 Feedback
|
Table Of Contents
Release Notes for CiscoWorks Network Compliance Manager 1.8
What's New in CiscoWorks NCM 1.8
What's Been Fixed in CiscoWorks NCM 1.8
Additional CiscoWorks NCM Configurations
Additional Required Applications
Known Problems in CiscoWorks NCM 1.8
Accessing the CiscoWorks NCM Documentation Set
Obtaining Documentation and Submitting a Service Request
Release Notes for CiscoWorks Network Compliance Manager 1.8
Published: July 2012, OL-27498-01These release notes are for CiscoWorks Network Compliance Manager (NCM) 1.8. It contains the following sections:
•
What's New in CiscoWorks NCM 1.8
•
•
•
•
•
•
Note
Introduction
CiscoWorks NCM tracks and regulates configuration and software changes in a multivendor network environment. It provides visibility into network changes and tracks compliance with a broad variety of regulatory, IT, corporate governance, and technology requirements. CiscoWorks NCM helps IT staff identify and correct trends that could lead to problems, such as network instability and service interruption.
What's New in CiscoWorks NCM 1.8
CiscoWorks NCM 1.8 includes the following features:
•
–
–
For information on the HP NNMi-Cisco NCM integration, see the HP NNM Integration User Guide for CiscoWorks Network Compliance Manager.
•
•
•
•
•
–
–
•
•
•
•
•
–
–
–
–
–
–
–
–
What's Been Fixed in CiscoWorks NCM 1.8
Table 1 describes the issues fixed in CiscoWorks NCM 1.8.
Supported Platforms
Table 2 shows the supported platforms for CiscoWorks NCM 1.8.
The following operating systems are no longer supported:
•
•
•
•
Note
Supported Databases
Table 3 shows the databases that are supported by CiscoWorks NCM 1.8.
Except for modest deployments without full enterprise scale and performance requirements, the application server and database server should be on separate physical machines. In addition, the database server should be dedicated to CiscoWorks NCM, rather than serving multiple applications.
Note
The following databases are no longer supported:
•
•
•
Note
Additional CiscoWorks NCM Configurations
If you have configured a High Availability Distributed System, the database requirements for Oracle and Microsoft SQL Server include:
If you have configured a Horizontal Scalability environment, the database requirements for Oracle and Microsoft SQL Server include:
See High Availability Distributed System Configuration Guide for CiscoWorks Network Compliance Manager for information on configuring High Availability Distributed System environment.
See Horizontal Scalability User Guide for CiscoWorks Network Compliance Manager for information on configuring Horizontal Scalability environment.
Note
Virtual Environments
Table 4 lists the virtual servers NCM supports.
Table 4 NCM-Supported Virtual Servers
VMware:
•
•
•
•
•
— Windows— Linux•
•
Microsoft® Hyper-V R2
Oracle Solaris Zones
If you are running NCM in a virtual environment, review the follow guidelines:
•
•
•
–
–
•
•
•
•
•
Performance Issues
To counter performance issues while running NCM in a virtual environment, do the following:
•
•
•
•
A large number of concurrent tasks increases NCM resource demand. If performance issues arise, reduce the number of concurrent tasks or provide more resources to the NCM virtual server. (This suggestion also applies to physical servers.)
Additional Required Applications
You need to install the following applications:
•
–
–
Note
•
•
•
•
•
Note
Hardware Requirements
CiscoWorks NCM requires the following minimum hardware:
Table 6 Database Server Requirements
CPU
Intel Xeon or equivalent, 3.0+ GHz
Memory
16 GB RAM
Swap Space
16 GB
Disk
512 GB, Fast SCSI
Network
100 Mbps Fast Ethernet, full duplex
Known Problems in CiscoWorks NCM 1.8
This section contains information about the limitations and problems known to exist in CiscoWorks NCM 1.8
HP NNMi-CISCO NCM integration in the NNMi console
Bug ID : QCCR1B102485
The HP NNMi-CISCO NCM integration must be enabled and disabled in the NNMi console.The Enabled/Disabled control on the 3rd Party Integrations page controls communication from NCM to NNMi only. It does not fully control the CISCO NNMi-CISCO NCM integration.
Workaround
Write memory command not included in the session log
Bug ID : QCCR1B102502
If you select both of the "Force Save" and "Session Log" options on any device task page, you can expect to see the command used to save the running configuration to startup configuration in the task session log. For instance, for a Cisco device you can usually see the command "write memory" being sent to device in the session log. For certain tasks, you might not see the saving configuration command in the session log, notably the Run Diagnostic task. The command is sent to device but not logged.
Workaround
HP NNMi-CISCO NCM integration: some NCM interface configurations are not available in NNMi
Bug ID : QCCR1B102518
Some NCM interface configurations are available in the NCM console but not in the NNMi console. For information about how NNMi interfaces are mapped to NCM ports, see the HP NNM Integration User Guide for CiscoWorks Network Compliance Manager.
Full-text search returns incorrect results for searches including hyphens
Bug ID : QCCR1B102520
Full-text search queries that contain a hyphen (-) might return more results than expected.
Failure while enabling case-insensitive search (Oracle)
Bug ID : QCCR1B102927
The mod oraclecaseinsensitive -option enable command sometimes returns an error message: GEN_FAILURE: Failed to modify database. In this case, case-insensitive search has not been enabled. Wait for few minutes, and then rerun the mod oraclecaseinsensitive -option enable command.
Autopass license overrides legacy license
Bug ID : QCCR1B95407
Introducing an CISCO Autopass license key prevents NCM from using a legacy license key. This issue affects customers who upgrade to NCM 1.8. It can take two forms:
•
•
Workaround
1.Locate the Autopass license file:
•
•
2.In a text editor, delete the contents of the lickeys.dat file, and then save the empty file.
3.Verify that an appropriate legacy NCM license (license.dat file) exists in the NCM root directory.
4.If an additional capacity Autopass license caused the issue, contact your Cisco Sales Representative to request a legacy format license key for the additional capacity, and then apply that key.
5.Restart the NCM management engine.
NCM now runs with the legacy license from the license.dat file.
Enabling cross-site scripting checks causes garbled characters in NCM 1.8 on SJK systems
Bug ID : QCCR1B91853
On a non-English system, when the "Cross site scripting check" check box is selected on the Admin > Administrative Settings > User Interface page, user-entered values, such as group, policy, and policy rule names, might include garbage characters.
Incorrect SNMPv3 Configuration Prevents Correct Device Detection
Bug ID : QCCR1B86730
For a device whose NCM configuration includes SNMPv3 settings, NCM first tries to communicate with the device using SNMPv3. NCM then tries the SNMPv1 or SNMPv2c settings. If the SNMPv3 settings are incorrect, NCM does not recognize that the SNMPv3 connection failed and detects the device as a non-active node or an unrecognized host. Therefore, NCM does not attempt SNMPv1 or SNMPv2c communication with the device.
Workaround
Using SNMPv3 with Privacy and AES192 and AES256 Encryption
Bug ID : QCCR1D88942
Several tasks, including Detect Network Devices and Discover Driver, do not correctly use SNMPv3 with the AES192 or AES256 encryption privacy protocol.
Workaround
SNMP Timeout Value Might Be Too Short for SNMPv3 Communications
Bug ID : QCCR1B87867
If you encounter frequent timeouts during communications with SNMPv3 devices, increase the value of the SNMP Timeout setting on the Device Access tab of the Administrative Settings page.
Telnet and SSH Sessions (IPv6 devices)
Bug ID : QCCR1B87641
NCM does not cache telnet or SSH sessions to IPv6 devices. Therefore, these histories are not available from the device information page.
Alternate Driver Discovery (IPv6 devices)
Bug ID : QCCR1B87801
Alternate driver discovery incorrectly interprets the first colon (:) of an IPv6 address as indicating a port on the device.
Users Without Permissions to All Partitions Might Not Be Able to Compare Device Configurations
Bug ID : QCCR1D94263
Users with access to some, but not all, partitions do not see the options for comparing devices on the Configuration Changes tab of the Devices page.
Custom Diagnostics
Bug ID : QCCR1B86671
NCM enables you to define custom diagnostics to capture specific information that is useful in your environment. If the name of a custom diagnostic is longer than 80 characters, the Device Diagnostic page shows the content of the most recent diagnostic. However, the Diagnostics History table at the bottom of the page does not appear due to a rendering error.
Polices Page
Bug ID : QCCR1D86308
Users with Admin permissions can view the full list of policies on the Policies page and segment polices into separate policy tags. However, users with Full Access permissions cannot filter policies based on policy tags when there is more than one site partition.
NCM-NNMi Integration (IPv6 devices)
Bug ID : QCCR1B86228
NCM-NNMi integration does not support synchronizing IPv6 devices. Only IPv4 devices are supported.
Using the mod authentication command
Bug ID : QCCR1D116666
When there are no device specific authentication records to modify for a device the mod authentication command reports the following error:
GEN_FAILURE : The Device Password Information for Device you requested can not be found. It may have been deleted.Workaround
Network Diagrams
Bug ID : QCCR1D113667
Network diagrams can be viewed in either Visio, static JPEG, or interactive JPEG format. When installing NCM 1.8 on Windows Server 2008, JPEG formatted network diagrams do not contain icons.
Memory Allocation Error
Bug ID : QCCR1D114717
If you have installed NCM on a Linux platform, you might see the following error in the log messages or within the results of failed NCM tasks:
Caused by: java.io.IOException: error=12, Cannot allocate memory
Note
Workaround
echo 1> /proc/sys/vm/overcommit_memoryUsing API calls to move sites and tasks
Bug ID : QCCR1D112938
Currently, NCM 1.8 does not support failover scripts when a NCM Core goes down in a Distributed System or Horizontal Scalability environment.
Workaround
Note
Uninstalling NCM
Bug ID : QCCR1B103211
If the current NCM is 64-bit and was upgraded from 32-bit NCM, the NCM uninstaller does not work.
Workaround
1.Stop NCM services (this includes TFTP, Syslog, SWIM, and FTP).
2.Rename <NCM install dir>/jre.
3.Rename <NCM install dir>/jre_old to <NCM install dir>/jre.
4.Run the NCM uninstaller.
FTP Service (Starting)
Bug ID : QCCRID114411
If you restart NCM through the CLI on a Linux or Solaris platform, the FTP service will not start. You must start the FTP service via the NCM Web UI after the NCM has been started.
Note
FTP Accounts
Bug ID : QCCR1D112098
The NCMUserManager class utilizes a configuration option to identify the username and password of the authorized FTP account. There is only one FTP account at this time. If the NCM administrator changes the configuration value in NCM, the FTP server will not be aware of the change until it has been restarted because the FTP server does not reload configuration options before performing a user check.
Workaround
CLI driver discovery via Bastion Host does not work for some devices
Bug ID : QCCR1D105486
When configuring a device to use a Bastion Host server with SSH, the Discover Driver task fails with the following error message: This task did not complete
In addition, the Session Log is not stored for the failed task.
Workaround
Oracle Database Log Files
Bug ID : QCCR1D1114453
Oracle database users could encounter the following error in their log files, associated with a failed query:
java.sql.SQLException: ORA-00600: internal error code, arguments: [kglhdgn_1], [0xA000000], [0], [2], [], [], [], []
This is an Oracle internal error, normally handled by the DBA and Oracle Support. The error is shown below:
ORA-00600 internal error code, arguments: [string], [string], [string], [string], [string], [string], [string], [string]
This is the generic internal error number for Oracle program exceptions. It indicates that a process has encountered a low-level, unexpected condition. Causes of this message include:
•
•
•
•
•
The first argument is the internal message number. Other arguments are various numbers, names, and character strings. The numbers may change meanings between different versions of Oracle.
Workaround
VLAN Searches
Bug ID : QCCR1D102754
VLAN searches saved in NCM 1.4 or earlier are not valid in NCM 1.8 because of VLAN features added in NCM 1.5.01. If you attempt to view a saved VLAN search, you could see the following error message:
Error executing query VLAN: PortInVlanName is not a valid field name for this query.
Workaround
Uploading Large Image Files
Bug ID : QCCR1D99027
Currently, NCM is limited to uploading device configurations no greater than 1GB.
Provision Device Task
Bug ID : QCCR1D102620
Although the Provision Device task enables you to select more than one device, the task only works with one device (or when using a .csv file for multiple devices). Attempting to select more than one device, or a device group, using the Device Selector will cause an error.
Canceling Tasks
Bug ID : QCCR1D101509
If you cancel a task that is currently communicating with a device, NCM could mark subsequent attempts to run the task (or similar tasks) as "skipped". This could happen even if communication between the task and the device seem to be hung and you are waiting for a timeout.
This issue can occur because NCM is looking for a clean opportunity to end communication between the task and the device before actually canceling the task. As a result, NCM will continue to execute the task until that point is reached. Any attempt to rerun the task before it is canceled will appear to NCM as if the task is already in progress. As a result, NCM will mark the new task as "skipped". You must give NCM ample time to finish with the canceled task. Once that has occurred, NCM will be able to rerun the task.
Using the $tc_device_enable_password$ variable in command scripts
Bug ID : QCCR1D100314
When using the $tc_device_enable_password$ variable in a command script, if the device enable password contains an at sign (@) character, the @ character will be preceded by a backslash (\) character.
Device Managed IP Addresses Page
Bug ID : QCCR1D101755
When making changes to the Device Managed IP Address, because NCM attempts to remember a connection path, the change might not take effect.
Workaround
Setting Parent Task Priority
Bug ID : QCCR1D98393
When changing a parent task's priority that is currently running, any existing child tasks that are in the "Pending" or "Waiting" state will appropriately change their priority to that of the parent task. However, child tasks that have not been created yet or are in another state, such as "Running" or "Paused" will retain the parent task's original priority. If a parent task is not running and its priority is changed, all of the parent task's child tasks take on the new priority.
Testing OpenLDAP User Authentication
Bug ID : QCCR1D99664
When configuring NCM to use OpenLDAP for NCM user authentication, save the configuration before using the test function to verify the settings.
Using LDAP Servers
Bug ID : QCCR1D99663
If you are using a LDAP server for external user authentication, you might need to modify certain LDAP related options in the appserver.rcx file. The default settings will work with the Active Directory server under most situations. However, for other types LDAP servers (depending on the LDAP schema configurations), you might need to customize the following settings if you are experiencing issues with the default settings:
<!-- Attribute mapping for Generic LDAP server-->
<option NCMme="ldap_server/attr_mapping/Generic/group_search">group,organizatioNCMlunit, container,groupOfUniqueNCMmes</option>
<option NCMme="ldap_server/attr_mapping/Generic/group_NCMme">NCMme,cn,commonNCMme</option>
<option NCMme="ldap_server/attr_mapping/Generic/member_search">member,uniqueMember </option>
<option NCMme="ldap_server/attr_mapping/Generic/userNCMme_search">samAccountNCMme,uid,cn </option>
Ignore the following settings. They are not used at this time.
<!-- Attribute mapping for SunLDAP server-->
<!-- Attribute mapping for OpenLDAP server-->
The "group_search" option specifies the list of LDAP entries to search for in the LDAP groups.
This information is used in Step 3 of the LDAP Setup Wizard, where you define the LDAP groups to specify the members are allowed to login to NCM.
Consult with your organization's LDAP Administrator to ensure that the list contains all necessary group attributes. For example, it might be necessary to add "groupOfName" to the list for the LDAP group search to work.
The same concept applies to "username_search" and "member_search". Both of these are used during the NCM login process to positively identify the user and to determine the user's group memberships. If the default LDAP attribute names do not match your LDAP schema configuration, change them accordingly.
The "group_name" option specifies the attribute names that usually contain the group name. If the attribute name for the LDAP group is not "name", "cn", and "commonName", you must modify them accordingly. You rarely need to change this option, however.
After you make the appropriate changes, save the appserver.rcx file and restart the NCM server.
Device Relationships
Bug ID : QCCR1D100298
Scripting to a vSwitch is done via direct API calls to the containing ESX server. As a result, there is no way to prevent scripts from modifying ESX server settings outside those that pertain to the vSwitch.
This is true even in cases where MSP permissions are being granted to the vSwitch, but not the containing ESX server.
Including URLs in Policies
Bug ID : QCCR1D98621
When creating a policy and including a vendor solution URL and/or a vendor advisory URL, the URL must start with the "http://" prefix, otherwise the link might not be correctly interpreted by the browser.
Note
Running NCM on a Solaris Platform
Bug ID : QCCR1D99873
When starting the NCM server on a Solaris platform, there is a remote chance that the NCM server will crash due to an error in the native frame_sparc.cpp file. This is due to a bug in the Solaris JVM Biased Locking feature.
Workaround
wrapper.java.additional.#=-XX:-UseBiasedLocking
Where # is the next number in sequential order of all the parameters. For example, if the jboss_wrapper conf file has the following arguments, the workaround VM argument would be #6.
wrapper.java.additional.1=-DTCMgmtEngine=1
wrapper.java.additional.2=-Duser.dir=C:\NCM\server\ext\jboss\bin
wrapper.java.additional.3=-Xmn170m
wrapper.java.additional.4=-Djava.awt.headless=true
wrapper.java.additional.5=-Dfile.encoding=UTF8
wrapper.java.additional.6=-XX:-UseBiasedLocking
Viewing VLAN Information for a Port/Interface
Bug ID : QCCR1D98139
When viewing device MAC Addresses details on the MAC Address Details page, the VLAN field is not populated.
Workaround
Using Active Directory
Bug ID : QCCR199633
If you are using Active Directory, you must modify the corresponding options in the appserver.rcx file to include the correct attributes in the search mapping session.
•
•
"groupOfName" is included in the "group_search".
"uid" is included in the "username_search".
"member" is included in the "member_search".
•
•
Java Plug-in Version
Bug ID : QCCR1D88659
If the Connect function fails and the NCM server hangs, check the version of Java running on your Windows system. This is problem with the Java Plug-in to your Web browser. The issue is not with the NCM server.
To check what version of Java you are running:
Step 1
Step 2
Step 3
The Java version will be displayed
If you have Version 6 Update 11 or later, you must install an older JRE on your Windows system. Version 6 Update 10 and earlier are known to work.
Using the Device Group Selector
Bug ID : QCCR1D98865
Some Chinese characters will not be displayed when using the Device Group Selector.
Creating advanced Perl scripts
Bug ID : QCCR1D101541
While creating an advanced Perl script, remember that NCM treats $some_text$ as reserved variables. If you use '$' pairs in the script that are not NCM variables, ensure you separate them with a space.
For example:
Incorrect: my($host,$port,$user,$pass) = ('localhost','$tc_proxy_telnet_port$', '$tc_user_username$','$tc_user_password$');
Correct: my($host, $port, $user, $pass) = ('localhost','$tc_proxy_telnet_port$', '$tc_user_username$','$tc_user_password$');
Error when viewing results for diagnostics with single quotes in their name
Bug ID : QCCR1D95468
When creating a diagnostic with single quotes in its name, such as "Ana's Diagnostic", after running the diagnostic against a device, the diagnostic results are not displayed.
Workaround
Diagnostic Name Limit
Bug ID : QCCR1D96090
When naming a diagnostic, you are able to enter up to 100 characters. However, when running the diagnostics, the name is limited to 50 characters.
Workaround
Using SCP with devices in remote Realms
Bug ID : QCCR1D87003
Devices in remote Realms cannot use the Secure Copy (SCP) Transfer Protocol because in most cases, the remote Gateway Satellite Agent cannot use SSH/SCP port 22, since the Gateway OS is already using the port.
Workaround
Solaris and SecurID
Bug ID : QCCR1D86370
Configuring NCM to use SecurID as the authentication method can cause the management service to crash. The SecurID libraries provided by RSA are the source of the problem. Currently, the problem can occur on Solaris 10 with a version string of "SunOS 5.10 Generic_118833-22", while version "SunOS 5.10 Generic_120011-14" works fine. Please update your OS to at least this version if you are experiencing problems with SecurID on Solaris until this issue can be resolved.
Using SCP on Linux and Solaris
Bug ID : QCCR1D82379
The Secure Copy (SCP) Transfer Protocol enables you to securely transfer files between a local and remote host or between two remote hosts using the Secure Shell (SSH) protocol. When using SCP on a Linux platform, you will need to modify your system's SSH daemon (SSHD) to run on an alternate port and restart the SSHD service. Port 8022 is recommended.
Once the system's SSHD is reconfigured, you can restart NCM so that it can bind to Port 22. System administrators will need to 'ssh -p 8022 userNCMme@host' to login via the system's SSHD after the change is made.
Note
When logged-in to NCM, you can NCMvigate to the Device Access page (Admin ' Administrative Settings ' Device Access). Scroll down to the SSH Device Access field. Enter a SSH User and SSH Password. The device driver will use this information when copying files to the NCM server.
Note
1 To use SCP with remote Realms, the SCP connection must be made back to the managing NCM server. A SCP connection to the NCM Gateway will not succeed because the NCM Gateway runs the Linux and Solaris system SSHD. The NCM Gateway sets the host to the NCM Gateway and not the managing NCM Core. This can be overridden by setting an access variable (TFTPServer) to the IP address of the managing NCM Core. Refer to the Satellite User Guide for CiscoWorksNetwork Compliance Manager for detailed information.
Using SCP
Bug ID : QCCR1D80180
The SSH protocol runs on port 22. Secure Copy (SCP) is a data transfer mechanism that uses the SSH protocol. By default, Linux and Solaris installs run on port 8022. Windows installs run on port 22. For Windows installs, if the port is switched to 8022, there could be connectivity issues. (Because most devices do not allow for the specification of an alternate port, this issue if uncommon.)
Note
Proxy Interface
Bug ID : QCCR1D86391
If you login to NCM as a limited access user and attempt to connect to a device via the proxy interface, the connection will be dropped at the username/password prompt.
SNMP Timeouts
Bug ID : QCCR1D75228
Using SNMP device discovery over networks with latency can cause SNMP timeouts. To resolve this issue:
1.Login to NCM.
2.On the menu bar under Admin, select Administrative Settings and click Device Access. The Administrative Settings - Device Access page opens.
3.Scroll down to the Detect Network Devices and Port Scan Task Settings section and set SNMP Timeout to a higher value, for example 2500 (milliseconds).
-sync option
Bug ID : QCCR1D79600
When Workflow is enabled, attempting to run a CLI or API task with the -sync option will fail with a "No such directory' error.
Database Passwords
Bug ID : QCCR1D61595
Any NCM user input cannot contain multiple dollar signs ($$). As a result, if the password you use to connect to the database contains multiple dollar signs, you must modify the password before installing NCM.
Installation Address
Bug ID : QCCR1D78975
The IPv4 address range 169.254.0.0/16 is reserved for link-local usage (referred to as APIPA: Automatic Private Internet Protocol Addressing, by Microsoft) and is not applicable addressing for a network application server such as NCM. For more information, refer to http://www.ietf.org/ (rfc 3330 and rfc3927).
SSH Communication
Bug ID : QCCR1D78861
NCM 1.4 introduced a new set of keys for SSH communication. In releases earlier than NCM 1.4, NCM used one Digital Signature Algorithm (DSA) key for all installations. When you upgrade to NCM 1.4 or NCM 1.5, NCM creates two, new 1024 bit keys. The first key uses the DSA algorithm. The second key uses the RSA algorithm. These keys are used when you connect to NCM via SSH.
Custom Data Setup
Bug ID : QCCR1D77153
Custom data fields enable you to assign useful data to specific devices, configurations, users, and so on. This gives you added flexibility and enables you to integrate NCM with other applications.
To add custom data, on the menu bar under Admin click Custom Data Setup. The Custom Data Setup page opens. Custom data field can include alphanumerics and underscores. While you can use dashes, custom data field names with dashes cannot be used with tc_device_custom device variables in custom scripts.
Advanced ACL Scripts
Bug ID : QCCR1D74295
Selecting the "Update Script" button when specifying an advanced ACL script can lock-in values. As a result, running (or re-running) the script could result in variables not being updated properly.
Workaround
Use of Dollar Signs ($) in Scripts
Bug ID : QCCR1D69342
If generating a script from a Telnet/SSH session log, the script will fail or perform in unexpected ways if the session contains dollar signs ($) in the executed commands.
OS Analysis Task
Bug ID : QCCR1D67566
When using NCM in an environment with overlapping IP addresses, the OS Analysis task is not supported for devices behind remote Realm gateways. OS Analysis tasks run on devices in the locally reachable network. This could result in an image recommendation being incorrect for devices behind the gateway. Keep in mind that NCM will report OS recommendations for a device in the default Realm instead of a remote Realm if they share an IP address.
Email Report Task
Bug ID : QCCR1D69342
When scheduling an Email Report task, if you select a report other than Summary Reports in the "Reports to run" field, the task is reported as failed. However, the report is successfully emailed to the recipient. You can disregard the error message.
Template Scripts
Bug ID : QCCR1D70552
When using template scripts (i.e., Batch insert line into ACL by handle), selecting the Run Again option will rerun the same script. Attempting to change fields will not change the script that is run.
NCM Core Gateways
Bug ID : QCCR1D68751
You cannot configure redundant NCM Core Gateways in the same NCM Realm as a single NCM Core.
Workaround
<array name="rpc/allowed_ips">
<value>10.255.54.10</value>
</array>
Oracle database errors cause failed tasks and other issues
Bug ID : QCCR1D69094
Oracle database errors cause failed tasks and other issues due to a bug in the JDBC Oracle driver. As a result, it is possible for the driver to cause database errors-causing tasks to fail and other issues. The error message information is OALL8 is in an inconsistent state.
Workaround
Potential for task failure when using reserved NCM characters in device prompts
Bug ID : QCCR1D70102
There are eleven characters with special meanings to NCM:
•
•
•
•
•
•
•
•
•
•
If you use these characters in a device prompt, null pointer exception errors could occur during task execution. As a result, the task will fail.
Workaround
ACLs with the same name, but different case in NCM, is not recommended
Bug ID : QCCR1D61744
NCM supports case-sensitivity in ACL names. As a result, you can have two ACLs with the same name, but different case. If you delete one of those ACLs, however, all ACLs with the same name are deleted, regardless of the case. Cisco does not recommend multiple ACLs with the same name, but differing case in NCM.
Use of the dollar sign ($) in Perl code
Bug ID : QCCR1D61867
If you convert a Telnet/SSH Proxy session that contains a dollar sign ($) to Perl (such as a script that puts a $ in the banner), NCM does not properly escape the dollar sign ($) in the generated Perl code.
Workaround
Batch editing parent device groups or device groups
Bug ID : QCCR1D61742
When you batch edit devices in a parent device group or in a device group or partition that has no devices, an invalid error message is displayed: You do not have Modify Device Permission for any of the devices you selected.
Workaround
Downloading software images from Cisco.com
Bug ID : QCCR1D66891
You can download software images from Cisco.com for devices that are not currently in your NCM system. However, to be able to successfully deploy the software image, you may need to modify the driver and/or model information.
Workaround
1.From the Devices menu, select Device Tools and click Software Images. The Software Images page opens.
2.In the Action column, click Edit for the software image you want modify. The Edit Software Image page opens.
3.In the Image Set Requirements field, modify the driver and/or model information to be compatible with the device in NCM.
4.Click the Save Software button.
Multimaster Distributed System: Importing Devices
Bug ID : QCCR1D59742
If you import two devices with identical IP addresses into two separate NCM Cores at approximately the same time, there is currently no way to detect the possibility of a duplicated device.
Workaround
Multimaster Distributed System on SQL Server
If you see a conflict entry for which the reason_text field does not reference a constraint name, it is possible that NCM automatically resolved the conflict. In which case, delete the conflict entry. If NCM did not resolve the conflict, make the appropriate corrections and then delete the conflict entry. The following is an example of a reason_text field from a conflict that does not reference a constraint name:
reason_text A row insert at 'red-dalmssql102.ds2880db2' could not be
propagated to 'RED-DALMSSQL101.ds2880db1'. This failure can be caused by a
constraint violation. The merge process was unable to synchronize the row.
Detect Network Devices Task
The NCM system prevents you from inadvertently running more than one Detect Network Devices task concurrently. Although the Detect Network Devices task generates only a minimal level of traffic, NCM provides this protection to help minimize additional traffic when running duplicate or additional Detect Network Devices tasks simultaneously.
If a second or third Detect Network Devices task is scheduled while an earlier Detect Network Devices task is running, NCM will place the new task(s) in the "Waiting" state. The task(s) will run individually after the first Detect Network Devices task has completed.
Diagramming
NCM applies an absolute value for the "text height" attribute for interface and port labels shown in Visio diagrams. When the Visio VDX file is loaded, Visio assigns an incorrect formula to the "text height" attribute. As a result, when you have more than two lines of annotated text (i.e. a label) for an interface or port and you attempt to copy & paste, the label of the new interface or port is displayed improperly and could hide the interface or port icon.
Workaround
Multimaster Distributed System Performance
When running a Distributed System, if you are deleting many objects simultaneously, the system may take a while to push transactions for large delete operations.
Multimaster Distributed System External Authentication
When using external authentication in a Multimaster Distributed System environment, the External Authentication Type, for example TACACS+ or Active Directory, is global (i.e., shared between all NCM Cores). Specific authentication server information is NCM Core specific. QCCR1D53815
Workaround
RADIUS External Authentication
Bug ID : QCCR1D9099
When setting up a user to authenticate using RADIUS, if the RADIUS server does not respond, NCM still authenticates the user against the NCM local password, even if you instruct NCM not to fail-over on external authentication.
Tasks: Running External Application tasks presents a possible security risk
Bug ID : QCCR1D14089
All Run External Application tasks run the application with root (UNIX) or system (Windows) privileges. This is a potential security risk that should be acknowledged by the System Administrator before using the Run External Application feature.
Scripts: Output results in HTML Format
Bug ID : QCCR1D21216
When executing an advanced script or a Run External Application task, any text that the advanced script or external application writes to 'stdout' is stored in NCM as the task result. Typically, this output is treated and displayed as plaintext. As a result, before NCM displays the task results, it will escape any characters that would affect the HTML rendering, for example converting < to <.
However, you may want to create an advanced script that outputs its results in HTML format. In this case, none of the output characters would be escaped, so the results displayed would include any applicable HTML formatting. To indicate to NCM that your script outputs HTML results, the first item that your script writes to 'stdout' must be <html>. If your script output begins with anything other than <html>, the script results will be treated as plaintext.
Nmap Scanning
Bug ID : QCCR1D19036
Careful consideration should be taken when identifying the network range you are going to scan. Some network topologies can result in very long scans. In addition, it is recommended that you do not scan Internet addresses. If you think your Nmap scan will take more than a few minutes, you can use several Nmap options, for example --max_scan_delay <milliseconds>, setting <milliseconds> to a value between 1 and 1000. Nmap will throttle up to 1000ms max as packets are dropped.
Keep in mind that Nmap settings can be changed using the Administrative Settings option under Admin on the menu bar, and selecting the Device Access option. Please refer to the Nmap documentation at www.insecure.org for detailed Nmap information.
SecurID Software Token Software, Version 3.x
Bug ID : QCCR1D18988
If the NCM server is installed with the 3.x SecurID token software, turn off copy protection when exporting SecurID software token keys on the RSA server. Otherwise, NCM reports an error when accessing SecurID software tokens. A patched version of the SecurID software is available at RSA's website (http://www.rsasecurity.com).
Canceling or Deleting Tasks
Bug ID : QCCR1D16257
Some NCM tasks will spawn external processes to run PERL or Expect scripts, or to run user-provided executables or shell scripts. Under certain circumstances, NCM may not be able to kill these external processes when the spawning task is cancelled or deleted. This could include scripts that spawn sub-processes or processes that are coded to catch kill signals.
Workaround
Tasks: A task scheduled for the 31st might run on the 1st
Bug ID : QCCR1D11142
If you schedule a monthly recurring task for the 31st of every month and that task runs during a month that contains fewer than 31 days, NCM will run the task on the 1st, 2nd, or 3rd day of the next month depending on how many days fewer than 31 the previous month contains. For example, if you schedule a task in February (with 28 days) for the 30th, the task will actually run on March 2nd. If you want to run the task on the last day of the month, you must set the date correctly.
Inventory: Data from device overwrites manually entered values
Bug ID : QCCR1D11942
Certain data on the Device Details page (and other pages) is auto-populated. If you manually change the data, NCM overwrites the values when the next snapshot occurs. .
The automatically populated data includes:
•
•
•
•
•
•
Console Server: SSH access is not supported
Bug ID : QCCR1D11402
NCM does not support console server access via SSH. If you use a console server to access a device, you must use the Telnet connectivity. In other words, on the New Device page/Edit Device page, if "Use to access device" is checked in the Console Server Information section, you should make sure that the "Telnet" option in the Connection Information section is also checked.
Sending reports to external email addresses
Bug ID : QCCR1D15982
Even though you may have properly configured NCM to contact your SMTP server, for network security reasons your SMTP server could have been configured to reject messages from the NCM server address. In this case, you would see the following error message, and any NCM messages would not be delivered.
Error occurred when sending email. Please check the email address and/or your SMTP server settings.
If this occurs, you will need to configure the SMTP server to enable the NCM server to relay email messages through it.
Non availability of Mail.jar
The mail.jar is not available in the directory /<NCM Directory>/server/ext/jboss/server/default/lib/
Workaround
Accessing the CiscoWorks NCM Documentation Set
All or any part of the CiscoWorks NCM documentation set, including this document, might be upgraded over time. Therefore, we recommend that you access the CiscoWorks NCM documentation set using the following URL: http://www.cisco.com/en/US/products/ps6923/tsd_products_support_series_home.html
Tip
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
Open a service request online at:
http://www.cisco.com/techsupport/servicerequest
View a list of Cisco worldwide contacts at:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2012 Cisco Systems, Inc. All rights reserved.
