“Enterprise network monitoring software vendors quoted $80,000 for commercial licenses. We rejected the quote and integrated rsyslog, RANCID, CACTI, Observium, and iTop to build a complete 24/7 NOC observability stack for zero licensing dollars.”

In September 2013, during my tenure as Assistant Manager at Net4 India, we managed an extensive ISP backbone and datacenter network spanning 3,000 active interfaces across Cisco, Foundry, and Juniper routers.

Our infrastructure was growing rapidly. Our operational monitoring tools were non-existent.

I put together a proposal to purchase a commercial enterprise network management software suite (SolarWinds / HP OpenView).

The sales quote came back: $80,000 USD per year in license fees.

The executive board rejected the proposal immediately: “We have zero rupees allocated for software licensing this fiscal year. Make do with what you have.”

---

The Darkness of Flying Blind

Operating a 3,000-interface ISP network without telemetry meant flying blind.

When an optic failed on a primary fiber link in Noida, engineers spent 45 minutes manually SSHing into dozens of edge routers running show interfaces to find which circuit had dropped.

Configuration management was equally chaotic.

A night-shift engineer logged into a core BGP router, modified a prefix-list to fix a customer routing issue, and forgot to save the running configuration to startup memory (copy running-config startup-config).

Three weeks later, during a routine datacenter power maintenance window, the core router rebooted.

The un-saved BGP configuration vanished. Twenty commercial ISP clients lost external BGP routing.

Because there was no version control or configuration history, the on-call team spent four hours re-inventing the missing prefix-list rules from memory while clients demanded SLA penalty refunds.

Flying blind was costing the business far more than $80,000 in lost reputation.

---

The Solution: The 5-Tool Open-Source NOC Stack

Instead of operating in the dark, I engineered a unified Open-Source NOC Operations Stack by integrating five complementary open-source Linux tools on a single CentOS server cluster.

# The 5-Tool Open-Source NOC Architecture ($0 License Cost)

| Tool                       | Primary NOC Function              | Technical Engine                                     |
| -------------------------- | --------------------------------- | ---------------------------------------------------- |
| **CACTI**                  | Bandwidth Telemetry & Capacity    | High-frequency C Spine SNMP poller + RRDtool graphs  |
| **Observium**              | Auto-Discovery & Topology Mapping | LLDP/CDP neighbor discovery + MySQL backend          |
| **RANCID + CVS**           | Configuration Version Control     | Automated `clogin` SSH pulls + CVS diff email alerts |
| **rsyslog + LogAnalyzer**  | Centralized Event Logging         | Syslog daemon parsing BGP/OSPF flaps to MySQL        |
| **iTop CMDB + RackTables** | Asset Management & IPAM           | ITIL CMDB web portal + 42U rack visualizer           |

# Sample RANCID Expect Script (clogin) Nightly Backup Task
# 1. Connects via SSH to core switches using encrypted credentials
# 2. Issues "show running-config" and strips dynamic clock uptime timestamps
# 3. Commits configuration to CVS repository and emails diffs to NOC team

clogin -c "show running-config" core-sw01.net4.in > /var/rancid/configs/core-sw01.cfg
cd /var/rancid/configs && cvs commit -m "Automated Nightly Backup Check" core-sw01.cfg

The Power of Automated RANCID Diff Alerts

The moment an engineer typed configure terminal and modified a router configuration, RANCID detected the change during its hourly execution run.

RANCID generated a clean diff text file highlighting the exact lines added or removed and emailed it directly to the NOC team mailing list:

# Automated RANCID Email Diff Alert:

Device: core-bgp-rt01.net4.in
Author: User 'sachin' via vty0
Diff:

- ip prefix-list CUST-BLOCK permit 202.71.10.0/24

* ip prefix-list CUST-BLOCK permit 202.71.10.0/24 le 32

If a router rebooted three weeks later and lost its configuration, any engineer could pull the exact known-good configuration file from the RANCID CVS repository in 15 seconds and restore service instantly.

---

The Impact

• $80,000 Cost Savings: Built a world-class 24/7 NOC observability platform at zero software licensing cost.
• Sub-Minute Outage Triage: Reduced link failure identification times from 45 minutes to 30 seconds via Observium and CACTI telemetry.
• 100% Config Auditing: Captured an immutable commit history for every network configuration change across 3,000 interfaces using RANCID.

Key Takeaway

Integrate Open-Source Toolchains to Achieve Enterprise Observability.

Do not assume 24/7 NOC observability requires expensive $80,000 commercial software licenses. Combine CACTI (telemetry), Observium (topology discovery), RANCID (configuration version control), rsyslog (centralized logging), and iTop (IPAM/CMDB) to build an enterprise-grade, automated NOC monitoring stack at zero licensing cost.

---

Architecture and decisions: mine. Debugging sessions at odd hours: mine. AI assistance: structure, syntax, first draft. — Sachin