06-30-2011 05:37 AM
Hi, I am trying to get RME to email me when a change is made on one of our devices. Currently the email is generated only when a change is made through CiscoWorks (NetConfig etc) and not when a change is made directly on the device from an SSH session. The device that has the change made logs a syslog to CiscoWorks server but this doesn't show up in the Audit report.
In older versions of CWLMS you had to direct Change Audit th look at syslog messages but the Cisco documentation seems to hint tat this is now an automated process. I've run a debug on the ChangeAudit.log but nothing appears in it.
Can anyone help?
Thanks in advance.
06-30-2011 06:07 AM
Hi ,
Syslog clients or message suppliers are Cisco devices that have been configured to log messages to RME. Syslog Analyzer receives messages from routers and other Cisco devices configured to send messages to the syslog server in RME. The messages are sent either directly or through a remote syslog collector installed in the network. These messages originate from the device in response to some activity that affects it.
Change Audit clients are RME applications that record change information. Applications, such as Software Management, send messages to Change Audit when they make a change to the network, for example, uploading a new Cisco IOS image.
For more information , you can check the below link:
As per my knowledge the logic for change Audit is same till the lates version of cisco works.
I am not sure but may be you are referring to syslog Automated action .
For more information , you can check the below link:
I hope this will help you!!
Thanks
Afroj
06-30-2011 06:52 AM
Hi thanks for your reply. What I'm expecting is to see any config change to be displayed in the Change Audit reporting. According to the documentation this relies on RME acting on a syslog generated by a device when a change has been made on that device. Unfortunately this isn't happening at present.
06-30-2011 03:07 PM
Hi,
As I mentioned before ,the changes done on a device Via Cisco works will only comes under Change Audit and an email notification is send on that basis.
----
Change Audit tracks and reports changes made in the network. Change Audit allows other RME applications to log change information to a central repository. Device Configuration, Inventory, and Software Management changes can be logged and viewed using Change Audit.
RME applications write change records to Change Audit. Change Audit stores these records in the log tables (summary and details) for later use with reports. For example, Software Management records a change for each completed device upgrade. If a job has ten devices, then Software Management writes ten entries to the Change Audit log, but the Change Audit report shows only one job with ten devices. You can then access individual device information.
Each application writes its own change records to Change Audit. For example, in Inventory you can set inventory change filters to filter out all kinds of information for different device types. Change Audit record maintenance is controlled by the Change Audit Delete Change History option.
You can convert change records into SNMP V1 traps and forward them to a destination of your choice. This allows system administrators to forward critical network change data to their own NMS.
You can define automated actions (e-mail and automated scripts) on creation of change audit record. The automated action gets triggered on creation of the change audit record.
Thanks
Afroj
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide