Cisco Systems 4.1 Tracking Network Changes Using Change Audit

CHAPTER

13-1

User Guide for Resource Manager Essentials 4.1

OL-11714-01

Tracking Network Changes Using Change Audit

Change Audit tracks and reports changes made in the network. Change Audit allows other RME

applications to log change information to a central repository. Device Configuration, Inventory, and

Software Management changes can be logged and viewed using Change Audit.

RME applications write change records to Change Audit. Change Audit stores these records in the log

tables (summary and details) for later use with reports.

For example, Software Management records a change for each completed device upgrade. If a job has

ten devices, then Software Management writes ten entries to the Change Audit log, but the Change Audit

report shows only one job with ten devices. You can then access individual device information.

Each application writes its own change records to Change Audit. For example, in Inventory you can set

inventory change filters to filter out all kinds of information for different device types. Change Audit

record maintenance is controlled by the Change Audit Delete Change History option.

You can convert change records into SNMP V1 traps and forward them to a destination of your choice.

This allows system administrators to forward critical network change data to their own NMS.

You can define automated actions (e-mail and automated scripts) on creation of change audit record. The

automated action gets triggered on creation of the change audit record.

Syslog clients or message suppliers are Cisco devices that have been configured to log messages to RME.

Syslog Analyzer receives messages from routers and other Cisco devices configured to send messages

to the syslog server in RME. The messages are sent either directly or through a remote syslog collector

installed in the network. These messages originate from the device in response to some activity that

affects it.

Change Audit clients are RME applications that record change information. Applications, such as

Software Management, send messages to Change Audit when they make a change to the network, for

example, uploading a new Cisco IOS image.

Often these changes and users who make changes from the command line interface also trigger syslog

messages. The messages are logged in the RME syslog facility and are also passed on to other RME

applications for processing.

For example, a device sends a syslog message about a device configuration change. This is passed on to

Device Configuration, which determines the exact nature of the change and then writes a change record

into the Change Audit log.