Network Management

Troubleshooting NCM Real Time Change Detection

This article describes how real-time change detection works and provides troubleshooting information.

First published date

10/15/2018 9:13 PM

Last published date

7/23/2025 6:22 PM

Overview

Network devices can be configured to send a Syslog message or a Trap message when the configuration on the device changes. If the device has been set up to send such messages to the SolarWinds Platform server, then you can configure a rule in Log Viewer or Log Analyzer to download the configuration. NCM then checks it against the existing saved startup or running configuration.

For RTCD (Real-Time Change Detection), running configurations are compared to running configurations and startup is compared to startup only. NCM will not compare one type of configuration with a different type for this purpose.

Product section

Network Configuration Manager

Resolution

Setting up RTCD

For information about setting up RTCD, see Configure real-time change detection in NCM in the NCM Admin Guide.

To test the setup, you might need to use a syslog/trap message spoof to generate the initial syslog/trap message, because devices in the Austin lab will not be able to send syslog/trap messages to VMs located in other GEO(s), due to firewalls placed on the WAN links.

Troubleshooting RTCD

RTCD is made up of a number of different components. To troubleshoot why RTCD is not working, you need to troubleshoot each of these components, to find which link in the chain is broken.

NOTE: The following diagram applies to NCM 2023.2.0 and earlier. In NCM 2023.2.1 and later, RTNforwarder.exe is not launched. The alert action downloads the configuration using a SWIS verb.

(NCM 2023..2.0 and earlier) Make sure that UAC is set to a low setting or disabled. When RTN Forwarder is executed UAC will prompt for it and will not launch the application.

To test the UAC, launch Command Prompt as Administrator, and navigate to the RTN Forward executable, by default it is located at C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.NCM.RTNForwarder.exe (target IP address of device):

If a prompt comes up, then disable UAC on the server and test again.

(All versions) Other issues could be the Regular Expressions for any of the configuration of the rule. This can be tested by adding the Windows Event Log:

Log Files

Log File	Details
Device logs	Some devices can log to console to confirm they have sent a trap or syslog message upon config change.
Wireshark trace	Confirm the Trap/Syslog message has been received by the SolarWinds Platform server.
Syslog / Traps	View Syslogs / Traps from the web console to confirm the syslog / trap has arrived, and confirm the format of the syslog / trap message matches what is being looked for in the Alert Action.
Session Trace	Confirm that a config is successfully downloaded from the device.
Real-Time Change Detection Logs	Enabled from the web console (Under NCM Settings -> Advanced Settings). Logs change events, notification success or failure, and device connectivity.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.