It makes reading the thread confusing! Why not? Please don't top post! > Date: Wed, 23 Jul 2008 10:04:06 -0400 > From: "Stefan Fouant" <[EMAIL PROTECTED]> > Sender: [EMAIL PROTECTED] > > Yep, we have RANCID, but that was precisely the problem - while I can > certainly do a config diff and see the changes from baseline at audit > time, it is impossible to see who made the changes and also which > config change corresponds to which change request... > > -- > Stefan Fouant > Principal Network Engineer > NeuStar, Inc. - http://www.neustar.biz > GPG Key ID: 0xB5E3803D > > On Wed, Jul 23, 2008 at 9:32 AM, Jose Madrid <[EMAIL PROTECTED]> wrote: > > Going back to Christian's point, Rancid doesn't know who made the > > changes and if there are multiple changes between rancid run-times, it > > will pick up various changes and not just the one in particular. I > > currently use a mixture of rancid and logs from devices to see who > > logged in at a time nearest when the change was picked up. This is > > less than ideal solution, but all we currently have.
I have modified rancid to record the name of the last committer (easy on JunOS) and to run on demand (as well as periodically). That way a reason for the commit as well as the committer can be logged. N.B. It requires the person making the commit to issue a command on the configuration management system after a commit. It's not automated. It does send out "tickler" messages to all committers when it finds changes that have not been logged and has a mode to log a reason for the missed entry. A syslog monitor could trigger a note to the committer. I'll have to think about doing that. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: [EMAIL PROTECTED] Phone: +1 510 486-8634 Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751
pgpe4Eqy1CI1Z.pgp
Description: PGP signature
_______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
