Backups and drift

A backup captures a device's running configuration through its collector. This page shows how to schedule backups for a whole fleet, back up the moment a device changes, and read what changed.

Before you begin

• The devices are in configuration management, each with a collector assigned. See Add devices to configuration management.
• A login credential is bound to the devices, plus an enable credential for Cisco IOS and NX-OS over SSH. See Device credential vault.
• The account the credential signs in with can read the full configuration. Supported platforms lists the command each OS family runs and the access it needs.

A backup only reads. It never enters configuration mode.

Create a backup policy

A backup policy chooses devices by attributes, so devices that match later, such as newly discovered ones, are backed up too.

1. 1

   Start a policy

   Open Network › Config Mgmt › Backup policies and select New policy. Enter a Name, such as edge-routers-daily.

2. 2

   Choose the devices

   Add clauses under Include: a device must match every include clause. Each clause matches on one attribute: site, collector, vendor, platform, model (wildcards such as C9300*), role, tag, device, cidr (IPv4 ranges), or all. Add Exclude clauses to remove devices that match any of them.

3. 3

   Check the membership preview

   The Membership preview updates as you build the scope. It counts the devices that match, how many are ready, and which have gaps: no collector, no credential, or an unsupported platform. Fix the gaps before you rely on the policy.

4. 4

   Set the schedule

   Pick a Schedule preset (Hourly, Every 6 hours, Every 12 hours or Daily), or enter an interval in Backup schedule: a number followed by m, h or d, such as 30m or 7d.

5. 5

   Turn it on

   New policies start disabled. Select Enabled, then save policy. The first backups start within about a minute, and then follow the schedule.

When a device matches more than one enabled policy, the policy with the highest Priority governs it. The Keep last and Keep days fields are saved with the policy, but Tracix doesn't prune older versions yet, so every saved version stays available.

You can also create a policy from Inventory: select devices, or none, and choose backup schedule or create schedule for selection. A policy made this way is enabled at once. A selection makes a fixed device list; any other scope stays dynamic.

Back up when a device changes

With Back up immediately on config-change trap/syslog on (the default), a device that sends a configuration-change SNMP trap, such as Cisco's ciscoConfigManEvent or Juniper's jnxCmCfgChange, is backed up soon after the trap arrives instead of at the next scheduled run. Traps that report only a configuration display, not a change, don't trigger a backup. For this to work, the device must send its traps to a collector with the trap listener on; see SNMP polling and traps.

Tracix records the trap as a change event on the device, and also records a backup that returns a device to an earlier configuration. Problems that involve the device show these changes; see Problems and cases.

Back up now

• One device: open it under Inventory and select Backup now.
• Several devices: select them under Inventory and choose back up now.
• A policy's devices: open the policy and select Backup now.
• Every policy that is due: select Run due backups on Backup policies.

What a backup saves

Each backup is a job you can follow under Network › Config Mgmt › Activity. When the configuration is identical to the previous one, the job says No configuration change — nothing to save. and no new version is created. When it changed, Tracix saves a new version. History is append-only.

Backups are stored as the device returned them, including any secrets the device prints, because they are the record of what the device ran. When Brain reads a configuration, Tracix masks passwords, communities and keys first. Activity never stores the raw device session.

Compare versions and spot drift

Open a device under Inventory:

• Running shows the configuration from the latest backup, and Intended what you declared.
• Revisions lists every version with who or what captured it and when. Select one to see its diff against the version before it.
• Compare shows drift: the requirements of the intended configuration that the running configuration breaks. It reads Baseline satisfied when there are none, and Not evaluated when the backup can't be checked against them.

Drift counts only requirements you declared, so extra settings on the device don't count unless a section uses exact matching. Lines that match the governing policy's Drift ignore-rules (regular expressions) are left out of the comparison on Compare. By default, the rules skip lines that change on their own, such as uptime counters.

Restore an earlier version

Select a version under Revisions and choose Propose restoration. Tracix creates a change request with that version's configuration. Nothing changes on the device, or in the intended configuration, until the request is approved, saved and deployed like any other change; see Drafts and change requests. Restoring needs a platform that supports applying changes; see Supported platforms.

Fleet report

Network › Config Mgmt › Reports shows the fleet's sync status, the backup success rate over the most recent jobs, running compliance and OS versions. It can also send configuration management notifications to a Slack incoming webhook or another webhook, filtered by severity.

Next steps