RTN with both ${IP} and ${MESSAGE}

I am running NPM 9.1 and NCM 5.1 on the same box. I am using the syslog server that comes with NPM. I was intrigued by this little nugget from the NCM 5.1 Realease Notes (pasted below). I want this functionality but I can't seem to get it to work. Here's the message I get:

2/3/2009 8:04:34 AM

IP Address 10.10.10.10 59196: Feb 3 08:04:31 EST: %SYS-5-CONFIG_I: Configured from console by a1mxff42 on vty0 (10.10.10.10) doesn't exist in Cirrus database
___________________________________________________________________________

Realtime Change Detection

As of version 5.1, you can now declare the following new variable when triggering the ConfigAutoDownload.exe:

Message: Includes the Syslog message in the realtime detection notification. If your Syslog message contains the user making the change, the user name is included through the use of this variable.

To implement this variable, use the following format: <code><i>Path</i>\Configuration Management\ConfigAutoDownload.exe ${IP} ${Message}.

Where, <i>Path</i> declares the location of the Configuration Management folder. For example, "C:\Program Files\SolarWinds". If the path contains spaces, enclose the path section of the statement in quotation marks (").

Find more posts tagged with

realtime_change_detection

Accepted answers

All comments

chris.lapoint

There is some inaccuracy in the release notes documentation concerning this functionality.

You'll need to specify the following:

ConfigAutoDownload.exe ${IP}, ${Message}, ${DateTime}

Let me know how this works.

Thanks,

-Chris

kahmeelyon

Chris,

Thanks for getting back to me. Unfortunately this still does not work. It does not seem to be parsing ${Message} correctly. This may be because we timestamp the logs (service timestamps log datetime localtime show-timezone) and your parser is not expecting that? Here's what I see:

Solarwinds, Inc. Orion Network Configuration Manager

Real-Time Configuration Change Detection

___________________________________________________________________________

2/12/2009 7:29:46 AM : Started SyslogJob - 101668 : Job-158159

Config for xxx.xxx.xxx.com has changed (Differs from Last Config)

User Name: 819: Feb 12 07:29:32 EST: %SYS-5-CONFIG_I: Configured from console by xxxxx on vty0 (xx.xx.xx.xx)

2/12/2009 7:29 AM

line vty 0 4 | line vty 0

> exec-timeout 5 1

downloaded and saved Running config

___________________________________________________________________________

2/12/2009 7:29:54 AM : Completed SyslogJob - 101668 : Job-158159

Execution time : 8 seconds

chris.lapoint

Actually, that is the expected behavior. Because we don't currently have the ability to provide a ${Username} macro in Syslog server, we're essentially putting the entire message into the Username field in NCM. We have plans to add parsing of this message in a future version.

ecornwell

We time stamp our logs as well and the message looks the same for us.

I have to say, I'm very excited about this!!!

ecornwell

I have another question about this.... I copied the same line that I use for my Cisco devices and tried to use it for my Juniper firewalls but I get an error when it tries to run the ConfigAutoDownload the following way, "ConfigAutoDownload.exe ${IP},${MESSAGE},${DateTime}". The log shows:

A valid IP address must be specified when running the ConfigAutoDownload.exe executable.

I also had it log the request to a file and I see the following: IPAddress,Message, Date and time

The IP Address is correct in the log. Is there any reason this would give the error above?