So far, we have explored what NCCM is, and taken a deep dive into device policy checking – in this post we are going to be exploring Real Time Configuration Change Detection (or just Change Detection as I will call it in this blog).  Change Detection is the process by which your NCCM system is notified - either directly by the device or from a 3^rd party system that a configuration change has been made on that device.  Why is this important?  Let’s identify 3 main reasons that Change Detection is a critical component of a well deployed NCCM solution.

1. Unauthorized change recording.  As anyone that works in an enterprise IT department knows, changes need to be made in order to keep systems updated for new services, users and so on.  Most of the time, changes are (and should be) scheduled in advance, so that everyone knows what is happening, why the change is being made, when it is scheduled and what the impact will be on running services.  
   
   However, the fact remains that anyone with the correct passwords and privilege level can usually log into a device and make a change at any time.    Engineers that know the network and feel comfortable working on the devices will often just login and make “on-the-fly” adjustments that they think won’t hurt anything.  Unfortunately as we all know, those “best intentions” can lead to disaster.
   
   That is where Change Detection can really help.  Once a change has been made, it will be recorded by the device and a log can be transmitted either directly to the NCCM system or to a 3^rd party logging server which then forwards the message to the NCCM system.  At the most basic level this means that if something does go wrong, there is an audit trail which can be investigated to determine what happened and when.  It can also potentially be used to roll back the changes to a known good state.
   
   
   
2. Automated actions. 
   
   Once a change has been made (scheduled or unauthorized) many IT departments will wish to perform some automated actions immediately at the time of change without waiting for a daily or weekly schedule to kick in.  Some of the common automated activities are:
   
   - Immediate configuration backup.  So that all new changes are recorded in the backup system.
   
   - Launch of a new discovery.  If the change involved any hardware or OS type changes like a version upgrade, then the NCCM system should also re-discover the device so that the asset system has up-to-date information about the device
   
   These automation actions can ensure that the NCCM and other network management applications are kept up to date as changes are being made without having to wait for the next scheduled job to start.  This ensures that any other systems are not acting “blindly” when they try to perform an action with/on the changed device.
   
   
   
3. Policy Checking.  New configuration changes should also prompt an immediate policy check of the system to ensure that the change did not inadvertently breach a compliance or security rule.  If a policy has been broken, then a manager can be notified immediately.  Optionally, if the NCCM system is capable of remediation, then a rollback or similar operation can happen to bring the system back into compliance immediately.
   

Almost all network devices are capably of logging hardware / software / configuration changes.  Most of the time these can easily be exported in the form of an SNMP trap or Syslog.  A good NCM system can receive these messages, parse them to understand what has happened and if the log signifies a change has taken place – is then able to take some action(s) as described above.  This real time configuration change detection mechanism is a staple part of an enterprise NCCM solution and should be implemented in all organizations where network changes are commonplace.