Drift: Knowing Exactly What Changed, On Which Device, and When

Configuration drift is the slow leak of any well-run network. A justified change today, an emergency fix tomorrow, an undocumented hand-edit next week — and a year later nobody can explain why two ostensibly identical routers behave differently. Drift is the panel that makes the leak visible.

Snapshots and baselines

Drift keeps two things per device: a stream of configuration snapshots and a designated baseline. Snapshots are appended whenever you collect a config — manually, on a schedule, or as part of another script. The baseline is what you currently consider correct, which can be promoted from any snapshot.

Grouping-aware diffs

A naive diff is useless on network configs. Reordering an ACL line shows as one delete and one insert. A renamed interface description looks like a wholesale rewrite. Drift uses grouping-aware diffing: the rule profile knows that an interface block is a single semantic unit, that ACL entries are unordered, and that banner motd is a multi-line literal. The result reads like an actual change report instead of a wall of red and green.

Word-level diff inside lines

Once a line is matched, drift highlights the changed tokens within it. A community string change in a long SNMP line becomes one yellow word instead of an entire red row. Reviewers actually read the diff this way.

Reports you can send to a human

Diff output ships with a markdown export that is structured for code review tools. Drift reports attached to a change ticket move conversations from "did anything happen?" to "is this what you intended?".

Three-way diffs

Compare any two snapshots against the baseline. This is how you debug "it broke after we rolled back" — the rollback was not the rollback you thought it was.

Drift as an input to RCA

Significant drift events emit findings, which means an unexplained config change shows up in the same stream the RCA engine reads. A correlation between a Tuesday afternoon edit and a Wednesday morning outage is exactly the kind of story RCA was built to tell.

Operational tips

• Promote a new baseline immediately after every approved change window. The baseline only works if it is current.
• Schedule snapshots more often than you think you need to. Storage is cheap; missing context is not.
• Tune the rule profile once per device class, then leave it alone — re-tuning during an incident is how diffs lose trust.

What to try first

Snapshot one device, change a single banner line by hand, snapshot again, and run the diff. The shape of the report will tell you everything you need to know about how to use the panel for real.