Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Granular Assignment of Access

I am in the process of evaluating NCM and have been able to figure out most of the settings. I have three big questions I can't seem to figure out:

1) Is is possible to assign a user different access to different groups of devices. For instance if I have a user I want to grant "Engineer" level access to a set of devices and "WebViewer" access to others....is that possible? If so how?

2) I can't seem to find where I can set how long configs should be kept in DB. It appears that configs are also stored on the local filesystem...can those be removed after a certain time as well?

3) I have a multi-vendor network (Extreme, Juniper, Cisco, Nortel, Netscreen, etc) and some of the devices such as Extreme don't have a running and startup config yet when I add Extreme devices they detect as having both so if I turn up nightly backups to pull both..its pulling "both" from extreme even though they don't really have two separate configs. I can't seem to edit the "Supported config types" section under the edit node screen. Can this be changed?

Any help would be appreciated. The rest is pretty straight forward.

Find more posts tagged with

Accepted answers

chris.lapoint

We'll have to check the Thwack record books, but I'm afraid this reply will break your streak ;-)

Sorry for sending you down a wild goose chase. Unfortunately, this means that the only option is to create 2 backup config jobs. One that targets device types (or vendors or whatever attribute you want to key on) that support both runnig and startup configs and one that targets devices types that only support running configs. If you'll edit the job, you'll notice on the Nodes tab you have the ability to specify selection criteria.

All comments

chris.lapoint

1) Is is possible to assign a user different access to different groups of devices. For instance if I have a user I want to grant "Engineer" level access to a set of devices and "WebViewer" access to others....is that possible? If so how?

This is on our roadmap, but this isn't possible in NCM today. It's all or nothing access based on the role provided.

Having said that, if you're also evaluating NPM, we provide an NCM integration module which extends the NPM website. The NPM website allows for settings node limitations and view limitations on accounts which would enable to meet the use-case you described.

2) I can't seem to find where I can set how long configs should be kept in DB. It appears that configs are also stored on the local filesystem...can those be removed after a certain time as well?

There is a purge config job (see Scheduled Jobs > Create new Job) which allows you to specify how many configs you'd like to keep in the database for each device.

3) I have a multi-vendor network (Extreme, Juniper, Cisco, Nortel, Netscreen, etc) and some of the devices such as Extreme don't have a running and startup config yet when I add Extreme devices they detect as having both so if I turn up nightly backups to pull both..its pulling "both" from extreme even though they don't really have two separate configs. I can't seem to edit the "Supported config types" section under the edit node screen. Can this be changed?

Yes, you'll need to edit the Extreme device template using a text editor, which defines the list of available commands. These are found in <install dir>\Program Files\SolarWinds\Configuration Management\DeviceTypes. When you open the Extreme device template, you want to change the Startup command value to be null as shown below.

brian_duvall

Thanks for the quick reply Chris!

brian_duvall

Even after changing the config template for Extreme devices to Null the Startup command name, my extreme switch still shows that it supports startup and running configs. When I pull configs I now get syntax error when pulling startup as the output. I tried removing then reapplying the Extreme template and that didnt fix it either.

pserwe

This is on our roadmap, but this isn't possible in NCM today. It's all or nothing access based on the role provided.
Having said that, if you're also evaluating NPM, we provide an NCM integration module which extends the NPM website. The NPM website allows for settings node limitations and view limitations on accounts which would enable to meet the use-case you described.

To expand on that a little Brian, the workaround for NPM involves setting node custom properties, and the best restrictions so far, are based on custom node properties. It's a little bit around the horn, but basically, I do different groups for access to different devices, then set the users to be restricted based on the contents of the custom property, or different ones for different users.

It's pretty clean, actually. Being a primarily NPM user, it works well for me.