Smarts NCM: Report Advisor "All Changes" report contains "EXTERNAL" prefix for usernames; Are these credential usernames or login names?

Products

• VMware Smart Assurance

Issue/Introduction

Symptoms:


Why does Smarts NCM Report Advisor All Changes report display "EXTERNAL" for user names?

Environment

VMware Smart Assurance - NCM

Resolution

The "credential" name is whatever comes in the syslog and is considered by Smarts NCM as the username. Smarts NCM does not differentiate whether it is credential name or login name, it just takes whatever is found in the syslog. The word "EXTERNAL" is prefixed by Smarts NCM, while the rest of the text is from syslog. The user name comes directly from syslogs.

EXTERNAL is displayed in Smarts NCM when either user has accessed a device externally through a terminal and made configuration changes, or accessed a device through external authentication mechanism such as LDAP, TACAC , RSA and Radius authentication.

When an external user does a configuration change on the device and subsequently a pull is triggered from voyence because of that configuration change, thechange is logged syslog. When this happens, the word EXTERNAL will be prefixed to the syslog message and displayed in Smarts NCM.