Tips for ArubaOS-CX Configuration Backups with Oxidized

August 4, 2026

As with any switch, it's very easy to end up having changes which are poorly accounted for ultimately bite you in the proverbial behind owing to cowboy antics or perhaps unaddressed issues leading to the loss of the switch configuration. Consider that with AOS-CX switches in a VSF stack, if your conductor falls over and you don't have a secondary configured, you'll lose your configuration unless you can resurrect the conductor. Though nobody would be that stupid, right?

However there's basically no documentation online that specifically addresses getting ArubaOS-CX to work nicely with Oxidized. Here I've written some notes based on a setup I performed recently.

Configuring Permissions

Don't add your Oxidized user to the administrators group on the switch. You're giving it God-mode for absolutely no reason whatsoever. ArubaOS-CX supports creating specific user groups whose access you can constrain by defining what commands a user in that group is permitted to run.

The commands defined below are based on the current version of the aoscx.rb model at the time of writing this article.

user-group oxidized-ro
    10 permit cli command "show running-config"
    20 permit cli command "show version"
    30 permit cli command "show environment"
    40 permit cli command "show module"
    50 permit cli command "show interface transceiver"
    60 permit cli command "show system"
    70 permit cli command "no page"

You can use oxidized-ro as the group name when defining your Oxidized user.

Triggering Configuration Backups with LibreNMS Syslog Hooks

LibreNMS is a very cool open-source tool that I would suggest to anyone, especially those without the budget for Aruba Central licenses. It supports an extremely broad range of devices via SNMP and it's difficult to find a piece of hardware that it can't gather useful statistics for.

Relevant to this exercise, we want to trigger Oxidized to backup a switch's configuration based on matching a pattern within a received syslog message from the switch.

This assumes the following:

You already have Oxidized setup
You've already configured the Oxidized Integration in LibreNMS
You're already sending syslog messages to LibreNMS (Note: I'm using syslog-ng, I don't know if this will work with other daemons)

Already built into LibreNMS is a mechanism to run a script via syslog hooks whenever a message that matches a particular regex is seen. In addition, LibreNMS ships with a script designed to work with its syslog hooks to trigger Oxidized for the particular device.

The only missing piece is that there's no documentation for ArubaOS-CX. (But hey, there's Procurve documentation if you want to dust off your old Aruba 2930F!)

There's two approaches for how you might want to trigger configuration backups from syslog messages. Which one you choose mainly depends on if you're using git with Oxidized, and how fearful you are of lingering unsaved changes.

Backing up on write

If you just want to take a backup every time the config is written, you won't need to do anything special to your logging directive, the defaults should be satisfactory. This hook will run anytime someone runs write memory on your switch.

lnms config:set os.arubaos-cx.syslog_hook '[{"regex":"/Copying configs from/","script":"/opt/librenms/scripts/syslog-notify-oxidized.php"}]'

Note: You'll need to restart syslog-ng for this change to take effect

Backup on command invocation

This is not how I ultimately configured our environment, mostly for fear of generating a worthless commit every single time I run a basic command, but you're free to go down this road if you want.

By default ArubaOS-CX will not include audit information in the syslog messages, but you can enable this by appending include-auditable-events to your logging directive. After doing this, you'll get syslog messages for every single command run on the switch, even fairly innocuous ones. From there, you can alter the hook specified above to match events from the audit log, ACCTSYSLOGD.

You may wish to enable include-auditable-events regardless of whether you go down this path or not, it's pretty handy albeit a little spammy.