RME 4.3.2 Change Audit.

[paulhowlett_2]

Hi, I am trying to get RME to email me when a change is made on one of our devices. Currently the email is generated only when a change is made through CiscoWorks (NetConfig etc) and not when a change is made directly on the device from an SSH session. The device that has the change made logs a syslog to CiscoWorks server but this doesn't show up in the Audit report.

In older versions of CWLMS you had to direct Change Audit th look at syslog messages but the Cisco documentation seems to hint tat this is now an automated process. I've run a debug on the ChangeAudit.log but nothing appears in it.

Can anyone help?

Thanks in advance.

[AFROJ AHMAD]

Hi ,

Syslog clients or message suppliers are Cisco devices that have been  configured to log messages to RME. Syslog Analyzer receives messages  from routers and other Cisco devices configured to send messages to the  syslog server in RME. The messages are sent either directly or through a  remote syslog collector installed in the network. These messages  originate from the device in response to some activity that affects it.

Change Audit clients are RME applications that record change  information. Applications, such as Software Management, send messages to  Change Audit when they make a change to the network, for example,  uploading a new Cisco IOS image.

For more information , you can check the below link:

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.2/user/guide/chgaud.html#wp1031857

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.2/user/guide/chgaud.html#wp1034685

As per my knowledge the logic for change Audit is same till the lates version of cisco works.

I am not sure but may be you are referring to syslog Automated action .

For more information , you can check the below link:

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.2/user/guide/syslog.html#wp1211314

I hope this will help you!!

Thanks

Afroj

[paulhowlett_2]

Hi thanks for your reply. What I'm expecting is to see any config change to be displayed in the Change Audit reporting. According to the documentation this relies on RME acting on a syslog generated by a device when a change has been made on that device. Unfortunately this isn't happening at present.

[AFROJ AHMAD]

Hi,

As I mentioned before ,the changes done on a device Via Cisco works will only comes under Change Audit and an email notification is send on that basis.

----

Change Audit tracks and reports changes made in the network. Change  Audit allows other RME applications to log change information to a  central repository. Device Configuration, Inventory, and Software  Management changes can be logged and viewed using Change Audit.

RME applications write change records to Change Audit. Change Audit  stores these records in the log tables (summary and details) for later  use with reports. For example, Software Management records a change for  each completed device upgrade. If a job has ten devices, then Software  Management writes ten entries to the Change Audit log, but the Change  Audit report shows only one job with ten devices. You can then access  individual device information.

Each application writes its own change records to Change Audit. For  example, in Inventory you can set inventory change filters to filter out  all kinds of information for different device types. Change Audit  record maintenance is controlled by the Change Audit Delete Change  History option.

You can convert change records into SNMP V1 traps and forward them to a  destination of your choice. This allows system administrators to forward  critical network change data to their own NMS.

You can define automated actions (e-mail and automated scripts) on  creation of change audit record. The automated action gets triggered on  creation of the change audit record.

Thanks

Afroj