DX NetOps

Expand all | Collapse all

EventProcedure Regex

Jump to Best Answer
  • 1.  EventProcedure Regex

    Posted 05-09-2019 05:17 AM

    Fellow Spectrum admins,

     

    I am trying to isolate a part of an event text (an IP address) and assign that to a new variable, but am getting stuck in the Regex part. Could someone please have a look and help me finding out what is wrong?

     

    Event text (variable 0): %ASA-2-113022: AAA Marking TACACS+ server 12.23.23.12 in aaa-server group TACACS as FAILED.

     

    My EventProcedure:

     

    0xfff00006 E 0 P " CreateEventWithAttributes({ C CURRENT_MODEL }, { H 0xfff00005 }, SetEventAttribute( GetEventAttributeList(),{ U 101 }, GetRegexp( GetEventAttribute( { U 0 } ), {S \"(\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b)\" }, { U 1 } ) ) )"

     

    The IP (12.23.23.12) should've been assigned to the new variable 101, but I keep getting the error:

     

    5/9/19 11:02:31 AM[Current Event: 0xfff00006] [Current Model: 0xaaa00000] Error: Error evaluating attribute value expression

     

    Thanks and regards,

    Zacchi



  • 2.  Re: EventProcedure Regex

    Posted 05-09-2019 07:59 AM

    Zacchi,

     

    Take a look at knowledge document Using a SPECTRUM Event procedure to extract a subs - CA Knowledge 

     

    If has an example of a regex used to extract an ip address.

     

    Joe



  • 3.  Re: EventProcedure Regex

    Posted 05-09-2019 08:53 AM

    Hi Joe,

     

    Thanks for your reply.

     

    I have tried using the code but I am still getting the same error:

    5/9/19 2:51:15 PM[Current Event: 0xfff00006] [Current Model: 0x64073ca] Error: Error evaluating attribute value expression

     

    Event message (Variable 0): "TACACS+ server 12.23.23.12 in aaa"

     

    EventProcedure:
    0xfff00006 E 50 P " \
    CreateEventWithAttributes( \
    { C CURRENT_MODEL }, \
    { H 0xfff00005 }, \
    SetEventAttribute( \
    GetEventAttributeList(), \
    { U 101 }, \
    GetRegexp( GetEventAttribute( { U 0 } ), \
    { S \".*?:.*?:(.*)\" }, \
    { U 1 } ) \
    )\
    )"

     

    Could it be because I am using variable 0 (through CLI's create event) to simulate the trap event?

     

    Regards,

    Zacchi



  • 4.  Re: EventProcedure Regex

    Posted 05-09-2019 09:08 AM

    Zacchi,

     

    I believe when using CLI create event with the text parameter, the text is event variable 1.



  • 5.  Re: EventProcedure Regex

    Posted 05-10-2019 03:46 AM

    hi Joe,

     

    No, I have tested and it is really zero. Overall, the EventProcedure is working except for the regex part.

    If I tested it with a simple ".*" statement, it works fine:

     

    0xfff00006 E 50 P " \
    CreateEventWithAttributes( \
    { C CURRENT_MODEL }, \
    { H 0xfff00005 }, \
    SetEventAttribute( \
    GetEventAttributeList(), \
    { U 101 }, \
    GetRegexp( GetEventAttribute( { U 0 } ), \
    { S \"(.*)\" }, \
    { U 1 } ) \
    )\
    )"

     

    CLI command:

    create event type=0xfff00006 text="TACACS+ server 12.23.23.12 in aaa" mh=0x64073ca

     

    Event message:

    Original string: {S 0}
    String 1: {S 1}
    RegEx variable: {S 101}

     

    Event in OC:



  • 6.  Re: EventProcedure Regex
    Best Answer

    Posted 05-10-2019 04:15 AM

    Thanks Joe, I have managed to make it work with the following regex:

     

    0xfff00006 E 50 P " \
    CreateEventWithAttributes( \
    { C CURRENT_MODEL }, \
    { H 0xfff00005 }, \
    SetEventAttribute( \
    GetEventAttributeList(), \
    { U 101 }, \
    GetRegexp( GetEventAttribute( { U 0 } ), \
    { S \"server ([0-9].*[0-9])\" }, \
    { U 1 } ) \
    )\
    )"

     

    In the one used in the example you sent, the IP was between colons and not spaces.

     

    Best regards,

    Zacchi