting), logs the results of the backup and any recorded changes, and optionally sends out an email of the changes. You should be able to view which user logged into the device to make the change within the Syslog Message stored in Orion.

In a future release of Cirrus, we plan to incorporate the ability to determine who made the configuration changes within Cirrus.

Would you also be able to post one of the Syslog Messages related to config changes you are receiving within Orion? I am interested in viewing the formatting of the message.

rizwan2392

Haley, following is the format of syslog message:

8/9/2007 5:49 PM : SYS-5-CONFIG_I 621676: Aug 9 12:49:38.067: %SYS-5-CONFIG_I: Configured from console by muhammadrizw on vty0 (172.16.254.24)

Well it does show the user/ip who made the changes but is there any possibility that Cirus Email Notification shows the same information??

Haley

Thank you for sending the Syslog Message.

The ability to pass information in addition to the IP address of the device whose configuration was modified to Cirrus is a feature we are planning for a later Cirrus release. Currently, we recommend you pull this information from the Orion Syslog Server.