Oxidized Network Configuration Backup: Install and Configure

Configuration backup is the one automation project that pays for itself the first time a switch dies. Oxidized is the modern RANCID replacement: it logs into every device on a schedule, pulls the running configuration, and stores each revision in a Git repository so you can diff, blame and restore. This guide installs it on Debian/Ubuntu and RHEL-family hosts, explains the config file and inventory, sets up Git output with change notifications, and covers the failures you will actually hit on the first run against a mixed Cisco/Juniper/Aruba estate.

Install

# Debian / Ubuntu
sudo apt update
sudo apt install -y ruby ruby-dev libssl-dev libsqlite3-dev git cmake pkg-config
sudo gem install oxidized oxidized-web

# RHEL / Rocky
sudo dnf install -y epel-release
sudo dnf config-manager --set-enabled crb
sudo dnf module enable ruby:3.1
sudo dnf install -y ruby-devel rubygems openssl-devel libyaml-devel sqlite-devel gcc gcc-c++ make git
sudo gem install oxidized oxidized-web

sudo useradd -r -m -d /var/lib/oxidized -s /bin/bash oxidized
sudo -u oxidized oxidized --version

Never run Oxidized as root: it executes vendor CLI parsing code and stores device credentials. A dedicated service account with a home directory it owns is the baseline. Point it at a consistent home so config, logs and the Git repo stay in one place:

export OXIDIZED_HOME=/etc/oxidized
sudo -u oxidized oxidized      # first run creates a default config
sudo -u oxidized oxidized

The configuration file

---
username: netbackup
password: !ruby/object:Oxidized::String 'SuperSecret'
model: junos
resolve_dns: true
interval: 3600
rest: 0.0.0.0:8888
log: /var/log/oxidized/logs
input:
  default: ssh, telnet
  ssh:
    secure: false
output:
  default: git
  git:
    user: Oxidized
    email: oxidized@example.com
    repo: "/var/lib/oxidized/network.git"
source:
  default: csv
  csv:
    file: "/etc/oxidized/router.db"
    delimiter: !ruby/regexp /:/
    map:
      name: 0
      model: 1
      username: 2
      password: 3

The interval is seconds between polls; one hour is the usual compromise between change visibility and device load. secure: false on SSH is Oxidized's way of permitting legacy key exchange algorithms for older switches - enable it deliberately, and prefer a jump host or out-of-band path over weakening SSH everywhere.

Inventory (router.db)

core-sw1:ios:netbackup:SuperSecret
core-sw2:ios:netbackup:SuperSecret
mx204-edge:junos:netbackup:SuperSecret
aruba-6300:aruba:netbackup:SuperSecret
sw-nxos-1:nxos:netbackup:SuperSecret

Use a per-device map when credentials differ by platform. The model field selects the driver - check the model list for your platforms and version: an incorrect model typically reveals itself as an empty or truncated backup file rather than an error, which is why verification matters more than installation.

Run it as a service and verify real backups

sudo cp /usr/local/lib/ruby/gems/*/gems/oxidized-*/extra/oxidized.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now oxidized
sudo journalctl -u oxidized -f

cd /var/lib/oxidized/network.git
git log --oneline -5
git log -p -- core-sw1

The only meaningful health check is a Git log with recent commits per device. Build a quick report instead of trusting the service state:

for d in $(git --git-dir=/var/lib/oxidized/network.git log --name-only --pretty=format: | sort -u | grep -v '^$'); do
  age=$(( ( $(date +%s) - $(git --git-dir=/var/lib/oxidized/network.git log -1 --format=%ct -- "$d") ) / 3600 ))
  [ "$age" -gt 24 ] && echo "STALE: $d (${age}h)"
done

Common first-run failures

Auth works in SSH but Oxidized fails: the account needs privilege and terminal length settings; on Cisco add terminal length 0 in the driver, and on ArubaOS-CX check that the account can enter enable mode. Empty files: model mismatch or an enable password prompt the driver does not answer. Only some devices update: inventory entries with the same name but different case, or DNS resolving to a stale address. No commits despite changes: the Git repo is owned by root after a manual run. Pair this with change-aware tooling - see our guides on NAPALM config diff, Ansible inventory and backups and Netmiko scripting if you want push-based automation next to pull-based backup.

原文链接：https://github.com/ytti/oxidized