CISCO-CONFIG-MAN-MIB

All MIBs › CISCO-CONFIG-MAN-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2007-04-27

Category: Cisco Devices, Device Management

Description: Tracks changes and saves of the running configuration, maintaining a history table of configuration management events with details about each change.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring CISCO-CONFIG-MAN-MIB with a free 30-day trial of IPNetwork Monitor.

What Is CISCO-CONFIG-MAN-MIB?

CISCO-CONFIG-MAN-MIB is a Cisco proprietary configuration-management MIB that models where a device's configuration data lives — running, terminal, local (NVRAM/flash), or remote — and records a history of configuration change and save events. It exposes timestamps of the last running-config change and save, the last startup-config change, and a history table of individual change events with their source and destination. It is squarely a software/configuration status MIB: it lets an operator detect drift between running and startup configuration, confirm that changes were actually saved, and identify who or what triggered each change. It has no strong dependency on other MIBs beyond general SNMP conventions, though it is often deployed alongside logging/AAA instrumentation to correlate config events with the user or session responsible. It is widely deployed on Cisco routers and switches for change-tracking, compliance auditing, and triggering automatic configuration backups. Engineers researching cisco-config-man-mib specifically use its ciscoConfigManEvent notification to get alerted whenever a device's running configuration changes.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-CONFIG-MAN-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco routers
Cisco switches (IOS/IOS-XE)

Monitoring Examples

ccmHistoryRunningLastChanged versus ccmHistoryRunningLastSaved lets an admin detect that the running configuration was modified but never saved, risking loss on reload. ccmHistoryEventTable/ccmHistoryEventEntry records each change with ccmHistoryEventTime, ccmHistoryEventCommandSource and ccmHistoryEventConfigSource/ccmHistoryEventConfigDestination, allowing a monitoring system to alert on unexpected out-of-band changes. A rising ccmHistoryEventEntriesBumped counter would indicate config changes are occurring faster than the history table (sized by ccmHistoryMaxEventEntries) can retain.

What Can Be Monitored

last configuration change time
last configuration save time
startup vs running configuration drift
configuration change history
source of configuration changes

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TC

Unsigned64

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using ccmHistoryEventEntriesBumped OID:

Select a Cisco router or switch (IOS/IOS-XE config management) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ccmHistoryEventEntriesBumped into the Find box to locate it in the OID tree, then select it and click OK. The number of times the oldest entry in ccmHistoryEventTable was deleted to make room for a new entry. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoConfigManMIB	1.3.6.1.4.1.9.9.43			Configuration management MIB. The MIB represents a model of configuration data that exists in various locations: running in use by the running system terminal saved to whatever is attached as the terminal local saved locally in NVRAM or flash remote saved to some server on the network Although some of the system functions that relate here can be used for general file storage and transfer, this MIB intends to include only such operations as clearly relate to configuration. Its primary emphasis is to track changes and saves of the running configuration. As saved data moves further from startup use, such as into different local flash files or onto the network, tracking becomes difficult to impossible, so the MIB's interest and functions are confined in that area. Information from ccmCLIHistoryCommandTable can be used to track the exact configuration changes that took place within a particular Configuration History event. NMS' can use this information to update the related components. For example: If commands related only to MPLS are entered then the NMS need to update only the MPLS related management information rather than updating all of its management information. Acronyms and terms: CLI Command Line Interface.
ciscoConfigManMIBObjects	1.3.6.1.4.1.9.9.43.1
ccmHistory	1.3.6.1.4.1.9.9.43.1.1
TIK ccmHistoryRunningLastChanged	1.3.6.1.4.1.9.9.43.1.1.1	TimeTicks	read-only	The value of sysUpTime when the running configuration was last changed. If the value of ccmHistoryRunningLastChanged is greater than ccmHistoryRunningLastSaved, the configuration has been changed but not saved.
TIK ccmHistoryRunningLastSaved	1.3.6.1.4.1.9.9.43.1.1.2	TimeTicks	read-only	The value of sysUpTime when the running configuration was last saved (written). If the value of ccmHistoryRunningLastChanged is greater than ccmHistoryRunningLastSaved, the configuration has been changed but not saved. What constitutes a safe saving of the running configuration is a management policy issue beyond the scope of this MIB. For some installations, writing the running configuration to a terminal may be a way of capturing and saving it. Others may use local or remote storage. Thus ANY write is considered saving for the purposes of the MIB.
TIK ccmHistoryStartupLastChanged	1.3.6.1.4.1.9.9.43.1.1.3	TimeTicks	read-only	The value of sysUpTime when the startup configuration was last written to. In general this is the default configuration used when cold starting the system. It may have been changed by a save of the running configuration or by a copy from elsewhere.
I32 ccmHistoryMaxEventEntries	1.3.6.1.4.1.9.9.43.1.1.4	Integer32	read-only	The maximum number of entries that can be held in ccmHistoryEventTable. The recommended value for implementations is 10.
C32 ccmHistoryEventEntriesBumpedEx	1.3.6.1.4.1.9.9.43.1.1.5	Counter32	read-only	The number of times the oldest entry in ccmHistoryEventTable was deleted to make room for a new entry.
ccmHistoryEventTable	1.3.6.1.4.1.9.9.43.1.1.6		not-accessible	A table of configuration events on this router.
ccmHistoryEventEntry	1.3.6.1.4.1.9.9.43.1.1.6.1		not-accessible	Information about a configuration event on this router.
I32 ccmHistoryEventIndex	1.3.6.1.4.1.9.9.43.1.1.6.1.1	Integer32	not-accessible	A monotonically increasing integer for the sole purpose of indexing events. When it reaches the maximum value, an extremely unlikely event, the agent wraps the value back to 1 and may flush existing entries.
TIK ccmHistoryEventTime	1.3.6.1.4.1.9.9.43.1.1.6.1.2	TimeTicks	read-only	The value of sysUpTime when the event occurred.
INT ccmHistoryEventCommandSource	1.3.6.1.4.1.9.9.43.1.1.6.1.3	INTEGER	read-only	The source of the command that instigated the event.
HIS ccmHistoryEventConfigSource	1.3.6.1.4.1.9.9.43.1.1.6.1.4	HistoryEventMedium	read-only	The configuration data source for the event.
HIS ccmHistoryEventConfigDestination	1.3.6.1.4.1.9.9.43.1.1.6.1.5	HistoryEventMedium	read-only	The configuration data destination for the event.
INT ccmHistoryEventTerminalType	1.3.6.1.4.1.9.9.43.1.1.6.1.6	INTEGER	read-only	If ccmHistoryEventCommandSource is 'commandLine', the terminal type, otherwise 'notApplicable'.
I32 ccmHistoryEventTerminalNumber	1.3.6.1.4.1.9.9.43.1.1.6.1.7	Integer32	read-only	If ccmHistoryEventCommandSource is 'commandLine', the terminal number. The value is -1 if not available or not applicable.
STR ccmHistoryEventTerminalUser	1.3.6.1.4.1.9.9.43.1.1.6.1.8	DisplayString	read-only	If ccmHistoryEventCommandSource is 'commandLine', the name of the logged in user. The length is zero if not available or not applicable.
STR ccmHistoryEventTerminalLocation	1.3.6.1.4.1.9.9.43.1.1.6.1.9	DisplayString	read-only	If ccmHistoryEventCommandSource is 'commandLine', the hard-wired location of the terminal or the remote host for an incoming connection. The length is zero if not available or not applicable.
IP ccmHistoryEventCommandSourceAddress	1.3.6.1.4.1.9.9.43.1.1.6.1.10	IpAddress	read-only	If ccmHistoryEventTerminalType is 'virtual', the internet address of the connected system. If ccmHistoryEventCommandSource is 'snmp', the internet address of the requester. The value is 0.0.0.0 if not available or not applicable. This object is deprecated by ccmHistoryEventCommandSourceAddrRev1
STR ccmHistoryEventVirtualHostName	1.3.6.1.4.1.9.9.43.1.1.6.1.11	DisplayString	read-only	If ccmHistoryEventTerminalType is 'virtual', the host name of the connected system. The length is zero if not available or not applicable.
IP ccmHistoryEventServerAddress	1.3.6.1.4.1.9.9.43.1.1.6.1.12	IpAddress	read-only	If ccmHistoryEventConfigSource or ccmHistoryEventConfigDestination is 'networkTftp' or 'networkRcp', the internet address of the storage file server. The value is 0.0.0.0 if not applicable or not available. This object is deprecated by ccmHistoryEventServerAddrRev1
STR ccmHistoryEventFile	1.3.6.1.4.1.9.9.43.1.1.6.1.13	DisplayString	read-only	If ccmHistoryEventConfigSource or ccmHistoryEventConfigDestination is 'networkTftp' or 'networkRcp', the configuration file name at the storage file server. The length is zero if not available or not applicable.
STR ccmHistoryEventRcpUser	1.3.6.1.4.1.9.9.43.1.1.6.1.14	DisplayString	read-only	If ccmHistoryEventConfigSource or ccmHistoryEventConfigDestination is 'networkRcp', the remote user name. The length is zero if not applicable or not available.
C32 ccmHistoryCLICmdEntriesBumped	1.3.6.1.4.1.9.9.43.1.1.6.1.15	Counter32	read-only	The number of times the oldest entry in ccmCLIHistoryCommandTable with first index as ccmHistoryEventIndex was deleted to make room for a new entry. This object is applicable only if ccmHistoryEventCommandSource has a value of 'commandLine'.
IPt ccmHistoryEventCommandSourceAddrType	1.3.6.1.4.1.9.9.43.1.1.6.1.16	InetAddressType	read-only	This object indicates the transport type of the address contained in ccmHistoryEventCommandSourceAddrRev1. The value will be zero if not available or not applicable.
IP ccmHistoryEventCommandSourceAddrRev1	1.3.6.1.4.1.9.9.43.1.1.6.1.17	InetAddress	read-only	If ccmHistoryEventTerminalType is 'virtual', the internet address of the connected system. If ccmHistoryEventCommandSource is 'snmp', the internet address of the requester. The value of all bit's is zero if not available or not applicable. The Format of this address depends on the value of the ccmHistoryEventCommandSourceAddrType object. This object deprecates ccmHistoryEventCommandSourceAddress
IPt ccmHistoryEventServerAddrType	1.3.6.1.4.1.9.9.43.1.1.6.1.18	InetAddressType	read-only	This object indicates the transport type of the address contained in ccmHistoryEventServerAddrRev1. The value will be zero if not available or not aplicable.
IP ccmHistoryEventServerAddrRev1	1.3.6.1.4.1.9.9.43.1.1.6.1.19	InetAddress	read-only	If ccmHistoryEventConfigSource or ccmHistoryEventConfigDestination is 'networkTftp' or 'networkRcp', the internet address of the storage file server. The value of all bits is 0s if not applicable or not available. The Format of this address depends on the value of the ccmHistoryEventServerAddrType object. This object deprecates ccmHistoryEventServerAddress.
ccmCLIHistory	1.3.6.1.4.1.9.9.43.1.2
U32 ccmCLIHistoryMaxCmdEntries	1.3.6.1.4.1.9.9.43.1.2.1	Unsigned32	read-write	The maximum number of entries that can be held in ccmCLIHistoryCommandTable. The recommended value for implementations is 100. If the number of entries in ccmCLIHistoryCommandTable exceeds the value of this object, old entries will be bumped to make room for new entries. The ccmCLIHistoryCommandTable will not be populated if the value of this object is 0.
G32 ccmCLIHistoryCmdEntries	1.3.6.1.4.1.9.9.43.1.2.2	Gauge32	read-only	The current number of entries in ccmCLIHistoryCommandTable.
U32 ccmCLIHistoryCmdEntriesAllowed	1.3.6.1.4.1.9.9.43.1.2.3	Unsigned32	read-only	This object indicates the upper limit on the number of entries allowed in ccmCLIHistoryCommandTable by the managed system.
ccmCLIHistoryCommandTable	1.3.6.1.4.1.9.9.43.1.2.4		not-accessible	A table of CLI commands that took effect during configuration events.
ccmCLIHistoryCommandEntry	1.3.6.1.4.1.9.9.43.1.2.4.1		not-accessible	Information about the CLI commands that took effect during the configuration event pointed by ccmCLIHistoryEventIndex. A set of rows in this table having the first index as ccmHistoryEventIndex will store the CLI commands entered during the corresponding configuration event in ccmHistoryEventTable. An entry will be created in this table only if the corresponding entry in ccmHistoryEventTable has a value of 'commandLine' for ccmHistoryEventCommandSource.
U32 ccmCLIHistoryCommandIndex	1.3.6.1.4.1.9.9.43.1.2.4.1.1	Unsigned32	not-accessible	A monotonically increasing integer for the purpose of indexing CLI commands which took effect during a configuration event.
STR ccmCLIHistoryCommand	1.3.6.1.4.1.9.9.43.1.2.4.1.2	DisplayString	read-only	The CLI command entered which took effect during the configuration event pointed by ccmHistoryEventIndex.
ccmCLICfg	1.3.6.1.4.1.9.9.43.1.3
T/F ccmCLICfgRunConfNotifEnable	1.3.6.1.4.1.9.9.43.1.3.1	TruthValue	read-write	This variable indicates whether the system produces the ccmCLIRunningConfigChanged notification. A false value will prevent notifications from being generated by this system.
ccmCTIDObjects	1.3.6.1.4.1.9.9.43.1.4
UNS ccmCTID	1.3.6.1.4.1.9.9.43.1.4.1	Unsigned64	read-only	This object indicates the Config Change Tracking ID which uniquely represents version-incrementing changes to the IOS running configuration.
DAT ccmCTIDLastChangeTime	1.3.6.1.4.1.9.9.43.1.4.2	DateAndTime	read-only	This object indicates the time when the Config Change Tracking ID last changed.
STR ccmCTIDWhoChanged	1.3.6.1.4.1.9.9.43.1.4.3	SnmpAdminString	read-only	This object indicates the user who last reset the Config Change Tracking ID.
T/F ccmCTIDRolledOverNotifEnable	1.3.6.1.4.1.9.9.43.1.4.4	TruthValue	read-write	This variable indicates whether the system produces the ccmCTIDRolledOver notification. A false value will prevent notifications from being generated by this system.
ciscoConfigManMIBNotificationPrefix	1.3.6.1.4.1.9.9.43.2
ciscoConfigManMIBNotifications	1.3.6.1.4.1.9.9.43.2.0
NTF ciscoConfigManEvent	1.3.6.1.4.1.9.9.43.2.0.1			Notification of a configuration management event as recorded in ccmHistoryEventTable.
NTF ccmCLIRunningConfigChanged	1.3.6.1.4.1.9.9.43.2.0.2			This notification indicates that the running configuration of the managed system has changed from the CLI. If the managed system supports a separate configuration mode(where the configuration commands are entered under a configuration session which affects the running configuration of the system), then this notification is sent when the configuration mode is exited. During this configuration session there can be one or more running configuration changes.
NTF ccmCTIDRolledOver	1.3.6.1.4.1.9.9.43.2.0.3			This notification indicates that the Config Change Tracking ID has rolled over and will be reset.
ciscoConfigManMIBConformance	1.3.6.1.4.1.9.9.43.3
ciscoConfigManMIBCompliances	1.3.6.1.4.1.9.9.43.3.1
ciscoConfigManMIBCompliance	1.3.6.1.4.1.9.9.43.3.1.1			The compliance statement for entities which implement the Cisco Configuration Management MIB
ciscoConfigManMIBComplianceRev2	1.3.6.1.4.1.9.9.43.3.1.2			The compliance statement for entities which implement the Cisco Configuration Management MIB
ciscoConfigManMIBComplianceRev3	1.3.6.1.4.1.9.9.43.3.1.3			The compliance statement for entities which implement the Cisco Configuration Management MIB. This compliance module deprecates ciscoConfigManMIBCompliance.
ciscoConfigManMIBComplianceRev4	1.3.6.1.4.1.9.9.43.3.1.4			The compliance statement for entities which implement the Cisco Configuration Management MIB. This compliance module deprecates ciscoConfigManMIBCompliance.
ciscoConfigManMIBGroups	1.3.6.1.4.1.9.9.43.3.2
ciscoConfigManHistoryGroup	1.3.6.1.4.1.9.9.43.3.2.1			Configuration history.
ciscoConfigManHistoryGroupRev1	1.3.6.1.4.1.9.9.43.3.2.2			Configuration history.
ciscoConfigManHistNotifyGroup	1.3.6.1.4.1.9.9.43.3.2.3			Notifications of a configuration management event.
ciscoConfigManCLIHistCmdGroup	1.3.6.1.4.1.9.9.43.3.2.4			CLI commands entered during a configuration history event.
ciscoConfigManHistoryGroupRev2	1.3.6.1.4.1.9.9.43.3.2.5			Configuration history. This group deprecates the old group ciscoConfigManHistoryGroupRev1
ciscoConfigManCTIDNotifyGroup	1.3.6.1.4.1.9.9.43.3.2.6			Notifications of a Config Change Tracking ID event.
ciscoConfigManCTIDObjectGroup	1.3.6.1.4.1.9.9.43.3.2.7			Information about the current CTID value, when CTID last changed, and who last changed the CTID.

RFC description

Configuration management and tracking for running, local, and remote configuration storage.

Start monitoring Cisco routers and switches (IOS/IOS-XE config management) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-CONFIG-MAN-MIB