About real-time change detection in NCM
When you configure real-time change detection (RTCD), NCM sends an email notification whenever a device configuration changes. Use RTCD notifications to quickly determine if the config change could potentially cause a problem. Immediate notification of changes helps you improve network security, prevent unexpected downtime, and resolve known errors faster.
Unlike the Config Change Report, RTCD detects changes only on the same configuration type. For example, if you download a startup configuration, make changes to it, and upload it as a running configuration, the change will be detected against the previous running configuration. RTCD does not compare running and startup configuration types.
How does real-time change detection work?
To enable real-time change detection, you configure your network devices to send syslog or trap messages to the Orion server, and then configure a rule to detect messages that indicate a config was changed. After you configure RTCD:
- A user logs in to a device and changes the config.
- The device sends a syslog or trap message to the Orion server.
- A rule in your syslog or trap receiver detects a message that indicates a config change. The action in the rule launches the NCM executable
RTNForwarder.exedownloads the updated config from the device.
- NCM compares the updated config to a baseline to determine what changed.
- NCM sends an email with details of the change to the designated recipient.