It's (rancid) a very useful tool. I find that the main benefit is not that it
backs up the configs, but that it tells you what has changed, and
when. Very useful in an environment where several people are modifying
router configs.
I run it hourly, and I regularly get mails like the one below, which
shows that during the last hour someone has added a "spanning tree"
statement to one particular config.
It's clever enough to know about things in the config that you would expect
to change - timestamps etc.
The only real problem I've found is that occasionally when retrieving
the config from a BigIron, the module serial number (as reported by
"show version") gets corrupted, so you occasionally get emails from
rancid saying the config has changed, with a corresponding email an
hour later saying it has changed back....
Bruce.
*** 107,114 ****
!
vlan 3140 name SGBS-Students by port
tagged ethe 3/11
router-interface ve 40
+ spanning-tree
!
vlan 252 name Todd-Centre by port
untagged ethe 1/5
!
***************
--
Bruce Rodger |[EMAIL PROTECTED] PGP key available
Network Manager, IT Services |http://www.strath.ac.uk/IT/People/bruce.html
The University of Strathclyde | +44 (0)141 548 3300
Glasgow G4 0LN, Scotland. | Fax 553 4100
From [EMAIL PROTECTED] Sat Oct 2 05:12:21 2004
From: [EMAIL PROTECTED] (Cliff Albert)
Date: Sat Oct 2 05:12:24 2004
Subject: [f-nsp] using
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
On Fri, Oct 01, 2004 at 10:12:19AM +0100, Bruce Rodger wrote:
>
> It's (rancid) a very useful tool. I find that the main benefit is not that it
> backs up the configs, but that it tells you what has changed, and
> when. Very useful in an environment where several people are modifying
> router configs.
We are doing the same, but then with custom build software and also the
use of CVS (which rancid also employs). I had some troubles using rancid
in our setup of mainly different equipment and had to rebuild something
from scratch which would do the job. However it's really custom so
expect no public release anywhere soon.
--
Cliff Albert <[EMAIL PROTECTED]>
From [EMAIL PROTECTED] Sat Oct 2 16:08:30 2004
From: [EMAIL PROTECTED] (Niels Bakker)
Date: Sat Oct 2 16:08:35 2004
Subject: [f-nsp] using
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
* [EMAIL PROTECTED] (Bruce Rodger) [Fri 01 Oct 2004, 11:15 CEST]:
[about rancid]
> The only real problem I've found is that occasionally when retrieving
> the config from a BigIron, the module serial number (as reported by
> "show version") gets corrupted, so you occasionally get emails from
> rancid saying the config has changed, with a corresponding email an
> hour later saying it has changed back....
You get that too? Here it usually happens with the standby mgmt module.
I first thought it'd be telnet crapping out, or rancid's --More-- pause
detector (pagebreaks are a pain to work around on IronWare in automated
scripts), until it showed "Non-exist." for the first time, and reverted
to the correct serial # on the next run.
Guess I now have really no excuse anymore to not submit it as a bug :)
I can wholeheartedly recommend rancid. Hook it up to a user with
lowered privilege levels (one that can only execute "show" command),
optionally write a script to watch syslog and tell rancid to get the
config whenever a box logs that it's been changed. You can't upload
configs with it but it forms a good audit trail along with cvsweb.
-- Niels.
--
From [EMAIL PROTECTED] Sat Oct 2 18:09:45 2004
From: [EMAIL PROTECTED] (Bruce Rodger)
Date: Sat Oct 2 18:09:51 2004
Subject: [f-nsp] using
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
>
> Guess I now have really no excuse anymore to not submit it as a bug :)
>
If you do, let me know what happens....
I've been meaning to do it for ages, but I try to not have more than
one "trivial" bug open at once, otherwise I waste too much time following them
up.
Example: Two of out bigirons occasionally throw an error message onto the
telnet console "Error! tunnel, but uptr_pkthdr=NULL"
So I logged a call just asking what this means. I had a suspicion that it was
PIM-related.
So far I've not had a definitive answer, but have been asked for
several "show tech" outputs, some console diagnostics (which means
physically visiting the site) and they've also asked me to disable and
re-enable PIM, which involves a reboot. Sigh.
Bruce.
--
Bruce Rodger |[EMAIL PROTECTED] PGP key available
Network Manager, IT Services |http://www.strath.ac.uk/IT/People/bruce.html
The University of Strathclyde | +44 (0)141 548 3300
Glasgow G4 0LN, Scotland. | Fax 553 4100
From [EMAIL PROTECTED] Sun Oct 3 21:49:18 2004
From: [EMAIL PROTECTED] (joshua sahala)
Date: Sun Oct 3 21:49:25 2004
Subject: [f-nsp] using
In-Reply-To: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
On (02/10/04 22:08), Niels Bakker wrote:
>
> * [EMAIL PROTECTED] (Bruce Rodger) [Fri 01 Oct 2004, 11:15 CEST]:
> [about rancid]
> > The only real problem I've found is that occasionally when retrieving
> > the config from a BigIron, the module serial number (as reported by
> > "show version") gets corrupted, so you occasionally get emails from
> > rancid saying the config has changed, with a corresponding email an
> > hour later saying it has changed back....
>
> You get that too?
i see it too, mostly on our ni1500's
> I can wholeheartedly recommend rancid. Hook it up to a user with
> lowered privilege levels (one that can only execute "show" command),
> optionally write a script to watch syslog and tell rancid to get the
> config whenever a box logs that it's been changed. You can't upload
> configs with it but it forms a good audit trail along with cvsweb.
i too will add a recomendation for rancid :)
you can push config changes with rancid, you just have to pre-write
them (which could work with automated scripting), and then use the
'-s' flag on flogin
/joshua
--
