Config Backup
Automatic, versioned backups of your network device configurations.
Config Backup keeps a versioned history of the configuration of every network device in your estate. QUARK connects to each device on a schedule, retrieves its running configuration, and stores it centrally — so every change is captured, attributable, and reversible.
What you get
- Scheduled backups — configurations are pulled automatically every hour.
- Change tracking — every retrieved configuration is compared against the previous version. When something changes, a new version is stored and the change is highlighted.
- Diffs — compare any two versions of a device's configuration side by side.
- Change alerts — get notified when a device's configuration changes, expectedly or not.
- Restore reference — when a change causes an incident, the last known-good configuration is one click away, ready to be reapplied to the device.
How it works
Config Backup connects to devices the same way an engineer would — over SSH (or Telnet where SSH is unavailable, and vendor APIs where that is the native method) — using a dedicated set of credentials that you create on the device. It reads the configuration and disconnects; it never modifies the device.
Devices are enrolled through their host in Netwatch: a set of {$CONFIGBACKUP_*} macros on the host marks the device for backup and tells the collector which operating system it runs and how to log in. Once the macros are in place everything else is automatic — the device list refreshes every hour, and each enrolled device's configuration is retrieved on the hourly schedule.
For this to work, each device needs to be prepared once:
- Reachability — the device's management interface must be reachable from your Netwatch collector.
- A backup account — a dedicated user on the device with enough privilege to display the full configuration. A read-only account is sufficient on most platforms.
- SSH enabled — or the platform's native management API, depending on the device.
The exact steps vary by vendor and operating system. See the per-vendor guides under Supported devices.
Getting started
- Prepare the device following its guide in Supported devices.
- In Netwatch, go to Data collection > Hosts, open the device's host, and switch to the Macros tab.
- Add the following macros:
| Macro | Type | Value |
|---|---|---|
{$CONFIGBACKUP_STATUS} | Text | supported — enrolls the device in backup. The value is exact-match and case-sensitive; anything else is ignored. |
{$CONFIGBACKUP_MODEL} | Text | The code for the device's operating system — for example routeros for MikroTik RouterOS, ios for Cisco IOS, junos for Juniper Junos. A device without a model is skipped. If you are unsure of the code for your platform, contact your Netwatch representative. |
{$CONFIGBACKUP_USERNAME} | Secret text | SSH username of the backup account you created on the device. |
{$CONFIGBACKUP_PASSWORD} | Secret text | SSH password of the backup account. |
{$CONFIGBACKUP_SSHPORT} | Text | Optional. Set only if the device does not listen for SSH on port 22. Unset or invalid values fall back to 22. |
Set the two credential macros to type Secret text so their values are hidden from the interface and the API. A device whose credential macros are missing is silently skipped, so make sure both are present.
Macros follow Netwatch inheritance (host → template → global). A fleet that shares one backup account can define the macros once on a template and override per host only where needed — for example, set the status, username, password, and port on a template and only the model on each host.
- Check the host's interface and name. The collector connects to the address on the host's agent interface — a configured IP address is preferred, with DNS as the fallback — so make sure the interface holds the address you want backups to use. The host's visible name becomes the backup's filename and its place in the version history, so keep it meaningful; hosts with duplicate names are suffixed with their address rather than merged.
The first backup appears within two hours of enrolling a device — the device list refreshes hourly, and backups then run on the hourly schedule.
Note: none of the values — host name, address, model, username, or password — may contain a colon (:) or a newline. A device with such a value is skipped.
If a device isn't being backed up
Work through these checks on the device's host in Netwatch:
{$CONFIGBACKUP_STATUS}is exactlysupported(case-sensitive, no extra whitespace).{$CONFIGBACKUP_MODEL}is present and holds a valid model code.- Both credential macros exist on the host or are inherited from a template, and the credentials work — test by hand with
ssh -p <port> <user>@<address>from a machine near the collector. - The device is reachable from the Netwatch collector on the SSH port (firewall rules, management ACLs, and
{$CONFIGBACKUP_SSHPORT}if the device uses a non-standard port). - No value contains a colon or newline.
- Allow up to two hours after enrolling before expecting the first backup.
If everything checks out and backups still don't appear, contact your Netwatch representative.