NAS AO Profile regex passing unmatched alarm messages

[Christopher Duryea]

Curious if anyone else has run across something similar?  I ran across interesting behavior of the regex in a nas AO profile where a orphaned parenthesis allowed several alarm messages that did not match to pass through.

ems 10.22
nas 9.20

Alarm message A:
URL response for 'AAAA - Watch Dog' failed. The attempt to connect to the server failed.. https://someserver:999 Assignment group: AAAA http://someotherserver/Responding%20to%20URL%20alarms%20in%20Spectrum.pdf

Alarm Message B:
URL Certificate due to expire in '3' days for profile 'XXX direct to XXX on XX## 8443' for 'https://XXXXXXXX:8443/xxxxxxx/'. Assignment group: BBBB http://someotherserver/Responding%20to%20URL%20alarms%20in%20Spectrum.pdf

AO Profile regex:
/.*URL\sCertificate\sdue\sto\sexpire\sin\s'21'\sdays.*Assignment\sgroup:\sCCCC).*/

That single parenthesis above after the CCCC caused the AO profile to pass the above messages instead of wholesale rejecting them.  Before and after I verified by removing the alarms and allowing them to regenerate.  As soon as that single ) was removed, it stopped passing the unrelated alarms.  
​​

[Gene Howard]

so the ) should be escaped of it needs to be there
so:
/.*URL\sCertificate\sdue\sto\sexpire\sin\s'21'\sdays.*Assignment\sgroup:\sCCCC\).*/
if you check the regex statement you can see that it is not valid

the incorrect regex would cause unexpected results.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Christopher Duryea]

The ) should not have been there.

 

If it causes unexpected behavior allowing alarms that do not match the regex to pass through instead of dropped, that's of real concern.   Since it was not escaped, I would presume this should result in some sort of regex syntax processing error and thus question the error handling.

 

		Christopher Duryea SYSTEMS ENGINEER, Enterprise Tools Eng Svcs BlueCross BlueShield of Tennessee 1 Cameron Hill Circle | Chattanooga, TN 37402-0001 Tel: [phone] | Email: [e-mail] | Web: BCBST.COM
The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.

[Gene Howard]

when in an AO profile you can use F2 to check your Regex against a message.
Currently, at run time there is no Regex testing.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Christopher Duryea]

Yes, I'm aware of the F2 option for checking. 

 

It's good to know that there's no run time validation/error handling in the code....

 

		Christopher Duryea SYSTEMS ENGINEER, Enterprise Tools Eng Svcs BlueCross BlueShield of Tennessee 1 Cameron Hill Circle | Chattanooga, TN 37402-0001 Tel: [phone] | Email: [e-mail] | Web: BCBST.COM
The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.