I am doing some spring cleaning. I'm checking my network devices to verify that:
- All networked devices that are in NPM are also being managed by NCM;
- NCM is able to log into the devices;
- All devices have a recent config backed up.
I have found out that there are many ways that devices are no longer able to download configs, or otherwise are not in NCM. Some of the causes of lack of NCM ability to login, which I have found, are:
- A NPS (RADIUS) server was retired, and network devices either not updated.
- The network device and NPS don't have matching keys for the client.
- A new device was put on the network without having full configuration completed.
- Everything would work right if the person who added the device to Orion had selected Manage node with NCM: Yes.
- The NCM connection profile was chosen, but not tested.
So, anyway, the easiest way to tell if all your devices are in NCM is to go to Manage Nodes, and Click the >> symbol at the far right of the column headings, and select "NCM-Licensed". Now, you can use the GUI to see which of the nodes exist, but are not licensed. Not licensed, means not in NCM, and the configs are not being backed up.
But sometimes you want a report. Sometimes you want to report to limit itself to Cisco, Palo Alto, and Riverbed (ignoring servers and UPS). Sometimes you don't want to see Cisco UCS or CCM as part of the report. It would be easy to create a report if there were a column for "NCM-Licensed", for the Nodes Table. I haven't been able to find any such column in the database (doesn't mean it is not there).
So, I recreated the relationship in a SQL query, to identify which NPM nodes are not also NCM nodes. This is the SQL query I developed for reporting nodes not in NCM.
PART 1: Which (Cisco) nodes are not in NCM
SELECT top 200 [n].[NodeID] ,[c].[CoreNodeID] ,[n].[IP_Address] ,[n].[Caption] ,[a].[DownloadTime] ,[a].[ConfigType]
FROM [dbo].[Nodes][n] WITH(NOLOCK)
LEFT JOIN [dbo].[NCM_Nodes][c] WITH(NOLOCK) ON [n].[NodeID]=[c].[CoreNodeID]
LEFT JOIN [dbo].[NCM_ConfigArchive][a] WITH(NOLOCK) ON [c].[NodeID]=[a].[NodeID]
WHERE [n].[Vendor]='Cisco' AND NOT [n].[IOSImage] = 'CIMC' AND NOT [n].[IOSImage] = 'Cisco IMC' AND NOT [n].[MachineType] LIKE 'Cisco Unified%' AND [c].[CoreNodeID]is NULL
ORDER BY [n].[Caption]
Here are the results of the report:
![]()
The key is the LEFT JOIN on line 9, pared with the [c].[CoreNodeID] in NULL on line 15. That's really all that's necessary here, the rest just shapes the data.
You can of course, change line 11 to represent a different Vendor, or multiple vendors by changing line 11 to be:
WHERE [n].[Vendor] in ('Cisco','Palo Alto Networks','Riverbed Technology') Lines 6, 7 and 10 are not useful for this report since they will always be Null since no config should exist if the node is not in NCM. However, the query can be modified easily to show recent configs (more on that later).
Now, it'd be nice to be able to see which of your devices in NCM have configs, and which don't I'm sure there is probably a way to find this out from the GUI. You could sort by "Last" in Configuration Management, and anything that has no icon there has no config. You can also see which devices are failing the nightly backup job in an e-mail. However, it is possible for you back up job to be missing some devices, so this report kind of double checks. But, it is really a matter of format of information. Sometimes you want a report, and sometimes you want to limit your scope of information to a certain group of devices. This is easy to do by running a report.
PART 2: Which NCM Nodes Do Not Have a Config archived:
SELECT top 200 [n].[NodeID] ,[n].[Vendor] ,[n].[IP_Address] ,[n].[Caption] ,[a].[DownloadTime] ,[a].[ConfigType]
FROM [dbo].[Nodes][n] WITH(NOLOCK)
LEFT JOIN [dbo].[NCM_Nodes][c] WITH(NOLOCK) ON [n].[NodeID]=[c].[CoreNodeID]
LEFT JOIN [dbo].[NCM_ConfigArchive][a] WITH(NOLOCK) ON [c].[NodeID]=[a].[NodeID]
WHERE [n].[Vendor] in ('Cisco','Palo Alto Networks', 'Riverbed Technology') AND NOT [n].[IOSImage] = 'CIMC' AND NOT [n].[IOSImage] = 'Cisco IMC' AND NOT [n].[MachineType] LIKE 'Cisco Unified%' AND NOT [c].[CoreNodeID]is NULL AND [a].[ConfigType] is NULL
ORDER BY [n].[Vendor] DESC, [n].[Caption]
Results:
![]()
You can see that this is the same basic table, with a few changes. First, we changed line 15 to NOT**, which means it select only nodes that are in NCM. I added line 16, which will only choose lines which don't have a type of config. If there are configs archived for the node, each config will have a node type like Running or Start-up. Any device which has Null for Config type should have no configs. The value of this query is that it tells you which NCM nodes don't have any config archived.
Time to login to those devices and find out why those downloads are failing.
Of course, you could NOT line 16. If you did that, you could see all the configs archived for each node in NCM. Be warned, if you run the report in that manner, it will return every config for every node with a config. If you dn't have a decent Purge job configured, this will be a lot of results.
If people are interested, I'll post Part 3, which will show how to take that report and only show the last config for each device -- and then compare that to the a date. If you have a job to download all configs whether or not they have been changed -- once per month or such -- this report will identify nodes which the oldest config is older than that last all devices backup.
Happy Administering!
**The easier way to do this is to just use all nodes in NCM_Nodes. I just did it in the manner above because it is a derivation of the previous query. By 'NOT'ing line 15, you are saying "use all NPM nodes which are not absent from NCM_Node". It would be easier to say, "use NCM_Nodes". Simplify by editing line 9 and removing line 16 (less NOTs). Marginally faster this way too:
SELECT top 200 [n].[NodeID] ,[n].[Vendor] ,[n].[IP_Address] ,[n].[Caption] ,[a].[DownloadTime] ,[a].[ConfigType]
FROM [dbo].[Nodes][n] WITH(NOLOCK)
JOIN [dbo].[NCM_Nodes][c] WITH(NOLOCK) ON [n].[NodeID]=[c].[CoreNodeID]
LEFT JOIN [dbo].[NCM_ConfigArchive][a] WITH(NOLOCK) ON [c].[NodeID]=[a].[NodeID]
WHERE [n].[Vendor] in ('Cisco','Palo Alto Networks', 'Riverbed Technology') AND NOT [n].[IOSImage] = 'CIMC' AND NOT [n].[IOSImage] = 'Cisco IMC' AND NOT [n].[MachineType] LIKE 'Cisco Unified%' AND [a].[ConfigType] is NULL
ORDER BY [n].[Vendor] DESC, [n].[Caption]
