Guides Book a demo

Network backup / Comparing versions

Comparing configuration versions

How to read the difference between two backups, tell real changes from noise, and use the history to find the cause of an incident in minutes.

Updated
Audience
Network and NOC teams
Reading time
5 min

01How to read a diff

Lines starting with - were in the old version and were removed; lines with + were added in the new one. The rest is context. An example on a MikroTik where the NAT source address was changed:

/ip firewall nat
-add action=src-nat chain=srcnat out-interface=sfp1 to-addresses=203.0.113.10
+add action=src-nat chain=srcnat out-interface=sfp1 to-addresses=203.0.113.20

A changed line shows up as a removal followed by an addition.

02Using it during an incident

"Subscribers in neighborhood X went down at 2 p.m." The routine:

  1. open the history of the devices in that area;
  2. compare the last version before 2 p.m. with the first one after;
  3. if a change shows up at that time, it is the first suspect;
  4. if the change was the problem, undo just that section (partial restore).

When there is no configuration change in the period, that is information too: the cause is probably physical, power-related or external, and the team stops looking in the wrong place.

03Noise: lines that change on their own

Some devices put the collection date and time, counters or transient messages in their output. If that stays in the file, every collection looks like a change, and the real changes get lost among them.

Examples Nexus removes before saving:

DeviceLine removed
MikroTik RouterOSDate and time at the top of /export, interface down warnings
ZTEtimestamp_write
VSOLWelcome banner, last login, lines with date and time

If you build your own collection, filter those lines out before comparing.

04What, when and who

Backup history answers what changed and between which collections. It does not know who made the change. For that:

  • use centralized authentication (TACACS+ or RADIUS) with command logging;
  • on Juniper, show system commit lists who made each commit and when;
  • on MikroTik, /system history print shows the latest actions and the user. Nexus records that history as a comment in every RouterOS backup;
  • give each person their own user on the devices, with no shared logins.

05Reviewing planned changes

After a maintenance window, run a backup and compare it with the previous one. The diff should contain only what was planned. Any extra line is a typo, a command on the wrong device or something nobody documented, and it is better to find out right away than at the next incident.