BLOG | Sep 23, 2025

Prevent Network Outages from Uncommitted Configs Using NQE

In Cisco environments, one missed write memory can spell disaster. Uncommitted changes, saved only in the running config but not in startup, can be wiped out during a reboot, causing outages and rollback failures. With Forward Networks’ Network Query Engine (NQE), teams can automatically detect discrepancies between running and startup configs across all Cisco devices, ensuring every critical change is properly saved.

Request a Demo Read the Blog

Arica Beckstead Customer Success Engineer

Who should read this post?

Network engineers managing large fleets of Cisco devices
Operations teams responsible for configuration compliance
IT admins seeking to automate verification of saved device states

What is covered in this content?

How uncommitted configs cause risk and outages
An NQE script to automatically compare Cisco running vs. startup configs
A structured way to detect and report unsaved changes
How to integrate this check into your snapshot validation workflows

The Hidden Risk of Uncommitted Cisco Configs

Cisco devices don’t warn you before rebooting with unsaved changes. A missed write memory means the running config is lost—and the device reloads with an outdated startup config. That’s how critical updates disappear, outages happen, and incidents get escalated. Manually checking for this drift across hundreds or thousands of devices is tedious and error-prone.

Business Value of Config Drift Detection

Prevent Outages: Eliminate device reload surprises by detecting unsaved changes in advance
Enforce Operational Hygiene: Ensure all changes are properly committed across environments
Audit-Ready Insights: Capture and report drift with structure and precision
Scale Across the Network: Run a single query to check every device in your Cisco estate

How the NQE Script Works

This NQE script checks for differences between the startup and running configurations on Cisco devices. It filters out irrelevant lines (like timestamps or system boot info), compares both configs line by line, and reports any differences as violations.

It also labels:

Lines present in the running config but not in startup (uncommitted)
Lines present in the startup config but missing from running (removed)

Use this as a snapshot-based drift detector across your entire Cisco fleet.

Full Script Breakdown

Here’s the full NQE query provided by the Forward Networks community:

exceptionsList = [
  "Current Configuration ...",
  "",
  "boot system.*"
];

exceptions(line) = 
foreach item in exceptionsList 
where hasMatch(line, regex(item))
select line;

flatten(outer) =
  foreach list in outer
  foreach item in list
  select item;

config(device, show) =
foreach command in device.outputs.commands
where command.commandText == show
let response = parseConfigBlocks(device.platform.os, command.response)
  let text = (foreach line in response
      let lines = if length(line.children) == 0
          then [line.text]
          else [line.text] + flatten(foreach line1 in line.children
               select if length(line1.children) == 0
                   then [line1.text]
                   else [line1.text] + flatten(foreach line2 in line1.children
                        select if length(line2.children) == 0
                            then [line2.text]
                            else [line2.text] + flatten(foreach line3 in line2.children
                                 select if length(line3.children) == 0
                                    then [line3.text]
                                    else [line3.text] + flatten(foreach line4 in line3.children
                                         select if length(line4.children) == 0
                                            then [line4.text]
                                            else [""]))))
            foreach item in lines
            where item not in exceptions(item)
            select item)
foreach line in text 
select line            
;
foreach device in network.devices
let runningConfig = config(device, "show running-config")
let startupConfig = config(device, "show startup-config")
let uncommitted = runningConfig - startupConfig
let removed = startupConfig - runningConfig
select {
  violation: runningConfig != startupConfig,
  device: device.name,
  os: device.platform.os,
  uncommitted,
  removed
}

The output flags any differences and labels the device with a "violation": true tag if drift is detected. You can use this data for ticket generation, dashboards, or alerting workflows.

Check out the original Forward Networks community post to copy the full script and review usage tips:
Prevent Outages from Uncommitted Configs: Using NQE to Compare Cisco Running and Startup Configs

Winner of over 20 industry awards, Forward Enterprise is the best-in-class network modeling software that customers trust

Visit our press room Hear from Gartner

From Fortune 50 institutions to top level federal agencies, users agree that Forward Enterprise is unlike any other network modeling software

Evaluate the reviews Chat with an expert