Cisco Expressway Configuration Audit

[Justin_Blignaut]

A question to the community?

We have Cisco Expressways configured for Event (Syslog) log management. Can one configure Prognosis 11.5 for managed the Expressway configurations logs as a separate feed as well. Or alternatively can you filter on the sys log for configuration changes. I have a business requirement to provide configuration audit of any device configuration changes and would like to use Prognosis is possible to do this instead of building a bespoke solution.

Surely more people have this compliance requirement.

[GeraldC1]

One could try create a display and apply a where clause to it to just show the configuration events. To check the nature of the data in Prognosis, drill into the Syslog History, step through to see what they look like compared with other kinds of events and therefore what kind of where clause might work.

Also if they can be sent in a sepearte feed by IP/port then Prognosis can uniquey label events based on source IP and port by adding a MAP DEVICE line into the SYSLOG config - see this Help article for details.
Prognosis for Unified Communications > Syslog Messages > Prognosis Setup > Configure the Syslog Collector

HTH