Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

ciscowoks to send alert when config change

Hi,

How can I set ciscoworks to send the notification email to admin when any of devices configuration had been change and change by whom ?

Thank you,

Regards,

Jan.

8 REPLIES
Cisco Employee

Re: ciscowoks to send alert when config change

You can do this by configuring an Automated Action to send an email when a config change syslog message is sent from a device. To configure this, go to RME > Tools > Syslog > Automated Actions. The syslog filter strings you want to use to capture config changes for all devices are:

*-*-*-RESTART:* RESTART-*-*-*:* SYS-*-5-ONLINE:* *-*-*-CONFIG_I:* SYS-*-5-RELOAD:* CONFIG-*-*-*:* *-*-*-CONFIG:* OIR-*-6-INSCARD:* Nodemgr-*-5-CE:*REBOOT* CPU_REDUN-*-6-BOOTED_AS_ACTIVE:* CPU_REDUN-*-5-SWITCHOVER:* CPU_REDUN-*-6-RUNNING_CONFIG_CHG :* CPU_REDUN-*-5-RCSF_SYNCED:* CPU_REDUN-*-6-STARTUP_CONFIG_CHG:* CPU_REDUN-*-5-STARTUP_CONFIG_SYNCED:* SNMP-*-5-COLDSTART:* SYS-*-6-CFG_CHG:*telnet* SYS-*-6-CFG_CHG:*Console* *-*-*-OIR:* SYS-*-6-CFG_CHG:*SNMP* SYS-*-6-CFG_CHG:*ssh* SNMP-*-5-CONF:* PORT-*-5-CONF:* CHAS-*-5-CONF:* DIAG-*-5-CONF:* PIX-*-5-111005:*

New Member

Re: ciscowoks to send alert when config change

Thanks for your advice. Please also tell me in detail how can I add that filter and email setting.

Thanks,

Jan

Cisco Employee

Re: ciscowoks to send alert when config change

From the screen I mentioned previously, click the Create button to create a new Automated Action. Keep the All Managed Devices radio button selected, then click the Add button and type in the facility, sub-facility, severity, and mnemonics from the list of message filters I specified. The format is:

facility-subfacility-severity-mnemonic

New Member

Re: ciscowoks to send alert when config change

If I want to add what device, what config had been changed and who change it to the email message. What should I add ?

Regards,

Jan.

Cisco Employee

Re: ciscowoks to send alert when config change

The syslog message will contain the device name and who made the change (provided the device is using AAA), but it will not contain the actual config change. There are other syslog messages that can be enabled on the device that will show this. If your device supports it, you can enable config change logging (IOS devices only):

config t

archive

log config

The messages will have the header:

PARSER-5-CFGLOG_LOGGEDCMD

New Member

Re: ciscowoks to send alert when config change

I created automate action as listed but ciscoworks send email for every syslog message occured. How to correct this ?

Cisco Employee

Re: ciscowoks to send alert when config change

You most likely have made your filter too loose. Please post a screenshot of your action details.

New Member

Re: ciscowoks to send alert when config change

Thanks for your advice.

Regards,

Jan

153
Views
0
Helpful
8
Replies
CreatePlease to create content