04-12-2013 11:21 AM - edited 04-12-2013 11:22 AM
Snapshots are generated either by a user defined periodic task, which is set up in NA or snapshots are triggered by Change Detection defined by the specific Driver for the device or defined by the customer/user of NA.
Change Detection is defined in the NA 9.21 User's Guide around Page 43.
NA uses several methods for detecting changes to a device configuration, including:
• Syslog messages
• AAA log reading
• Internal proxy
From these methods, NA uses a number of different inputs to determine who actually made
a change on the device. This information provides the most likely user responsible for the
change. In order of priority, the following information is used:
• User who scheduled a password change that was run on the device.
• User who scheduled a software update that was run on the device.
• User who deployed a configuration to the device.
• User who ran a script on the device.
• User who connected to the device via NA’s proxy.
• User information gathered from AAA logs.
• User information parsed out of a syslog message.
NA assigns a change attribution to a device interaction that is higher in the priority list. For
example, if a user schedules a password change while another user had proxied to the
device during the same time period, if a change had been detected, that change would be
assigned to the user who had scheduled the password change.
To view configuration changes on a device:
1. On the menu bar under Devices, click Inventory. A list of all currently managed
2. Click the device for which you want to view configuration changes. The Device Details
3. From the View drop-down menu, click Configuration Changes.
4. In the Changed By column, click the Details link. The User Attribution Details page
The NA Core Syslog server forwards Syslog messages to the NA Core that match a list of
Syslog patterns for the drivers that are in-use on the system. When the Discover Driver
task runs, it updates the list of Syslog message patterns to look for, and then instructs the
NA Syslog server to update its list of Syslog message patterns.
This should get you pointed in the right direction.
Thank you for your question.
Have an Insouciant Day!
06-06-2013 12:02 AM
While browsing through this thread, one question popped up in my mind. Hope you would be kind enough to correct me here.
NA discover driver task only updates syslog matching patterns only when NA driver pack is updated ?
Is that right ? or we need to SCHEDULE discover driver task for updated syslog pattern ?
I am asking this because in our deployment we haven't configured any discover driver task as I think it was unnecessary to schedule. And our NA detects changes by syslog.
Kindly reply back if any explaination or clearity is rquired.
Thanks in advance