NCM Report Auditor Report for Conf T

Question

We are looking to write an auditor report that will show anytime a user uses conf t and/or write mem. We would like the report to collect all any such commands for the previous day and the report would be emailed around 8am.

What would be the best way to handle this? I am assuming that this could be done as we are using Real-Time Config Change Detection

Thanks in advance

sja · Answer

Yes its different from vendor J or C :-)

Juniper is easy

syslog

interactive-commands info;

Configuring Auditing of Configuration Changes - Technical Documentation - Support - Juniper Networks

Can be done with Cisco TACAS?

But If you don't need real time change/backup ...

Try that work around and filter CmD for "conf t"?

Re: Use Solarwinds to Track CMD History on Cisco Devices

wluther · Answer

spyfly​ Are you using Kiwi Syslog, and forwarding the "good" messages, or just sending everything directly to your primary SolarWinds server? If you are using Kiwi, I THINK it allows for some basic scripting, which I THINK you can use to parse variables from messages... If so, that should give you the ability to pull the different header values from the messages. Otherwise, you could run some SQL magic on the backend, and likely accomplish the same results. Would those be valid options to explore? Also, if what you seek does not already exist, you should create a feature request. It looks like Mr. Peterson is no longer available, however, jeff.stewart​​ might be able to point you in the correct direction.

spyfly · Answer

wluther​ I am not sure with the Syslog report if I can get what I need the report will need to have the following headers

Date     Time     User Name(user that made the change)     Node IP Address     Node Name     Command Ran

I was hoping there was an out of the box report for NCM that I could modify but it appears most of the NCM Reports are built around configurations and not around commands.