06-22-2008 11:09 PM
Hi,
How can I set ciscoworks to send the notification email to admin when any of devices configuration had been change and change by whom ?
Thank you,
Regards,
Jan.
06-22-2008 11:38 PM
You can do this by configuring an Automated Action to send an email when a config change syslog message is sent from a device. To configure this, go to RME > Tools > Syslog > Automated Actions. The syslog filter strings you want to use to capture config changes for all devices are:
*-*-*-RESTART:* RESTART-*-*-*:* SYS-*-5-ONLINE:* *-*-*-CONFIG_I:* SYS-*-5-RELOAD:* CONFIG-*-*-*:* *-*-*-CONFIG:* OIR-*-6-INSCARD:* Nodemgr-*-5-CE:*REBOOT* CPU_REDUN-*-6-BOOTED_AS_ACTIVE:* CPU_REDUN-*-5-SWITCHOVER:* CPU_REDUN-*-6-RUNNING_CONFIG_CHG :* CPU_REDUN-*-5-RCSF_SYNCED:* CPU_REDUN-*-6-STARTUP_CONFIG_CHG:* CPU_REDUN-*-5-STARTUP_CONFIG_SYNCED:* SNMP-*-5-COLDSTART:* SYS-*-6-CFG_CHG:*telnet* SYS-*-6-CFG_CHG:*Console* *-*-*-OIR:* SYS-*-6-CFG_CHG:*SNMP* SYS-*-6-CFG_CHG:*ssh* SNMP-*-5-CONF:* PORT-*-5-CONF:* CHAS-*-5-CONF:* DIAG-*-5-CONF:* PIX-*-5-111005:*
06-22-2008 11:59 PM
Thanks for your advice. Please also tell me in detail how can I add that filter and email setting.
Thanks,
Jan
06-23-2008 12:06 AM
From the screen I mentioned previously, click the Create button to create a new Automated Action. Keep the All Managed Devices radio button selected, then click the Add button and type in the facility, sub-facility, severity, and mnemonics from the list of message filters I specified. The format is:
facility-subfacility-severity-mnemonic
06-23-2008 12:47 AM
If I want to add what device, what config had been changed and who change it to the email message. What should I add ?
Regards,
Jan.
06-23-2008 12:54 AM
The syslog message will contain the device name and who made the change (provided the device is using AAA), but it will not contain the actual config change. There are other syslog messages that can be enabled on the device that will show this. If your device supports it, you can enable config change logging (IOS devices only):
config t
archive
log config
The messages will have the header:
PARSER-5-CFGLOG_LOGGEDCMD
06-23-2008 01:20 AM
I created automate action as listed but ciscoworks send email for every syslog message occured. How to correct this ?
06-23-2008 09:24 AM
You most likely have made your filter too loose. Please post a screenshot of your action details.
06-23-2008 12:09 AM
Thanks for your advice.
Regards,
Jan
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide