Quantcast
Channel: THWACK: Message List - Network Configuration Manager
Viewing all articles
Browse latest Browse all 8827

Re: Trigger alert when configuration changes happens

$
0
0

Actually, you probably could do this in a number of different ways, but it wouldn't be easy, it would involve a bit of effort.  The problem is that the trap manager has a few options to it, and none of those are to send an alert, so you can't use the alert timers and such out-of-the-box to do what you want.   And there is no way to delay an action on it either, unless setting the trigger threshold to "suppress alert actions until at least X traps matching this rule are received in a X (second/minute/hour) time window" could be done to do that.  You could try setting it to "at least 1 trap" and "within a 1 hour" time period and see if that works.  I'm guessing once the one trap is received that it will stop the timer though.

 

So, the other ways of handling it would have to involve the other action types.   The ones that might be useful are "log the trap to a file", "windows event log", "execute an external program", "execute and external vbscript"...   You might be able to use a couple others in even more obtuse ways.   If you're a programmer or good with VBScript, one of those two might be a decent way to do it, maybe set a custom field in the DB and have an alert work off that value somehow, probably would need to do some programming with logging it to a file also. 

 

One that might not require any programming on your part could be the "windows event log" where you could log the config change to the event log.  Then, using Solarwinds free "Windows Event Log Forwarder" you would forward those event logs from that server into the syslog's of the Solarwinds server (probably itself) and create a simple alert based on the syslog message coming in.

 

The problems with all of these that I see is that you get a LOT of traps saying the config has changed when it really hasn't.   When this happens Orion downloads a copy of the config and only keeps a new one if it has actually changed.  I would think you'd want the alerts based on this, not on the syslog traps.   If you go to your main NCM page, you can see in the NCM events how it says "Change Detected - Saved Config for XX" or "No Change Detected - Discarded...".     So, that actually brings up another someone complex method of doing this, an advanced SQL query alert on the table where this info is stored.   This message is stored in the NCM_Audit table in the Details column.  You also have the DateTime that this was logged.   So, if you checked every 15 minutes to see if a message like this had been logged, and checked the time interval of between 75 minutes ago and 60 minutes ago, you should be able to produce alerts like this.  Or, alternatively check for the last minute for alerts like this and use the delay feature in alerting to hold onto the alert for an hour.   A query similar to this might do...

 

SELECT TOP 1000 * FROM [dbo].[NCM_Audit]

WHERE (DateTime > DATEADD(minute, -961, GetDate())) AND (DateTime < DATEADD(minute, -60, GetDate())) AND (Details LIKE 'Change Detected - Saved%')

 

The only problem is you might miss a couple due to them being right on the cusp of your timeframe and the checks being delayed a bit.   But with a bit of work you could probably do it...

 

Now, this would ONLY delay the email or whatever alert you sent out, the config would be backed up immediately.  Of course you don't know if the config actually changed until you back it up either, so...

 

Just wanted to illustrate that it probably could be done, but it all depends on what you want and how much work you want to do to get it done.

 

For that matter, if you're in to writing custom apps or scripts you could probably write one that instead of using the RTCD binary that SW provides us for real time change detection, you could write your own that takes the info and stores it somewhere and an hour later calls the actual RTCD binary with the correct arguments.   There ya go, quite a few potential ways to do it!!


Viewing all articles
Browse latest Browse all 8827

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>