Send syslog from devices

• It recognizes change messages from Cisco IOS/IOS-XE/NX-OS/ASA, Juniper, Huawei, H3C, FortiGate, Palo Alto, MikroTik, Aruba/HPE and generic “configuration changed” messages.
• Several notices from the same device within 60 seconds trigger a single backup.
• Changes applied by OpenNCCM (approved requests) open a maintenance window: they are not treated as intrusions. The window closes as soon as the following backup finishes; any notice received meanwhile is reviewed when it closes.
• Set up syslog on the devices as described below (see how to configure each vendor).

Configure each vendor

For OpenNCCM to detect changes the moment someone makes them, each device must send its syslog messages to the server (UDP 514). When a change notice arrives, OpenNCCM waits 20 seconds, backs up the device, compares, alerts and, if enabled, reverts the unauthorized change.

Shortcut

There are ready-made configlets for Cisco IOS, Junos and Huawei in Configlets → “Configurar syslog hacia OpenNCCM”: choose the devices, type the server IP in the servidor_ncm variable and approve.

Cisco IOS / IOS-XE

logging host SERVER_IP
logging trap notifications
archive
 log config
  logging enable
  notify syslog contenttype plaintext

Juniper Junos

set system syslog host SERVER_IP interactive-commands notice
set system syslog host SERVER_IP change-log info
commit

Huawei VRP / H3C

info-center loghost SERVER_IP

Fortinet FortiGate

config log syslogd setting
    set status enable
    set server "SERVER_IP"
end

MikroTik RouterOS

/system logging action add name=ncm target=remote remote=SERVER_IP
/system logging add topics=system,info action=ncm

Aruba / HPE / Arista

logging SERVER_IP

The device must be registered in OpenNCCM with the same IP it sends syslog from (or with a DNS name that resolves to it). You can check that messages arrive in Alarms: a “Change syslog” event appears.