EventProcedure Regex

[Marcelo Zacchi]

Fellow Spectrum admins,

 

I am trying to isolate a part of an event text (an IP address) and assign that to a new variable, but am getting stuck in the Regex part. Could someone please have a look and help me finding out what is wrong?

 

Event text (variable 0): %ASA-2-113022: AAA Marking TACACS+ server 12.23.23.12 in aaa-server group TACACS as FAILED.

 

My EventProcedure:

 

0xfff00006 E 0 P " CreateEventWithAttributes({ C CURRENT_MODEL }, { H 0xfff00005 }, SetEventAttribute( GetEventAttributeList(),{ U 101 }, GetRegexp( GetEventAttribute( { U 0 } ), {S \"(\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b)\" }, { U 1 } ) ) )"

 

The IP (12.23.23.12) should've been assigned to the new variable 101, but I keep getting the error:

 

5/9/19 11:02:31 AM[Current Event: 0xfff00006] [Current Model: 0xaaa00000] Error: Error evaluating attribute value expression

 

Thanks and regards,

Zacchi

[ackjo04]

Zacchi,

 

Take a look at knowledge document Using a SPECTRUM Event procedure to extract a subs - CA Knowledge 

 

If has an example of a regex used to extract an ip address.

 

Joe

[Marcelo Zacchi]

Hi Joe,

 

Thanks for your reply.

 

I have tried using the code but I am still getting the same error:

5/9/19 2:51:15 PM[Current Event: 0xfff00006] [Current Model: 0x64073ca] Error: Error evaluating attribute value expression

 

Event message (Variable 0): "TACACS+ server 12.23.23.12 in aaa"

 

EventProcedure:
0xfff00006 E 50 P " \
CreateEventWithAttributes( \
{ C CURRENT_MODEL }, \
{ H 0xfff00005 }, \
SetEventAttribute( \
GetEventAttributeList(), \
{ U 101 }, \
GetRegexp( GetEventAttribute( { U 0 } ), \
{ S \".*?:.*?:(.*)\" }, \
{ U 1 } ) \
)\
)"

 

Could it be because I am using variable 0 (through CLI's create event) to simulate the trap event?

 

Regards,

Zacchi

[ackjo04]

Zacchi,

 

I believe when using CLI create event with the text parameter, the text is event variable 1.

[Marcelo Zacchi]

hi Joe,

 

No, I have tested and it is really zero. Overall, the EventProcedure is working except for the regex part.

If I tested it with a simple ".*" statement, it works fine:

 

0xfff00006 E 50 P " \
CreateEventWithAttributes( \
{ C CURRENT_MODEL }, \
{ H 0xfff00005 }, \
SetEventAttribute( \
GetEventAttributeList(), \
{ U 101 }, \
GetRegexp( GetEventAttribute( { U 0 } ), \
{ S \"(.*)\" }, \
{ U 1 } ) \
)\
)"

 

CLI command:

create event type=0xfff00006 text="TACACS+ server 12.23.23.12 in aaa" mh=0x64073ca

 

Event message:

Original string: {S 0}
String 1: {S 1}
RegEx variable: {S 101}

 

Event in OC:

[Marcelo Zacchi]

Thanks Joe, I have managed to make it work with the following regex:

 

0xfff00006 E 50 P " \
CreateEventWithAttributes( \
{ C CURRENT_MODEL }, \
{ H 0xfff00005 }, \
SetEventAttribute( \
GetEventAttributeList(), \
{ U 101 }, \
GetRegexp( GetEventAttribute( { U 0 } ), \
{ S \"server ([0-9].*[0-9])\" }, \
{ U 1 } ) \
)\
)"

 

In the one used in the example you sent, the IP was between colons and not spaces.

 

Best regards,

Zacchi