NetConfig shows partial fail on SSH devices

[GeorgeLarson]

Using LMS 2.5

When I use Netconfig->SNMP Community on SSH devices to change the RO string, I get a partial failure that reports it could not find the old string. When I check the devices, the old string is gone and the new string is present. So it seems to work, but am wondering why Netconfig reports it as a partial failure. Is this due to SSH, or a bug?

[Joe Clarke]

You would need to look at the job log after enabling ConfigJob debugging via RME > Admin > System Preferences > Loglevel Settings. This log should contain any CLI errors that were encountered trying to remove the old string, or any internal CiscoWorks problems.

The job log can be found under /var/adm/CSCOpx/files/rme/jobs/NetConfigJob/ on Solaris or NMSROOT\files\rme\jobs\NetConfigJob\ on Windows.

[GeorgeLarson]

Thanks for the info. It was currently set to a logging level of info. I changed it to debug and am running a new netconfig. Will let you know what I get.

[GeorgeLarson]

OK, tried it again. Here is what the job results show.

*** Device Details for PRL002CE02IMS01 ***

Protocol ==> SSH

Message: Deploy command partially failed

no snmp-server community ********

Cannot find community TestIt

PRL002CE02IMS01(config)#

snmp-server community ******** ro 6

xxxx(config)#

I am attatching the log.

Like I said. It appears to work and the old string is gone and the new string is there. Must be a bug.

[Joe Clarke]

This seems pretty cut and dry. What did the running-conig look like before running this Netconfig job? The error being returned is from IOS. IOS is saying that it cannot find the community string "TestIt" in the running-config.

[GeorgeLarson]

The string was there and I did a credential Verification, and manually looked at it by doing a show running | include snmp-server and saw the correct old string before doing the netconfig. So yes it is there, and Netconfig is actually finding it and replacing it, it just doesn't know that it is.

[Joe Clarke]

No, it's trusting what IOS says. What you should try is performing the same exact command manually, and see if you get the same result. that is:

no snmp-server community TestIt

[GeorgeLarson]

Thought of that and tried manually and it works fine, no error like in the Netconfig output.

I then changed it manually on the switch. Went and change the DCR to reflect the new RO SNMP string, did a Device Credential Verification and that was fine. I then did another NetConfig to change it once again and got the same error results.

[Joe Clarke]

Since the log you attached has no debugging enabled, I cannot say for sure if RME is sending any other commands prior to the "no snmp-server community" command. However, I can say that IOS is providing the "Cannot find community" error, and that error will only be seen if the community string cannot be found in the internal lookup.

You might consider opening a TAC Service Request for this, and providing the Netconfig debug log as well as a show run and show ver from this device so additional analysis can be done.

[GeorgeLarson]

I don't understand. It turned on Debug, why does the log not have it. Did I send the wrong type of log file. There were several files in the job directory.

[Joe Clarke]

The log file is the correct file, but it has no debug. You need to enable ConfigJob debugging, then run a new Netconfig job.