3 Replies Latest reply on Jul 9, 2014 2:56 PM by HMote

    Email when Cisco device is accessed


      Is there a way to have a Cisco device email when enable or config is accessed on device?

        • Re: Email when Cisco device is accessed

          I've achieved this in the past by monitoring for syslog messages (using the Solarwinds Syslog Viewer) which contain the relevant message text. An action is then set to fire an email alert containing the original syslog message.

          • Re: Email when Cisco device is accessed

            *** Disclaimer ***

            This was only tested on a Cisco ASA, accessed via ASDM and SSH but here's what I found...

            *** End Disclaimer ***


            Here's what I came up with as far as an nDepth search for finding when someone is entering a configuration terminal.  I'd assume something similar could be done for enable and also other devices by updating/adding the ToolAlias.



            One important thing to note is that the Detection IP will be filled based on whichever interface the LEM node is setup.  You can find your nodes at 'Manage > Nodes'.  I was testing with an ASA and my LEM node is setup on an interface say but when I access my firewall, for configurations, I access it via, for example.  The Detection IP in this case would be instead of since LEM is not monitoring  Although, you will more than likely refer to the firewall as, since syslog is setup on the interface of the firewall, you will get logs detected by  This just something to note, which I was confused by at first.


            Here's a link to a good Solarwinds produced video on setting up email alerts (rules):  Creating Rules in Your SolarWinds Log & Event Manager Console - Videos | SolarWinds


            Hopefully this helps or at least gets you going on the right track!  Thanks,