NacTrack
FRGet the demo
Change

How to find out what changed on the network between two collections

Most outages follow a change, and the hard part is rarely the fix. It is establishing what moved and on which device, at a point where nobody is volunteering that they touched anything. NacTrack compares each device's configuration against its previous collection and records what was added, removed and modified, so the question stops being who changed something and becomes which of these changes could produce the symptom.

All the questions
Before you start

What you need

  • Module required: core.
  • Permission required: use_troubleshooting.
  • All collected platforms; the comparison is on configuration text

1. See every change

app.nactrack.com/diff/config
See every change
Each row is one device whose configuration differs from its previous collection. Prev and Curr identify the two collections being compared, and the three counts say how many lines were added, removed and modified. A change with removals is worth more attention than one that only adds, because removing a line is how something stops working.

2. Read the severity

app.nactrack.com/diff/config
Read the severity
Severity is NacTrack's judgement of what was touched, not of how many lines moved. The high-severity row here removed two lines and added one, while a low-severity row further down modified a line and nothing else. Fewer lines, more consequence.

3. Narrow to what matters

app.nactrack.com/diff/config
Narrow to what matters
With a symptom and a time window, filter to the severity worth reading first. On a real estate this list is hundreds of rows a week, and starting from the high-severity ones is what makes it a diagnosis rather than a reading exercise.

4. Apply and read the result

app.nactrack.com/diff/config
Apply and read the result
One device remains. That is the candidate: a core switch that lost two configuration lines between two collections on the same day. From here the device page gives you its neighbours, its interfaces and its compliance state, which is where the diagnosis continues.
The limits

What this view does not tell you

  • This compares collections, not moments. Two changes made between the same pair of collections appear as one combined difference, and a change made and reverted before the next collection leaves no trace at all.
  • A change appearing here is not proof of a fault, and its absence is not proof of innocence. Plenty of outages come from something outside the configuration entirely - a failed optic, a neighbour's change, an expired certificate.
  • Severity is assigned from what kind of configuration changed, so it reflects blast radius rather than intent. A deliberate, approved change to a routing statement still reads as high.

Try the same thing on your own estate

Request accessAll the questionsEvery guide as a PDF (25 MB)