How to debug NACM-rules

[DTtb]

Hi all,

I had problems with some NACM rule definition and wanted to debug it.

I am doing a REST-API-call to NCS 4.7.2 instance and would like to see, which NACM rules were hit during the API-call, or maybe no NACM rule were hit due to misconfiguration.

Does exist some capabilities to debug it?

Thanks.

[vleijon · Accepted solution]

From the NSO admin guide: “For the rule processing to be written to the devel log, the /ncs-config/logs/developer-loglevel entry in ncs.conf must be set to trace.”

It also says “log-if-permit – If this leaf is present, an entry is written to the developer log for a matching request also when action is permit. This is very useful when debugging command rules.”

I haven’t tried either of these options, but hopefully it is enough for your case.