Chapter 3
Figure 3.1: Process for real-time device configuration monitoring.
When the utility detects a logon or other pertinent event in the log file, it then polls the device's
configuration and compares the current configuration with the most recent authorized
configuration, which is stored in a separate database. If there are any differences, a report is
created and an administrator is notified immediately. Because it is feasible for the utility to
constantly look for new log activity--scanning the log every few minutes, for example--
notification of a device configuration change can come within minutes of the change being
made.
What about false positives--legitimate, authorized changes made to a device? You certainly
don't want a barrage of email notifications or pager alerts just because a perfectly legitimate,
planned change is being implemented. To prevent such alerts, most third-party utilities provide a
user interface (UI) for making (or at least downloading) changes to devices; the utilities then
ignore the changes made through the software. In other words, the software provides a central
management interface, and it will alert you only to changes made outside that interface. Changes
made within the interface can be controlled and audited by the software, closing the loop on
device configuration management. Figure 3.2 illustrates this process.
48
Summary :
Because it is feasible for the utility to constantly look for new log activity--scanning the log every few minutes, for example-- notification of a device configuration change can come within minutes of the change being made.
Tags :
configuration,made,changes,interface,deice,software,log,change,utilities,other,utility,alerts,within