LMS4.2.5 ChangeAudit, who changed?

[STEFFEN NEUSER]

Hello,

Is there a possibility in LMS change audit to get out who by means which user did the changes.

If I go deeper into a syslog config change report, I get a Message Box with one interesting field named "description" with content:

configured from [char] by [char].

is it possible to get [char] translated?

thx for hints in advance, steffen

[AFROJ AHMAD]

Hi Steffen,

Did you tried {Admin > Network > Notification and Action Settings >ChangeAudit Automated Actions }

?

this has an option to get email \trap\script  on the generation of such actions.

Thanks-

Afroz

***Ratings Encourages Contributors ***

[STEFFEN NEUSER]

Hi afroz, 

This is not what I mean. I want to know which user did which changes in the Change Audit.

Source of information for change audit is primary Syslog and the source of information of the "who"- part could be a correct parsing of the message text: Configured from console by admin on vty0 ....

My expectation on LMS is to correctly parse admin and vty0 from the message text and replace the place holders [char] at "configured from [char] by [char]" correctly.

But it doesnt work in my installation and the question is how do I get this working?

Steffen

[Robert Singer]

Hi,

i think you will only able to see who have configured a network device by two options

a) A User used LMS to configure the Device

b) A user logged into a network Device with RADIUS/TACACS / Configure appropiate Start/Stop commands 

if a user connect to a a device managed by LMS without the two option mentioned above, LMS is not able to see it.

Please refer to the admin guide to configure both options. I hope this was informitive for you.

Best regards,

Robert

[STEFFEN NEUSER]

Hi Robert,

Its working now by perhaps coinsidence. I did nothing:). After checking this LMS installation yesterday real local users (no Radius nor Tacacs, no changes by LMS) are shown now instead of N/A in the ChangeAudit.

best regards, Steffen