Cisco work change report

[ahmad82pkn]

Hi.

there is something wrong happening in my Cisco works,

if user A makes changes on router and logs out ( no write mem), and then user B logs in and make change and user B do a write mem.

then change audit shows all changes of user A and user B , under user B login ID.

why so? and idea:)

whereas ut should have shown user A changes in user A account. and user B changes under user B account.

[Michel Hegeraat]

It is not certain if ciscoworks will know who made the changes, after all, the changes were made using TELNET/SSH/console, not a user logged in on ciscoworks!!

And ciscoworks is not the AAA device giving authentication or authorization to user A and B on the device.

The only time cisoworks might know about the change is it the device sends a SYSLOG message when user A or B comes out of the 'Config' mode, or when a polling or collection schedule happens to take place.

Within the syslog messages there is only enough info to make out who may have changed something, but not what was changed.

I always wondered why ciscoworks does not have a 'link' to ACS to 'hear' about these changes being made on a device.

Merry Christmas,

Michel

[ahmad82pkn]

thank you for your detailed reply.

is it possible in cisco works to arhcive the config of particular device when it receives syslog message that some one logged out of config mode?

Like at this time, my devices config is getting archived every day on schedule time.

what i want is, when ever someone logs out of config mode, Cisco works does receive the syslog message that someone logged out of config mode. i want cisco works to immediately archive the configuration at that time.

is it possible? if yes how?

[Michel Hegeraat]

This already happens by default if the SYSLOG is configured on the device to be send to ciscoworks.

If you look for 'automated actions' in the help, then you will find it

Cheers,

Michel