Evaluating Devexana for a campus network

Start an evaluation with logs and files, without device credentials. This page explains access requirements, answer limits and support status.

On this page

Answers at a glance
The three access levels
Can we start with logs only, or must Devexana connect to our devices?
What access does Devexana need on our equipment?
How reliable are the answers?
How does Devexana work with our existing monitoring?
Does any of our data leave the campus?
Which vendors does Devexana support?
How large a network can Devexana handle?
A first evaluation that needs no device credentials

Devexana can receive logs and import files without device credentials. Device reads use read-only accounts. By default, Devexana produces answers on the appliance.

Aruba/HP AOS-S switch reads are in production use. Devexana has not yet run on a campus network.

This page gives a short answer to each question, with its status and a link to the full page. The last section describes a first evaluation that needs no device credentials.

Answers at a glance

Question	Short answer	Status
Can we start with logs only?	Yes, for part of the product. Switch state from the last read needs read-only SSH or SNMP access	Listeners off by default. Syslog: in production use for Barracuda CloudGen; available for other senders. SNMP traps: available
What access does it need?	Logs and files need no device credentials. Device reads use read-only accounts. Devexana also enforces read-only access. Device configuration changes are disabled in code in this release	Read approval available
How reliable are the answers?	Each answer cites stored records. Citations do not prove that every sentence is correct. Devexana does not publish an accuracy figure	Citations available
How does it work with our monitoring?	A PRTG source is available. Devexana builds read-only API connectors for the monitoring products listed below during onboarding. If devices or monitoring tools support syslog or SNMP traps, they can send that data to the listeners	Available
Does our data leave the campus?	By default, Devexana produces answers on the appliance. A deployment can run with no cloud model. If a deployment uses a cloud model, Devexana provides it through its zero-data-retention agreement on AWS. Customers do not bring their own model keys	Other cloud features off by default
Which vendors are supported?	Aruba/HP AOS-S switches in production use. Other switch families available	See the vendor table
How large a network can it handle?	Not yet measured on a campus. Discovery scans are limited to /22 ranges	No campus deployment yet

The three access levels

Each level adds sources. Each source adds records that an answer can cite. Access makes a feature possible. An administrator still turns each feature on.

Level 1: logs and exports

Level 1 needs no device credentials.

You provide:
- Logs sent to listeners.
- Port maps, DHCP lease files and a site file.
Available when an administrator turns it on:
- Raw logs for 30 days.
- Barracuda CloudGen alerts and the daily brief.
- NetFlow top talkers.
- Campus buildings and closets.

Level 2: read-only access

Level 2 includes Level 1.

You provide:
- Read-only SSH and SNMP accounts.
- Read-only API keys.
Available when an administrator turns it on:
- Port state, VLAN and PoE class.
- Neighbour links from LLDP and CDP.
- Daily configuration history.
- Configuration checks.

Level 3: added context

Level 3 includes Level 2.

You provide:
- Helpdesk and directory sources.
- PRTG.
- The extended switch read set.
Available when an administrator turns it on:
- Person to device to port links.
- Ticket history by switch or port.
- Optics and PoE power.

The answers below refer to these levels. Port maps, site files and DHCP lease files also work at Level 1. Access levels do not indicate production use.

Can we start with logs only, or must Devexana connect to our devices?

Yes, you can start with logs and files. That covers part of the product. Switch state from the last read needs read-only SSH or SNMP access.

At Level 1, Devexana receives syslog, SNMP traps and NetFlow on receive-only listeners. It also imports documents, port maps and DHCP lease files, and draws a campus from your site file.

Status: The listeners are off by default. The syslog listener is in production use for Barracuda CloudGen logs. It is available for other senders. The SNMP-trap listener is available. File imports and the campus map are available.

What access does Devexana need on our equipment?

Device reads use read-only accounts. Devexana also enforces read-only access. In this release, changes to network-device configuration are disabled in code.

Devexana applies these checks to each read:

If a source declares a write operation, Devexana rejects it when it loads.
Each read function stays off until an administrator approves it.
Each switch command must pass a read-only command allowlist.
SNMP reads use GET and GETNEXT requests only.
Devexana pins the SSH host key of each device and refuses a changed key until a person trusts it.

On Barracuda CloudGen firewalls, the SSH read covers interfaces, high-availability state, routes and licences. It does not read the rule set.

Devexana records approvals and each read of a stored credential in the audit log.

Status: Read approval and the command allowlist are available.

How reliable are the answers?

Citations do not prove that every sentence is correct. Devexana does not publish an accuracy figure.

Devexana builds answers from records stored on the appliance. Each answer links to the records that were used to build it, and each link shows how fresh the record is.

Deterministic checks remove person names and dates that are not in the source records. When nothing relevant is stored, the assistant says that it has no local record.

To judge reliability on your own data, run the evaluation at the end of this page. Check each answer with the steps on Check an answer against its sources.

Status: Citations with freshness are available.

How does Devexana work with our existing monitoring?

A read-only PRTG source is available. For Nagios, Observium, AKiPS, LibreNMS, Zabbix or SolarWinds, Devexana builds a read-only API connector during onboarding. Each connector uses an account that can only read.

If your devices or monitoring tools support syslog or SNMP traps, they can send that data to the appliance's receive-only listeners.

Devexana can forward its own audit events to a SIEM. It does not read data from a SIEM.

Status: The PRTG source is available. SIEM forwarding is off by default.

Does any of our data leave the campus?

By default, Devexana produces answers with models that run on the appliance. A deployment can run with no cloud model. In production, customers do not bring their own model keys. If a deployment uses a cloud model, Devexana provides it through Devexana's zero-data-retention (ZDR) agreement on AWS. The optional networking assistant uses a cloud model only when Devexana has set up the cloud connection for that deployment. Other cloud features are off by default. Devexana records each networking-assistant request in the egress log on the appliance. Outbound connections: the complete list describes outbound connections and their recording limits.

To keep answers on the appliance, ask Devexana not to set up a cloud model connection. The egress guard checks outbound TCP connections from the Devexana service only. It does not see DNS lookups, UDP traffic or other programs on the appliance. Add a default-deny outbound rule for the appliance at your firewall.

Status: The networking assistant sends only after Devexana sets up the cloud connection. Other cloud features are off by default.

Which vendors does Devexana support?

Read-only switch reads over SSH and SNMP are in production use on Aruba/HP AOS-S (ProCurve) switches. Command sets for other switch families are available.

Vendor family	Status
Aruba/HP AOS-S (ProCurve) switches, over SSH and SNMP	In production use
Barracuda CloudGen firewalls, over SSH and syslog	In production use
Cisco IOS, IOS-XE, IOS-XR and NX-OS, Arista EOS, Juniper Junos, Aruba AOS-CX, HP Comware, Dell OS10, OS9 and OS6 command sets	Available
Cisco Meraki, Cisco Catalyst Center, Aruba Central, Aruba ClearPass API sources	Available
Paessler PRTG	Available
Fortinet, Palo Alto Networks, Juniper Mist	Devexana builds a read-only API connector during onboarding

How large a network can Devexana handle?

Devexana has not yet run on a campus network. No campus-scale measurement is available. Aruba/HP AOS-S switch reads are in production use.

Bound	Value in this release
Discovery scan range	/22 at most for each scan
Default switch read schedule	Once a day for each switch
Public demonstration	Invented sample data. It is not evidence of a deployment

A first evaluation that needs no device credentials

This evaluation tests Devexana on a historical log sample and files that your team already has. It needs no device credentials and no cloud model.

The result shows what logs and files alone can answer. It does not measure what read-only device access would add.

Prepare the sample

Choose the period and the devices that the log sample covers.
Remove any data that your policy does not allow on a new system.

Import the files

Import the log sample and the optional files.

Optional: firewall log processing

Firewall log processing builds daily rollups. It runs after a scheduled source reads again.

If you want firewall rollups, add a scheduled source, such as a DHCP lease file.
If the sample contains Barracuda CloudGen logs, ask Devexana support to load them with the operator command.

Optional: live syslog

If you want live data, send syslog from the devices in scope to a receive-only listener.

Ask and check

Ask your incident questions.
Compare each answer with its cited records.
Mark each question: answered with citations, partly answered, or not answerable at this level.
Export the audit log and the egress log at the end.

What the result can and cannot show

The result can show	The result cannot show
What your logs and files record, with a citation to each record	Current port state, VLANs, PoE and neighbours
Daily rollups of Barracuda CloudGen firewall logs, with the optional firewall processing	Alert classification for logs from vendors other than Barracuda CloudGen
Campus buildings and closets from your site file	Links between switches, and configuration history
Address, MAC address and host name from DHCP lease files	Whether a device is down now
Which of your questions logs alone cannot answer	Full-text search over raw log lines

To arrange an evaluation, write to support@devexana.com.

Logs, read-only access and evidence: what each level gives youStart with logs and files without device credentials. When you need more context, add read-only device access or other sources.
Campus network teamsCampus teams can start with logs and files, then add read-only device access. This page gives the support status of each source.
Outbound connections: the complete listEach outbound connection, its default state, the data it sends, how it is turned on and where it is logged. Includes the network controls your organization must configure.
Supported vendors and protocolsThis page lists each vendor and protocol that Devexana reads, with its availability, connection method and data. Devexana does not support vendors that are not listed.
Read-only sourcesDevexana sources only read your systems. Separate features can write to business systems. In this release, Devexana disables network-device configuration changes in code.
Check an answer against its sourcesCheck claims against the source records before you act. A citation identifies a record used to build the answer. It does not prove every sentence.

Applies to Devexana release 0.3.182. Page updated 2026-10-20. Questions or corrections: support@devexana.com.