About dfaught

dfaught · ‎04-12-2017

I have a requirement to be PCI compliant for some devices, which means retaining the syslogs, maybe in an archive form, for 12 months. I was told by Cisco Support that Cisco Prime Infrastructure will not do this (although LMS does) and I should look for some other product for that capability.

dfaught · ‎04-12-2017

We are implementing Role-Based CLI Access across a number of routers and switches using RADIUS authentication and authorization. When authentication occurs, the RADIUS server also returns the proper view name for the Role-Based authorization, so the user is put immediately into that view and has capabilities according to that view's configuration on the client device. This all is working just fine. But there is an issue with Cisco Prime LMS 4.2.4 NetConfig. Cisco Prime has credentials on the RADIUS server that give it both privilege level 15 and view "root", which means that it is put immediately into view root when it logs into client devices. When trying to run a NetConfig job, whether in config mode or enable mode, the job apparently always tries to enter enable mode, which is unnecessary, and fails with the error ERROR:CONFIG_CDL1031:Transport session to device failed Could not enter ENABLE Mode from USER Mode on Device. This has also been tried with Cisco Prime Infrastructure 3.1.1 and fails with the same type of error. In both LMS and Infrastructure, the configuration job fails when trying to go to enable mode from user mode even though it is already in view root when it first logs in. Why is it doing this unneeded step and how can this step be skipped? Thanks for any help. Dave

dfaught · ‎06-13-2016

The sudo command does not work for me. I get an error that says sysadmin is not in the sudoers file. I'm a little curious why it looks like it works for you without entering the sysadmin password again. Or so it appears.

dfaught · ‎05-06-2016

PCI rules say that logs must be retained for a year. Can PI do this for syslogs? The only retention setting for syslogs that I see has a maximum period of 90 days.

dfaught · ‎05-06-2016

This problem appears to have come back after upgrading to PI 3.1.0. My boss is once again inundated with "Configured from console ...: messages.

dfaught · ‎05-06-2016

Yes, the shell command is there now. For PI, it used to be the root command and for LMS it has always been the shell command. The shell command on PI gets you to a bash shell but does not have root authority. Try to do a simple ls command right after getting into the PI shell.

dfaught · ‎05-05-2016

I opened a TAC case about this and was told that root access was taken away by design for additional security. So far, I have not come up with a positive reason that I need it, but I am a little surprised that it was just taken away instead of going to something like sudo. Just so you know.

dfaught · ‎09-03-2015

Thanks Marvin, It looks like I should check out Cisco Active Advisor further. I do see that Active Advisor does not support Nexus or UCS devices, which I need to include. I have mixed feelings about this, but I'm a practical guy. Shouldn't this same kind of functionality already be there in PI? What was PI for again? Managing my Cisco devices? Isn't this one of the primary activities in managing my devices? Thanks again, but I think I need to pursue a PI solution, possibly augmented by Active Advisor. Regards, Dave

dfaught · ‎09-02-2015

How do I get a proper inventory report with the correct serial number for each device that is needed for a maintenance contract? I would actually prefer a way to do this with the REST API, but a report will work. Thanks for any help. Dave

dfaught · ‎07-28-2015

Hello Ernesto, I am a little hesitant to implement your steps because it appears to me that the /var/log/syslog_info file is an OS-level file and therefore is not really controlled by the log rotation process in LMS. The /var/log/messages file in your document is, in fact, rotated by an OS process using the /etc/logrotate.d and /etc/logrotate.conf and should probably not be put under LMS control. But now I am unsure how to proceed. Since the /var/log/syslog_info file is an OS-level file, why was it not included in the /etc/logrotate.d files? And if it is now added into the /etc/logrotate.d configuration, how will that affect the LMS SyslogCollector subscription? Or, if the /var/log/syslog_info file is put into the LMS logrotation process, how will the OS syslogd process find out that the file has changed? Thank you for your help. Dave

dfaught · ‎07-27-2015

On the LMS 4.2.4 soft appliance, the file /var/log/syslog_info is about 26 gigabytes. I think it should be smaller. What should I do? I did a Syslog Forced Purge, which says it completed successfully, but this file appears unchanged. Thanks for any info, Dave

dfaught · ‎07-14-2015

I am running both Cisco Prime LMS 4.2.4 and Cisco Prime Infrastructure 2.2.2 in parallel. THey have both been running for several months now. I suspect that there are number of others doing this or something pretty close. Is there a nice simple automated way to make sure that the same wired devices are in both? When PI was first brought up, the inventory was migrated from LMS and I have tried to make sure that the inventories on both stay updated. How can I make sure? Thanks for any help.

dfaught · ‎06-05-2015

Can someone explain to me how this bug is marked as fixed but there is no available fix for it?

dfaught · ‎03-17-2015

I would love to have an option to shut off this particular test because the large volume of these events caused by exiting config mode obfuscates the tracking and auditing of real config events, which could also be done by PI. Dave

dfaught · ‎03-17-2015

More information. I have a few old devices that are still using telnet instead of ssh, and also have a packet capture appliance that captured all of this discovery traffic from PI. I filtered out the trace from one of these telnet devices and found the following sequence among a bunch of different show commands: config t ip nbar ? ip nbar exit In the particular case of this device, the responses to the ip nbar config commands indicated that the device is not capable of doing nbar. Your mileage may vary. Dave

dfaught · 04-12-2017

I have a requirement to be PCI compliant for some devices, which means retaining the syslogs, maybe ...

dfaught · 04-12-2017

We are implementing Role-Based CLI Access across a number of routers and switches using RADIUS authe...

dfaught · 06-13-2016

The sudo command does not work for me. I get an error that says sysadmin is not in the sudoers file....

dfaught · 05-06-2016

PCI rules say that logs must be retained for a year. Can PI do this for syslogs? The only retention ...

dfaught · 05-06-2016

This problem appears to have come back after upgrading to PI 3.1.0. My boss is once again inundated ...

dfaught · 05-06-2016

Yes, the shell command is there now. For PI, it used to be the root command and for LMS it has alway...

dfaught · 05-05-2016

I opened a TAC case about this and was told that root access was taken away by design for additional...

dfaught · 09-03-2015

Thanks Marvin,It looks like I should check out Cisco Active Advisor further. I do see that Active Ad...

dfaught · 09-02-2015

How do I get a proper inventory report with the correct serial number for each device that is needed...

dfaught · 07-28-2015

Hello Ernesto,I am a little hesitant to implement your steps because it appears to me that the /var/...

dfaught · 07-27-2015

On the LMS 4.2.4 soft appliance, the file /var/log/syslog_info is about 26 gigabytes. I think it sho...

dfaught · 07-14-2015

I am running both Cisco Prime LMS 4.2.4 and Cisco Prime Infrastructure 2.2.2 in parallel. THey have ...

dfaught · 06-05-2015

Can someone explain to me how this bug is marked as fixed but there is no available fix for it?

dfaught · 03-17-2015

I would love to have an option to shut off this particular test because the large volume of these ev...

dfaught · 03-17-2015

More information. I have a few old devices that are still using telnet instead of ssh, and also have...

Date Registered	‎06-04-2004 07:56 AM
Date Last Visited	‎07-23-2018 12:37 PM
Total Messages Posted	27

I have a requirement to be

Role-Based Access and Cisco Prime NetCo...

The sudo command does not

PCI log retention in Prime Infrastructu...

This problem appears to have

Yes, the shell command is

No root access after Prime Infrastructu...

Thanks Marvin,It looks like I

Cisco Prime Infrastructure 2.2 inventor...

Hello Ernesto,I am a little

LMS 4.2.4 /var/log/syslog_info file is ...

Sync LMS 4.2.4 and PI 2.2.2

Can someone explain to me how

I would love to have an

More information. I have a

I have a requirement to be

Role-Based Access and Cisco Prime NetConfig

The sudo command does not

PCI log retention in Prime Infrastructure?