cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1310
Views
5
Helpful
1
Replies

How to debug NACM-rules

DTtb
Level 1
Level 1

Hi all,

 

I had problems with some NACM rule definition and wanted to debug it.

I am doing a REST-API-call to NCS 4.7.2 instance and would like to see, which NACM rules were hit during the API-call, or maybe no NACM rule were hit due to misconfiguration.

 

Does exist some capabilities to debug it?

 

Thanks.

1 Accepted Solution

Accepted Solutions

vleijon
Cisco Employee
Cisco Employee
From the NSO admin guide: “For the rule processing to be written to the devel log, the /ncs-config/logs/developer-loglevel entry in ncs.conf must be set to trace.”

It also says “log-if-permit – If this leaf is present, an entry is written to the developer log for a matching request also when action is permit. This is very useful when debugging command rules.”

I haven’t tried either of these options, but hopefully it is enough for your case.

View solution in original post

1 Reply 1

vleijon
Cisco Employee
Cisco Employee
From the NSO admin guide: “For the rule processing to be written to the devel log, the /ncs-config/logs/developer-loglevel entry in ncs.conf must be set to trace.”

It also says “log-if-permit – If this leaf is present, an entry is written to the developer log for a matching request also when action is permit. This is very useful when debugging command rules.”

I haven’t tried either of these options, but hopefully it is enough for your case.