Re: [c-nsp] Syslog Patterns

2012-01-23 Thread Livio Zanol Puppim
My script... (sorry for the portuguese language) You need to execute the command file prompt quiet at configure terminal before running the script. It send the running-configuration to a server (can be TFTP, FTP, SCP, etc...) every time a user enters the configure terminal mode and exit. It

Re: [c-nsp] Syslog Patterns

2012-01-18 Thread Nikolay Abromov
On Tue, Jan 17, 2012 at 11:18 PM, Peter Rathlev pe...@rathlev.dk wrote: On Tue, 2012-01-17 at 20:50 +0200, Nikolay Abromov wrote: I haven't read what the rest of the guys suggested about this topic but this is pretty easy. A bit ironic... I read your question and answered. I don't see

Re: [c-nsp] Syslog Patterns

2012-01-18 Thread Peter Rathlev
On Wed, 2012-01-18 at 16:05 +0200, Nikolay Abromov wrote: On Tue, Jan 17, 2012 at 11:18 PM, Peter Rathlev pe...@rathlev.dk wrote: On Tue, 2012-01-17 at 20:50 +0200, Nikolay Abromov wrote: I haven't read what the rest of the guys suggested about this topic but this is pretty easy. A

Re: [c-nsp] Syslog Patterns

2012-01-18 Thread Phil Mayers
On 18/01/12 14:26, Peter Rathlev wrote: My own experience is that there is no easy way of detecting a real configuration change. You can only compare two copies of the configuration, and since some things (e.g. ntp clock-period and timestamps) change more or less by themselves, you cannot even

Re: [c-nsp] Syslog Patterns

2012-01-18 Thread Nikolay Abromov
On Wed, Jan 18, 2012 at 4:26 PM, Peter Rathlev pe...@rathlev.dk wrote: On Wed, 2012-01-18 at 16:05 +0200, Nikolay Abromov wrote: On Tue, Jan 17, 2012 at 11:18 PM, Peter Rathlev pe...@rathlev.dk wrote: On Tue, 2012-01-17 at 20:50 +0200, Nikolay Abromov wrote: I haven't read what the rest of

Re: [c-nsp] Syslog Patterns

2012-01-18 Thread Peter Rathlev
On Wed, 2012-01-18 at 16:37 +0200, Nikolay Abromov wrote: On Wed, Jan 18, 2012 at 4:26 PM, Peter Rathlev pe...@rathlev.dk wrote: My own experience is that there is no easy way of detecting a real configuration change. You can only compare two copies of the configuration, and since some

Re: [c-nsp] Syslog Patterns

2012-01-18 Thread Martin Komoň
There is a feature configured with parser config cache interface, that caches interface configuration. On a Cat6k5 w/ Sup720 it reduces time to generate running config from 7 to ~1 sec (YMMV). Beware of the bug CSCtd93384! Martin On 1/18/2012 4:31 PM, Peter Rathlev wrote: And the fact that

Re: [c-nsp] Syslog Patterns

2012-01-18 Thread Peter Rathlev
On Wed, 2012-01-18 at 17:10 +0100, Martin Komoň wrote: There is a feature configured with parser config cache interface, that caches interface configuration. On a Cat6k5 w/ Sup720 it reduces time to generate running config from 7 to ~1 sec (YMMV). Beware of the bug CSCtd93384! Nice, that

Re: [c-nsp] Syslog Patterns

2012-01-17 Thread Nikolay Abromov
I haven't read what the rest of the guys suggested about this topic but this is pretty easy. Cisco is generating CONFIG_I syslog message when running config has been changed. The verify this you can do the following thing (on a hardware platform). 1. configure NTP master (on the local router or

Re: [c-nsp] Syslog Patterns

2012-01-17 Thread Peter Rathlev
On Tue, 2012-01-17 at 20:50 +0200, Nikolay Abromov wrote: I haven't read what the rest of the guys suggested about this topic but this is pretty easy. A bit ironic... Cisco is generating CONFIG_I syslog message when running config has been changed. Nope. It's generated when you exit config

Re: [c-nsp] Syslog Patterns

2012-01-16 Thread Mohammad Khalil
But when i use the CONFIG_I and enter the conf mode and exit without any modifications the syslog pattern is generated , but in this case i did not do any changes ! From: t...@yort.com Date: Sun, 15 Jan 2012 16:10:01 -0800 Subject: Re: [c-nsp] Syslog Patterns To: eng_m...@hotmail.com CC

Re: [c-nsp] Syslog Patterns

2012-01-16 Thread Phil Mayers
On 01/16/2012 10:13 AM, Mohammad Khalil wrote: But when i use the CONFIG_I and enter the conf mode and exit without any modifications the syslog pattern is generated , but in this case i did not do any changes ! That's just how IOS works. Nothing you can do about it.

Re: [c-nsp] Syslog Patterns

2012-01-16 Thread Mohammad Khalil
ok , then to track configuration changes CONFIG_I is better than parser ? Date: Mon, 16 Jan 2012 11:07:57 + From: p.may...@imperial.ac.uk To: cisco-nsp@puck.nether.net Subject: Re: [c-nsp] Syslog Patterns On 01/16/2012 10:13 AM, Mohammad Khalil wrote: But when i use the CONFIG_I

Re: [c-nsp] Syslog Patterns

2012-01-16 Thread Saku Ytti
On (2012-01-16 13:13 +0200), Mohammad Khalil wrote: ok , then to track configuration changes CONFIG_I is better than parser ? Why not combine it, if you have CONFIG_I and in preceeding lines you see PARSER-5-CFGLOG_LOGGEDCMD before you see another CONFIG_I you can conclusively state if

Re: [c-nsp] Syslog Patterns

2012-01-16 Thread Nick Hilliard
On 16/01/2012 11:13, Mohammad Khalil wrote: ok , then to track configuration changes CONFIG_I is better than parser ? if you want to track configuration changes, why not use tacacs+? You can get a free server on: http://www.shrubbery.net/tac_plus/ This will handle login authentication, login

Re: [c-nsp] Syslog Patterns

2012-01-16 Thread Peter Rathlev
On Mon, 2012-01-16 at 13:18 +0200, Saku Ytti wrote: On (2012-01-16 13:13 +0200), Mohammad Khalil wrote: ok , then to track configuration changes CONFIG_I is better than parser ? Why not combine it, if you have CONFIG_I and in preceeding lines you see PARSER-5-CFGLOG_LOGGEDCMD before you

Re: [c-nsp] Syslog Patterns

2012-01-15 Thread Troy Davis
On Sat, Jan 14, 2012 at 1:25 PM, Mohammad Khalil eng_m...@hotmail.com wrote: what is better between tracking configuration changes CONFIG_I or PARSER-5-CFGLOG_LOGGEDCMD? For detecting config changes (like to re-sync rancid), use CONFIG_I. That's AKA SYS-5-CONFIG_I. PARSER-5-CFGLOG_LOGGEDCMD

[c-nsp] Syslog Patterns

2012-01-14 Thread Mohammad Khalil
hi all what is better between tracking configuration changes CONFIG_I or PARSER-5-CFGLOG_LOGGEDCMD? ___ cisco-nsp mailing list cisco-nsp@puck.nether.net