About real-time change detection in NCM
When you configure real-time change detection (RTCD), NCM sends an email notification whenever a device configuration changes. Use RTCD notifications to quickly determine if the config change could potentially cause a problem. Immediate notification of changes helps you improve network security, prevent unexpected downtime, and resolve known errors faster.
Unlike the Config Change Report, RTCD detects changes only on the same configuration type. For example, if you download a startup configuration, make changes to it, and upload it as a running configuration, the change will be detected against the previous running configuration. RTCD does not compare running and startup configuration types.
How does real-time change detection work?
To enable real-time change detection, you configure your network devices to send syslog or trap messages to the SolarWinds Platform server, and then configure a rule to detect messages that indicate a config was changed. After you configure RTCD:
- A user logs in to a device and changes the config.
- The device sends a syslog or trap message to the SolarWinds Platform server.
- A rule in Log Viewer (LV) or Log Analyzer (LA) detects a message that indicates a config change.
- The action in the rule downloads the updated config from the device.
- NCM compares the updated config to a baseline to determine what changed.
- NCM sends an email with details of the change to the designated recipient.
Next steps
- Complete the steps to configure real time change detection.
- If a large number of config downloads is an issue after you enable RTCD, you can limit the number of simultaneous downloads.