From philipp at redfish-solutions.com  Sat Dec  3 00:54:11 2016
From: philipp at redfish-solutions.com (Philip Prindeville)
Date: Sat, 03 Dec 2016 00:54:11 -0000
Subject: [rancid] Logging/encryption patches sent last month
In-Reply-To: <2086D8F0-A3E2-4203-A9E0-0BED788E04D3@redfish-solutions.com>
References: <2086D8F0-A3E2-4203-A9E0-0BED788E04D3@redfish-solutions.com>
Message-ID: <9267190B-04E9-4697-909C-22F7A62863A8@redfish-solutions.com>


> On Oct 19, 2016, at 12:08 PM, Philip Prindeville <philipp at redfish-solutions.com> wrote:
> 
> I was going to submit packaging for tac_plus on Redhat (Fedora, CentOS, EPEL, RHEL) but if the project is no longer accepting patches then I don?t want to be in a position to have to maintain distro-specific patches for Redhat with no hope of upstreaming them.


Looking at the tarball, I?m seeing a .spec file? but it doesn?t conform to some Fedora packaging requirements? like avoiding embedding files as here-documents in the .spec file.

Are there any objections to breaking those files out?

Thanks,

-Philip

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161203/bab366d4/attachment.html>

From on at LEFerguson.com  Fri Dec  2 18:31:52 2016
From: on at LEFerguson.com (on at LEFerguson.com)
Date: Fri, 2 Dec 2016 18:31:52 +0000
Subject: [rancid] rancid - Cisco WLC devices
References: <7451D4018F28FD479AD780242296607191727F07@SIILPEOSVEX01.skin.local>
 <20161130190429.GG51915@shrubbery.net>
 <7451D4018F28FD479AD780242296607191728062@SIILPEOSVEX01.skin.local>
 <20161130191957.GI51915@shrubbery.net> 
Message-ID: <BN6PR05MB3009630419D7C43E9031F6B2D58E0@BN6PR05MB3009.namprd05.prod.outlook.com>


> Can I just install this over the current version that I have running. I set this up through the package in Ubuntu. It took me a really long time to get all this working as a am a newbie with this. I am currently on version 3.3.0.

I just wanted to think you for bringing this up and the answers.  I didn't even bother trying the WLC's as they are so weird, but after a bit of digging (magic name for me was cisco-wlc5, there's also a 4) it seemed to work perfectly.  I found I also needed "noenable" defined for these, not sure if that's our setup or normal.

But having done that it all worked perfectly.

To the OP, if the distros are out of date (and it looks as though they are), you might look at just building it yourself.  While the paths will end up differently, this is about all it takes on Ubuntu to get a working config built from source.  DO NOT JUST DO THIS on a working system as the paths change, and any existing rancid will be separate and trying to run at the same time, perhaps.  I just offer this as sometimes "build from source" sounds so ominous, but it's not here.  This presumes you have the required libraries, which you should have most of with a distro package installed.  I don't have a rancid only list as I have so many other items installed, or I would share it.

wget ftp://ftp.shrubbery.net/pub/rancid/rancid-3.5.1.tar.gz
tar -zxvf rancid-3.5.1.tar.gz
cd rancid-3.5.1
./configure --prefix=/home/rancid --localstatedir=/home/rancid/var/rancid
make install 

You could play with the configs, as mentioned, and probably get them to build over the same paths.  With the above I think you need to change the rancid's account's PATH also to include the new bin directory this creates.

But if you have a system you can experiment on, you can keep it more up to date with building it yourself, without a lot of trouble.

Thanks.

Linwood




From Brad.Shifflett at micromenders.com  Mon Dec  5 23:23:12 2016
From: Brad.Shifflett at micromenders.com (Brad Shifflett)
Date: Mon, 5 Dec 2016 23:23:12 +0000
Subject: [rancid] Need to pull certain info from configs
Message-ID: <B9F20958E6FB394F9DC7B81C9B607E64EDC10592@MM-EXMB1.micromenders.com>

I want to run a command to search all of our devices, report back which firewalls and devices have ssh opened to the outside world. Example: ssh 0.0.0.0 0.0.0.0 <interface>

Any idea on how we can do that? I recall doing a grep for serial numbers and asa-versions

Brad Shifflett
---------------------------------------------------------------------------------------
 This email has been scanned for email related threats and delivered safely by Mimecast.
 For more information please visit http://www.mimecast.com
---------------------------------------------------------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161205/7ce5b6fd/attachment.html>

From doug.hughes at keystonenap.com  Mon Dec  5 23:38:57 2016
From: doug.hughes at keystonenap.com (Doug Hughes)
Date: Mon, 5 Dec 2016 18:38:57 -0500
Subject: [rancid] Need to pull certain info from configs
In-Reply-To: <B9F20958E6FB394F9DC7B81C9B607E64EDC10592@MM-EXMB1.micromenders.com>
References: <B9F20958E6FB394F9DC7B81C9B607E64EDC10592@MM-EXMB1.micromenders.com>
Message-ID: <5513614d-5daf-aca6-5315-9cd28fd71098@keystonenap.com>

you can do just like you said.

grep 'ssh 0.0.0.0 0.0.0.0' from all of your configs



On 12/5/2016 6:23 PM, Brad Shifflett wrote:
> I want to run a command to search all of our devices, report back 
> which firewalls and devices have ssh opened to the outside world. 
> Example: ssh 0.0.0.0 0.0.0.0 <interface>
>
> Any idea on how we can do that? I recall doing a grep for serial 
> numbers and asa-versions
>
> Brad Shifflett
>
>
> ------------------------------------------------------------------------
> This email has been scanned for email related threats and delivered 
> safely by Mimecast.
> For more information please visit http://www.mimecast.com
> ------------------------------------------------------------------------
>
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss

-- 
Doug Hughes
Keystone NAP
Fairless Hills, PA
1.844.KEYBLOCK (539.2562) 	

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161205/ecc50a61/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: keystone-nap.png
Type: image/png
Size: 3476 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161205/ecc50a61/attachment.png>

From on at LEFerguson.com  Tue Dec  6 00:14:59 2016
From: on at LEFerguson.com (on at LEFerguson.com)
Date: Tue, 6 Dec 2016 00:14:59 +0000
Subject: [rancid] Need to pull certain info from configs
Message-ID: <BN6PR05MB3009DC534F8311111853DF20D5820@BN6PR05MB3009.namprd05.prod.outlook.com>

>I want to run a command to search all of our devices, report back which
>firewalls and devices have ssh opened to the outside world. Example: ssh 0.0.0.0 0.0.0.0
If you have an NMS that can be a good hook if this is something you want to do on an automated, e.g. recurring basis. I use Zabbix, and I wrote some fairly simple minder parsing routines to find the config from the name (pretty easy given the directory structure in rancid) and then parse out what IPSec tunnels were defined.  Then with SNMP polling I get which SNMP tunnels are up, and can compare the two to see if any are failing, turned down, never started, etc.

But you could parse for most anything and tie to an NMS data collection.

But for one-time needs, grep is perfect -- it's quite nice having them all pulled as text files as they are in Rancid.

Linwood

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161206/0a1a0b30/attachment.html>

From imd at acens.com  Wed Dec  7 15:50:33 2016
From: imd at acens.com (=?iso-8859-1?Q?I=F1aki_Mart=EDnez_D=EDez?=)
Date: Wed, 7 Dec 2016 15:50:33 +0000
Subject: [rancid] Migration from Rancid 2.3.8 (Debian 6.0.10 Package) to new
 Rancid 3.x (latest)
Message-ID: <D46DEE57.99EB9%imd@acens.com>

An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161207/fb7d16ba/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: acens_mail_g.gif
Type: image/gif
Size: 7644 bytes
Desc: acens_mail_g.gif
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161207/fb7d16ba/attachment.gif>

From heas at shrubbery.net  Wed Dec  7 16:09:34 2016
From: heas at shrubbery.net (heasley)
Date: Wed, 7 Dec 2016 16:09:34 +0000
Subject: [rancid] Migration from Rancid 2.3.8 (Debian 6.0.10 Package) to
 new Rancid 3.x (latest)
In-Reply-To: <D46DEE57.99EB9%imd@acens.com>
References: <D46DEE57.99EB9%imd@acens.com>
Message-ID: <20161207160934.GC85632@shrubbery.net>

Wed, Dec 07, 2016 at 03:50:33PM +0000, I?aki Mart?nez D?ez:
> <div>&nbsp;My intention in to HOLD Rancid Packages and upgrade Debian to versi?n 8.6 and then migrate Rancid to the newest versi?n.</div>

there is an UPGRADING file in the distribution with notes about moving from
2.x to 3.x.


From heas at shrubbery.net  Wed Dec  7 17:38:50 2016
From: heas at shrubbery.net (heasley)
Date: Wed, 7 Dec 2016 17:38:50 +0000
Subject: [rancid] supermicro switch (again)
In-Reply-To: <CABJoABbDHtK64VgorEGwnoRsdvZnTNBstyD50_8brhYRSrgUWg@mail.gmail.com>
References: <CABJoABZ5VjOgTd-db+=8cpskqfoi=CxrMuSeAWUsCox_UM59gA@mail.gmail.com>
 <20161116201401.GM27885@shrubbery.net>
 <CABJoABbtcenZen0YUF4P9JVxkf20A49CjvDbJEkh83F1qREXJw@mail.gmail.com>
 <20161121063521.GC73648@shrubbery.net>
 <CABJoABb+2MMOoW64WYOKjfyKGhPb3pzb8GtKpQyt3TjUrKrmqg@mail.gmail.com>
 <20161121153310.GE73648@shrubbery.net>
 <CABJoABbDHtK64VgorEGwnoRsdvZnTNBstyD50_8brhYRSrgUWg@mail.gmail.com>
Message-ID: <20161207173850.GK85632@shrubbery.net>

Tue, Nov 22, 2016 at 01:47:00PM +0100, Marcin Dulak:
> On Mon, Nov 21, 2016 at 4:33 PM, heasley <heas at shrubbery.net> wrote:
> 
> > Mon, Nov 21, 2016 at 10:26:25AM +0100, Marcin Dulak:
> > > naively I do:
> > > cp usr/share/perl5/vendor_perl/rancid/edgemax.pm
> > > usr/share/perl5/vendor_perl/rancid/supermicro.pm
> > > change "package supermicro;" on the top and add a print STDERR ("I'm
> > > here"); to ShowVersion,
> > > but "I'm here" does no appear in the output of:
> >
> > you havent a module line in the device config below, so the module is not
> > loaded.
> >
> >
> thanks, this was missing. It was also important to specify the module to be
> used with "supermicro;script;rancid -t supermicro".
> Based on rancid-3.5.1, I managed to get the basic information out of the
> switch with the following changes:
> 
> $ cat etc/rancid/rancid.types.conf
> supermicro;script;rancid -t supermicro
> supermicro;login;smlogin
> supermicro;inloop;supermicro::inloop
> supermicro;module;supermicro
> supermicro;command;supermicro::ShowVersion;show version
> supermicro;command;supermicro::WriteTerm;show running-config

do you/anyone have one of these that I can access remotely?


From gmourani at gmail.com  Thu Dec  8 15:08:28 2016
From: gmourani at gmail.com (Gerhard Mourani)
Date: Thu, 8 Dec 2016 10:08:28 -0500
Subject: [rancid] Fortigate OSPF MD5 key
Message-ID: <3562C498-DC24-4C95-B4F0-9825DC3E0DB0@gmail.com>

Hello,

I've a small problem with Fortigate devices using OSPF with dynamic key. Every time a new check is made, new backup is generated because dynamic MD5 Key change and I get something like the following each time.

set md5-key 10 "ENC 9RFKaZXxTsGOoGB9rTkLTLo3fdR2"

Does someone know how I can exclude this kind of line to be taken?

Gerhard,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161208/4e77669c/attachment.html>

From heas at shrubbery.net  Thu Dec  8 17:33:55 2016
From: heas at shrubbery.net (heasley)
Date: Thu, 8 Dec 2016 17:33:55 +0000
Subject: [rancid] Fortigate OSPF MD5 key
In-Reply-To: <20161208172838.4062F1CFA57@sea.shrubbery.net>
 <3562C498-DC24-4C95-B4F0-9825DC3E0DB0@gmail.com>
Message-ID: <20161208173355.GD21846@shrubbery.net>

Thu, Dec 08, 2016 at 10:08:28AM -0500, Gerhard Mourani:
> I've a small problem with Fortigate devices using OSPF with dynamic key. Every time a new check is made, new backup is generated because dynamic MD5 Key change and I get something like the following each time.
> 
> set md5-key 10 "ENC 9RFKaZXxTsGOoGB9rTkLTLo3fdR2"
> 
> Does someone know how I can exclude this kind of line to be taken?

Based on rancid 3.6, i think this will filter it, lmk if it doesn't:

Index: bin/fnrancid.in
===================================================================
--- bin/fnrancid.in	(revision 3536)
+++ bin/fnrancid.in	(working copy)
@@ -228,7 +228,7 @@
 	    next;
 	}
 	# filter cycling password encryption
-	if (/^(\s*set \S*)\s(enc\s\S+)(.*)/i &&
+	if (/^(\s*set \S*( \d+)?)\s("?enc\s\S+"?)(.*)/i &&
 	    ($filter_osc || $filter_pwds > 0)) {
 	    ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
 	    next;


From gmourani at gmail.com  Thu Dec  8 18:29:53 2016
From: gmourani at gmail.com (Gerhard Mourani)
Date: Thu, 8 Dec 2016 13:29:53 -0500
Subject: [rancid] Fortigate OSPF MD5 key
In-Reply-To: <20161208173355.GD21846@shrubbery.net>
References: <20161208173355.GD21846@shrubbery.net>
Message-ID: <84E1EC40-EAF8-4EFC-9DA6-D26A099616BB@gmail.com>

It doesn't, I've md5-key + auth-password now! worse then before.

I'm using Rancid version 3.2.11 and here my original lines:

        # filter cycling password encryption
        if (/^\s*(set [^\s]*)\s(enc\s[^\s]+)(.*)/i && $filter_pwds > 0 ) {
            ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
            next;
        }

Gerhard,

> On Dec 8, 2016, at 12:33 PM, heasley <heas at shrubbery.net> wrote:
> 
> Thu, Dec 08, 2016 at 10:08:28AM -0500, Gerhard Mourani:
>> I've a small problem with Fortigate devices using OSPF with dynamic key. Every time a new check is made, new backup is generated because dynamic MD5 Key change and I get something like the following each time.
>> 
>> set md5-key 10 "ENC 9RFKaZXxTsGOoGB9rTkLTLo3fdR2"
>> 
>> Does someone know how I can exclude this kind of line to be taken?
> 
> Based on rancid 3.6, i think this will filter it, lmk if it doesn't:
> 
> Index: bin/fnrancid.in
> ===================================================================
> --- bin/fnrancid.in	(revision 3536)
> +++ bin/fnrancid.in	(working copy)
> @@ -228,7 +228,7 @@
> 	    next;
> 	}
> 	# filter cycling password encryption
> -	if (/^(\s*set \S*)\s(enc\s\S+)(.*)/i &&
> +	if (/^(\s*set \S*( \d+)?)\s("?enc\s\S+"?)(.*)/i &&
> 	    ($filter_osc || $filter_pwds > 0)) {
> 	    ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
> 	    next;
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161208/01a7f83a/attachment.html>

From heas at shrubbery.net  Thu Dec  8 18:45:44 2016
From: heas at shrubbery.net (heasley)
Date: Thu, 8 Dec 2016 18:45:44 +0000
Subject: [rancid] Fortigate OSPF MD5 key
In-Reply-To: <84E1EC40-EAF8-4EFC-9DA6-D26A099616BB@gmail.com>
References: <20161208173355.GD21846@shrubbery.net>
 <84E1EC40-EAF8-4EFC-9DA6-D26A099616BB@gmail.com>
Message-ID: <20161208184544.GH21846@shrubbery.net>

Thu, Dec 08, 2016 at 01:29:53PM -0500, Gerhard Mourani:
> It doesn't, I've md5-key + auth-password now! worse then before.
> 
> I'm using Rancid version 3.2.11 and here my original lines:

$filter_osc isnt in 3.2 (besides that there never was a 3.2.11).  If you
included that when you patched your script, I'm not sure what the result
would be.  Otherwise, it looks like it should have worked for both cases.

if you can provide a .raw file, i can fix this more easily:
export NOPIPE=YES
fnrancid -dl hostname
send hostname.raw to me as an attachment.

>         # filter cycling password encryption
>         if (/^\s*(set [^\s]*)\s(enc\s[^\s]+)(.*)/i && $filter_pwds > 0 ) {
>             ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
>             next;
>         }
> 
> Gerhard,
> 
> > On Dec 8, 2016, at 12:33 PM, heasley <heas at shrubbery.net> wrote:
> > 
> > Thu, Dec 08, 2016 at 10:08:28AM -0500, Gerhard Mourani:
> >> I've a small problem with Fortigate devices using OSPF with dynamic key. Every time a new check is made, new backup is generated because dynamic MD5 Key change and I get something like the following each time.
> >> 
> >> set md5-key 10 "ENC 9RFKaZXxTsGOoGB9rTkLTLo3fdR2"
> >> 
> >> Does someone know how I can exclude this kind of line to be taken?
> > 
> > Based on rancid 3.6, i think this will filter it, lmk if it doesn't:
> > 
> > Index: bin/fnrancid.in
> > ===================================================================
> > --- bin/fnrancid.in	(revision 3536)
> > +++ bin/fnrancid.in	(working copy)
> > @@ -228,7 +228,7 @@
> > 	    next;
> > 	}
> > 	# filter cycling password encryption
> > -	if (/^(\s*set \S*)\s(enc\s\S+)(.*)/i &&
> > +	if (/^(\s*set \S*( \d+)?)\s("?enc\s\S+"?)(.*)/i &&
> > 	    ($filter_osc || $filter_pwds > 0)) {
> > 	    ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
> > 	    next;
> > 
> 


From heas at shrubbery.net  Fri Dec  9 18:22:50 2016
From: heas at shrubbery.net (heasley)
Date: Fri, 9 Dec 2016 18:22:50 +0000
Subject: [rancid] Fortigate OSPF MD5 key
In-Reply-To: <20161209182137.EA19F8E690@sea.shrubbery.net>
 <20161208184544.GH21846@shrubbery.net>
Message-ID: <20161209182250.GD24603@shrubbery.net>

Thu, Dec 08, 2016 at 06:45:44PM +0000, heasley:
> Thu, Dec 08, 2016 at 01:29:53PM -0500, Gerhard Mourani:
> > It doesn't, I've md5-key + auth-password now! worse then before.
> > 
> > I'm using Rancid version 3.2.11 and here my original lines:
> 
> $filter_osc isnt in 3.2 (besides that there never was a 3.2.11).  If you
> included that when you patched your script, I'm not sure what the result
> would be.  Otherwise, it looks like it should have worked for both cases.
> 
> if you can provide a .raw file, i can fix this more easily:
> export NOPIPE=YES
> fnrancid -dl hostname
> send hostname.raw to me as an attachment.
> 
> >         # filter cycling password encryption
> >         if (/^\s*(set [^\s]*)\s(enc\s[^\s]+)(.*)/i && $filter_pwds > 0 ) {
> >             ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
> >             next;
> >         }
> > 
> > Gerhard,

This appears to work:

Index: fnrancid.in
===================================================================
--- fnrancid.in	(revision 3460)
+++ fnrancid.in	(working copy)
@@ -228,9 +228,9 @@
 	    next;
 	}
 	# filter cycling password encryption
-	if (/^(\s*set \S*)\s(enc\s\S+)(.*)/i &&
+	if (/^(\s*set \S*( \d+)?)\s("?enc\s\S+"?)(.*)/i &&
 	    ($filter_osc || $filter_pwds > 0)) {
-	    ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
+	    ProcessHistory("ENC","","","#$1 ENC <removed> $4\n");
 	    next;
 	}
 	ProcessHistory("","","","$_");


From gmourani at gmail.com  Fri Dec  9 19:38:54 2016
From: gmourani at gmail.com (Gerhard Mourani)
Date: Fri, 9 Dec 2016 14:38:54 -0500
Subject: [rancid] Fortigate OSPF MD5 key
In-Reply-To: <20161209182250.GD24603@shrubbery.net>
References: <20161209182250.GD24603@shrubbery.net>
Message-ID: <17C01952-22EC-4207-AC17-B2EFA7C5E4EA@gmail.com>

Yes, it appears to work. I'll continue to check it for some days and will let you know if something change. Big thanks for your great help here.

> On Dec 9, 2016, at 1:22 PM, heasley <heas at shrubbery.net> wrote:
> 
> Thu, Dec 08, 2016 at 06:45:44PM +0000, heasley:
>> Thu, Dec 08, 2016 at 01:29:53PM -0500, Gerhard Mourani:
>>> It doesn't, I've md5-key + auth-password now! worse then before.
>>> 
>>> I'm using Rancid version 3.2.11 and here my original lines:
>> 
>> $filter_osc isnt in 3.2 (besides that there never was a 3.2.11).  If you
>> included that when you patched your script, I'm not sure what the result
>> would be.  Otherwise, it looks like it should have worked for both cases.
>> 
>> if you can provide a .raw file, i can fix this more easily:
>> export NOPIPE=YES
>> fnrancid -dl hostname
>> send hostname.raw to me as an attachment.
>> 
>>>        # filter cycling password encryption
>>>        if (/^\s*(set [^\s]*)\s(enc\s[^\s]+)(.*)/i && $filter_pwds > 0 ) {
>>>            ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
>>>            next;
>>>        }
>>> 
>>> Gerhard,
> 
> This appears to work:
> 
> Index: fnrancid.in
> ===================================================================
> --- fnrancid.in	(revision 3460)
> +++ fnrancid.in	(working copy)
> @@ -228,9 +228,9 @@
> 	    next;
> 	}
> 	# filter cycling password encryption
> -	if (/^(\s*set \S*)\s(enc\s\S+)(.*)/i &&
> +	if (/^(\s*set \S*( \d+)?)\s("?enc\s\S+"?)(.*)/i &&
> 	    ($filter_osc || $filter_pwds > 0)) {
> -	    ProcessHistory("ENC","","","#$1 ENC <removed> $3\n");
> +	    ProcessHistory("ENC","","","#$1 ENC <removed> $4\n");
> 	    next;
> 	}
> 	ProcessHistory("","","","$_");
> 


From erikm at buh.org  Mon Dec 12 00:42:22 2016
From: erikm at buh.org (Erik Muller)
Date: Sun, 11 Dec 2016 19:42:22 -0500
Subject: [rancid] juniper dynamic-vpn license filtering
Message-ID: <e09f3f26-55af-72e3-7c6d-c50256a965b8@buh.org>

I've recently started monitoring a few branch SRXes that are serving as
backup out-of-band access to production sites, and the license usage change
every time somebody (dis)connects gets to be a bit much.  The attached
patch tweaks the existing license filtering to ignore changes in usage on
small pools.  The 100 threshold is kind of arbitrary; 500 might be a more
reasonable number for where the percentage summary starts to be useful and
4000 looks to be where the large-scale subscriber licenses start - but this
at least reduces the noise at the low end.  Or should this maybe just
follow the filter_osc model?

tested on 3.3.0(ubuntu), but the patch seems clean against 3.6 still.

-e
-------------- next part --------------
--- junos.pm.orig	2016-12-11 15:38:54.564455375 -0500
+++ junos.pm	2016-12-11 15:39:42.404544746 -0500
@@ -456,20 +456,26 @@
 	next if (/^\{(master|backup)(:\d+)?\}/);
 
 	# licenses used changes constantly.  distill it to a percentage.
-	if (/^(\s+scale-subscriber)(\s+)(\d+)(\s+\d+)(.*$)/) {
+	if (/^(\s+(?:dynamic-vpn|scale-subscriber))(\s+)(\d+)(\s+\d+)(.*$)/) {
 	    my($a, $sp, $used, $avail, $rem) = ($1, $2, $3, $4, $5);
 	    my($spl, $usedl) = (length($sp), length($used));
 	    my($pcnt);
+	    my($usage);
 	    if ($avail < 1) {
 		$pcnt = ">100";
+	    } elsif ($avail < 100) {
+		# if license count is small, percentage doesn't do much to
+		# stabilize the output - just skip it.
+		$usage = "--";
 	    } else {
 		$pcnt = int(($used + 0.0) / ($avail + 0.0) * 100);
 	    }
-	    my($pcntl) = length($pcnt) + 1;
+	    if (defined $pcnt) { $usage = sprintf("%s%%",$pcnt) };
+	    my($pcntl) = length($usage) ;
 	    $spl = $spl + $usedl - $pcntl;
 
-	    my($fmt) = "%s%-" . $spl . "s%s%%%s%s\n";
-	    $_ = sprintf($fmt, $a, "", $pcnt, $avail, $rem);
+	    my($fmt) = "%s%-" . $spl . "s%s%s%s\n";
+	    $_ = sprintf($fmt, $a, "", $usage, $avail, $rem);
 	}
 
 	/Unrecognized command/ && return(1);

From aleromex at gmail.com  Mon Dec 12 09:01:24 2016
From: aleromex at gmail.com (Alexander R)
Date: Mon, 12 Dec 2016 12:01:24 +0300
Subject: [rancid] IBM BNT Layer 2/3 Copper Gigabit Ethernet Switch no config
 collected
Message-ID: <CANkm-FiUSx9CnNe2B_WT=J4H=1F0pNB1KD=SJfkr1ojz60WuHw@mail.gmail.com>

Hi,

my configuration:
centos 7 x86_64
i've issue in rancid 3.5.1 and 3.6.0

i've issue to collect configs from switch modules "BNT Layer 2/3 Copper
Gigabit Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH image1))",
it has IP 192.168.1.11

It's cisco-like CLI, so i've created my own "ibm" type in rancid.types.conf:

# cat /etc/rancid/rancid.types.conf
ibm;script;rancid -t ibm
ibm;login;clogin
ibm;module;ios
ibm;inloop;ios::inloop
ibm;command;ios::WriteTerm;show running-config

It's working fine with other switch module  "IBM Networking OS Virtual
Fabric 10Gb Switch Module for IBM BladeCenter (7.8.3 (FLASH image1))" and
it have IP 192.168.1.12, but not with "BNT Layer 2/3 Copper Gigabit
Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH image1))"

Fail device:
# rancid -t ibm -d 192.168.1.11
loadtype: device type ibm
loadtype: found device type ibm in /etc/rancid/rancid.types.conf
executing clogin -t 90 -c"show running-config" 192.168.1.11
PROMPT MATCH: sw11#
HIT COMMAND:sw11#show running-config
    In WriteTerm: sw11#show running-config
192.168.1.11: End of run not found
end

In 192.168.1.11.raw i see config issued by "show run..."

Ok device:
# rancid -t ibm -d 192.168.1.12
loadtype: device type ibm
loadtype: found device type ibm in /etc/rancid/rancid.types.conf
executing clogin -t 90 -c"show running-config" 192.168.1.12
PROMPT MATCH: sw12#
HIT COMMAND:sw12#show running-config
    In WriteTerm: sw12#show running-config
192.168.1.12: End of run not found
end

ps. 192.168.1.11 has NO words "exit" in config, because interface isn't
configured (such a configuration plan).
192.168.1.12 has words "exit", because interfaces is configured.

Could you help me?

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161212/19cb907e/attachment.html>

From andrewm659 at yahoo.com  Mon Dec 12 17:13:39 2016
From: andrewm659 at yahoo.com (Andrew Meyer)
Date: Mon, 12 Dec 2016 17:13:39 +0000 (UTC)
Subject: [rancid] Nortel Baystack 5000 series switch
References: <24017693.1249660.1481562819784.ref@mail.yahoo.com>
Message-ID: <24017693.1249660.1481562819784@mail.yahoo.com>

Trying to look for ways to get this working with RANCID. ?Do I need to use baynet?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161212/1d55b385/attachment.html>

From heas at shrubbery.net  Mon Dec 12 21:19:51 2016
From: heas at shrubbery.net (heasley)
Date: Mon, 12 Dec 2016 21:19:51 +0000
Subject: [rancid] IBM BNT Layer 2/3 Copper Gigabit Ethernet Switch no
 config collected
In-Reply-To: <CANkm-FiUSx9CnNe2B_WT=J4H=1F0pNB1KD=SJfkr1ojz60WuHw@mail.gmail.com>
References: <CANkm-FiUSx9CnNe2B_WT=J4H=1F0pNB1KD=SJfkr1ojz60WuHw@mail.gmail.com>
Message-ID: <20161212211951.GE57590@shrubbery.net>

Mon, Dec 12, 2016 at 12:01:24PM +0300, Alexander R:
> my configuration:
> centos 7 x86_64
> i've issue in rancid 3.5.1 and 3.6.0

thank you for including this.

> i've issue to collect configs from switch modules "BNT Layer 2/3 Copper
> Gigabit Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH image1))",
> it has IP 192.168.1.11
> 
> It's cisco-like CLI, so i've created my own "ibm" type in rancid.types.conf:
> 
> # cat /etc/rancid/rancid.types.conf
> ibm;script;rancid -t ibm
> ibm;login;clogin
> ibm;module;ios
> ibm;inloop;ios::inloop
> ibm;command;ios::WriteTerm;show running-config
> 
> It's working fine with other switch module  "IBM Networking OS Virtual
> Fabric 10Gb Switch Module for IBM BladeCenter (7.8.3 (FLASH image1))" and
> it have IP 192.168.1.12, but not with "BNT Layer 2/3 Copper Gigabit
> Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH image1))"
> 
> Fail device:
> # rancid -t ibm -d 192.168.1.11
> loadtype: device type ibm
> loadtype: found device type ibm in /etc/rancid/rancid.types.conf
> executing clogin -t 90 -c"show running-config" 192.168.1.11
> PROMPT MATCH: sw11#
> HIT COMMAND:sw11#show running-config
>     In WriteTerm: sw11#show running-config
> 192.168.1.11: End of run not found
> end
> 
> In 192.168.1.11.raw i see config issued by "show run..."
> 
> Ok device:
> # rancid -t ibm -d 192.168.1.12
> loadtype: device type ibm
> loadtype: found device type ibm in /etc/rancid/rancid.types.conf
> executing clogin -t 90 -c"show running-config" 192.168.1.12
> PROMPT MATCH: sw12#
> HIT COMMAND:sw12#show running-config
>     In WriteTerm: sw12#show running-config
> 192.168.1.12: End of run not found
> end
> 
> ps. 192.168.1.11 has NO words "exit" in config, because interface isn't
> configured (such a configuration plan).
> 192.168.1.12 has words "exit", because interfaces is configured.
> 
> Could you help me?

ios::WriteTerM() will expect to find and "end" marker in the config, without
which it will not set $found_end.  if this device does not have this marker
or something similar that a customer version of ios::WriteTerm could use,
you can use a custom version of ios::WriteTerm that just counts lines, which
ios::WriteTerm already does if the input is an ASA (or a few others), which
lack an end marker.

the purpose of this is that some devices behave poorly in low memory
conditions, eg: memory leaks.  some appear to succeed to produce a config,
but output nothing.  requiring the marker prevents rancid from dropping
the config from the repo.


From heas at shrubbery.net  Mon Dec 12 21:23:26 2016
From: heas at shrubbery.net (heasley)
Date: Mon, 12 Dec 2016 21:23:26 +0000
Subject: [rancid] Nortel Baystack 5000 series switch
In-Reply-To: <24017693.1249660.1481562819784@mail.yahoo.com>
References: <24017693.1249660.1481562819784.ref@mail.yahoo.com>
 <24017693.1249660.1481562819784@mail.yahoo.com>
Message-ID: <20161212212326.GF57590@shrubbery.net>

Mon, Dec 12, 2016 at 05:13:39PM +0000, Andrew Meyer:
> Trying to look for ways to get this working with RANCID. ?Do I need to use baynet?

No idea.  Try it.  if its an oem, try the oem type if there is one.


From aleromex at gmail.com  Tue Dec 13 07:30:08 2016
From: aleromex at gmail.com (Alexander R)
Date: Tue, 13 Dec 2016 10:30:08 +0300
Subject: [rancid] IBM BNT Layer 2/3 Copper Gigabit Ethernet Switch no
 config collected
In-Reply-To: <20161212211951.GE57590@shrubbery.net>
References: <CANkm-FiUSx9CnNe2B_WT=J4H=1F0pNB1KD=SJfkr1ojz60WuHw@mail.gmail.com>
 <20161212211951.GE57590@shrubbery.net>
Message-ID: <CANkm-Fgst5dfm=_k7KdNkftEGE0Ju_eZCbekCtX_8uwUe-NCDw@mail.gmail.com>

On Tue, Dec 13, 2016 at 12:19 AM, heasley <heas at shrubbery.net> wrote:

> Mon, Dec 12, 2016 at 12:01:24PM +0300, Alexander R:
> > my configuration:
> > centos 7 x86_64
> > i've issue in rancid 3.5.1 and 3.6.0
>
> thank you for including this.
>
> > i've issue to collect configs from switch modules "BNT Layer 2/3 Copper
> > Gigabit Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH
> image1))",
> > it has IP 192.168.1.11
> >
> > It's cisco-like CLI, so i've created my own "ibm" type in
> rancid.types.conf:
> >
> > # cat /etc/rancid/rancid.types.conf
> > ibm;script;rancid -t ibm
> > ibm;login;clogin
> > ibm;module;ios
> > ibm;inloop;ios::inloop
> > ibm;command;ios::WriteTerm;show running-config
> >
> > It's working fine with other switch module  "IBM Networking OS Virtual
> > Fabric 10Gb Switch Module for IBM BladeCenter (7.8.3 (FLASH image1))" and
> > it have IP 192.168.1.12, but not with "BNT Layer 2/3 Copper Gigabit
> > Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH image1))"
> >
> > Fail device:
> > # rancid -t ibm -d 192.168.1.11
> > loadtype: device type ibm
> > loadtype: found device type ibm in /etc/rancid/rancid.types.conf
> > executing clogin -t 90 -c"show running-config" 192.168.1.11
> > PROMPT MATCH: sw11#
> > HIT COMMAND:sw11#show running-config
> >     In WriteTerm: sw11#show running-config
> > 192.168.1.11: End of run not found
> > end
> >
> > In 192.168.1.11.raw i see config issued by "show run..."
> >
> > Ok device:
> > # rancid -t ibm -d 192.168.1.12
> > loadtype: device type ibm
> > loadtype: found device type ibm in /etc/rancid/rancid.types.conf
> > executing clogin -t 90 -c"show running-config" 192.168.1.12
> > PROMPT MATCH: sw12#
> > HIT COMMAND:sw12#show running-config
> >     In WriteTerm: sw12#show running-config
> > 192.168.1.12: End of run not found
> > end
> >
> > ps. 192.168.1.11 has NO words "exit" in config, because interface isn't
> > configured (such a configuration plan).
> > 192.168.1.12 has words "exit", because interfaces is configured.
> >
> > Could you help me?
>
> ios::WriteTerM() will expect to find and "end" marker in the config,
> without
> which it will not set $found_end.  if this device does not have this marker
> or something similar that a customer version of ios::WriteTerm could use,
> you can use a custom version of ios::WriteTerm that just counts lines,
> which
> ios::WriteTerm already does if the input is an ASA (or a few others), which
> lack an end marker.
>

Hi,
thank you for responce.

It's my configs

Ok device:
rancid]# tail -n5 192.168.1.12.raw
ntp secondary-server 192.168.1.1
!
end

sw12#exitReceived disconnect from 192.168.1.12: 11: Logged out.
rancid]#

Fail device:
rancid]# tail -n5 192.168.1.11.raw
ntp secondary-server 192.168.1.1
!
end

sw11#exitReceived disconnect from 192.168.1.11: 11: Logged out.
rancid]#

So, both switches have "end" word at the end of file. Any ideas? I don't
know why it's not worked on same "text" files


> the purpose of this is that some devices behave poorly in low memory
> conditions, eg: memory leaks.  some appear to succeed to produce a config,
> but output nothing.  requiring the marker prevents rancid from dropping
> the config from the repo.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161213/a04dc1ab/attachment.html>

From andrewm659 at yahoo.com  Tue Dec 13 14:02:34 2016
From: andrewm659 at yahoo.com (Andrew Meyer)
Date: Tue, 13 Dec 2016 14:02:34 +0000 (UTC)
Subject: [rancid] Nortel Baystack 5000 series switch
In-Reply-To: <20161212212326.GF57590@shrubbery.net>
References: <24017693.1249660.1481562819784.ref@mail.yahoo.com>
 <24017693.1249660.1481562819784@mail.yahoo.com>
 <20161212212326.GF57590@shrubbery.net>
Message-ID: <2099552308.1828967.1481637754393@mail.yahoo.com>

So I got it to work with the baynet config. ?However I get something about the enable password not working. ?Do I need to do a enableprompt? 

    On Monday, December 12, 2016 3:23 PM, heasley <heas at shrubbery.net> wrote:
 
 

 Mon, Dec 12, 2016 at 05:13:39PM +0000, Andrew Meyer:
> Trying to look for ways to get this working with RANCID. ?Do I need to use baynet?

No idea.? Try it.? if its an oem, try the oem type if there is one.


 
   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161213/0fb83fe7/attachment.html>

From andrewm659 at yahoo.com  Tue Dec 13 14:19:35 2016
From: andrewm659 at yahoo.com (Andrew Meyer)
Date: Tue, 13 Dec 2016 14:19:35 +0000 (UTC)
Subject: [rancid] Nortel Baystack 5000 series switch
In-Reply-To: <2099552308.1828967.1481637754393@mail.yahoo.com>
References: <24017693.1249660.1481562819784.ref@mail.yahoo.com>
 <24017693.1249660.1481562819784@mail.yahoo.com>
 <20161212212326.GF57590@shrubbery.net>
 <2099552308.1828967.1481637754393@mail.yahoo.com>
Message-ID: <1589361281.1829453.1481638775836@mail.yahoo.com>


? ? ? ? ? ? ? ? ? ? ? ? ?Incorrect PasswordError: Check your Enable passwd
 

    On Tuesday, December 13, 2016 8:02 AM, Andrew Meyer <andrewm659 at yahoo.com> wrote:
 
 

 So I got it to work with the baynet config. ?However I get something about the enable password not working. ?Do I need to do a enableprompt? 

    On Monday, December 12, 2016 3:23 PM, heasley <heas at shrubbery.net> wrote:
 
 

 Mon, Dec 12, 2016 at 05:13:39PM +0000, Andrew Meyer:
> Trying to look for ways to get this working with RANCID. ?Do I need to use baynet?

No idea.? Try it.? if its an oem, try the oem type if there is one.


 
   

 
   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161213/b350797b/attachment.html>

From fra.nospam.nk at gmx.de  Tue Dec 13 21:34:42 2016
From: fra.nospam.nk at gmx.de (Frank Fegert)
Date: Tue, 13 Dec 2016 22:34:42 +0100
Subject: [rancid] Support for Dell EqualLogic PS-Series Storages in RANCID
Message-ID: <20161213213442.GA22690@dyndns.org>

Hello all,

i'd like to propose to add support for Dell EqualLogic PS-Series
storage arrays to RANCID. I've described the necessary extensions
and changes here:
  http://www.bityard.org/blog/2016/12/13/dell_equallogic_ps-series_rancid

and there is a Git branch containing the changes available here:
  https://github.com/frank-fegert/rancid/tree/equallogic

Besides some minor changes to the build system and documentation,
the only major additions are "bin/eqllogin(.in)" and "lib/equal-
logic.pm(.in)".

The extensions have been successfully tested against the following
Dell EqualLogic PS-Series models:
  Dell EqualLogic PS-M4110
  Dell EqualLogic PS-4210
  Dell EqualLogic PS-6210

and have been in production use for over a month now.

Can you please consider the provided extensions for inclusion in
the next rancid release?

Thanks & best regards,

    Frank Fegert


From Muhammad_Shoaib at comcastspectacor.com  Thu Dec 15 18:58:02 2016
From: Muhammad_Shoaib at comcastspectacor.com (Shoaib, Muhammad)
Date: Thu, 15 Dec 2016 18:58:02 +0000
Subject: [rancid] config changes are repeating
In-Reply-To: <D47823BE.4F542%muhammad_shoaib@comcastspectacor.com>
References: <D47823BE.4F542%muhammad_shoaib@comcastspectacor.com>
Message-ID: <D4782770.4F561%muhammad_shoaib@comcastspectacor.com>

Hi,

All of a sudden, I have notice that RANCID is keep reporting the same
changes that were made yesterday.

Seems like it is not registering that changes are reported yesterday and
there aren't any new changes.

This is happening only to one set of Group. Other groups reporting working
fine and their changes reported by RANCID only once, as it usually does.

Appreciate any hints or ideas how to troubleshoot and fix the problem.

RANCID version 2.3.8 running on CentOS Linux

Thank you,
Muhammad


From andrewm659 at yahoo.com  Fri Dec 16 16:17:34 2016
From: andrewm659 at yahoo.com (Andrew Meyer)
Date: Fri, 16 Dec 2016 16:17:34 +0000 (UTC)
Subject: [rancid] Nortel Baystack 5510
References: <544603663.353982.1481905054974.ref@mail.yahoo.com>
Message-ID: <544603663.353982.1481905054974@mail.yahoo.com>

So after further investigation I have found that there are extra scripts I can download and run, however, the brancid script work with it. ?I am trying to figure out how to drop my rancid user into enable mode. ?But it doesn't reauthenticate. ?My question is, if I can't get it to reauth right now, if there a way to put in the .cloginrc file to not have an enable password?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161216/edbde895/attachment.html>

From heas at shrubbery.net  Fri Dec 16 17:23:48 2016
From: heas at shrubbery.net (heasley)
Date: Fri, 16 Dec 2016 17:23:48 +0000
Subject: [rancid] Nortel Baystack 5510
In-Reply-To: <544603663.353982.1481905054974@mail.yahoo.com>
References: <544603663.353982.1481905054974.ref@mail.yahoo.com>
 <544603663.353982.1481905054974@mail.yahoo.com>
Message-ID: <20161216172348.GF96654@shrubbery.net>

Fri, Dec 16, 2016 at 04:17:34PM +0000, Andrew Meyer:
> So after further investigation I have found that there are extra scripts I can download and run, however, the brancid script work with it. ?I am trying to figure out how to drop my rancid user into enable mode. ?But it doesn't reauthenticate. ?My question is, if I can't get it to reauth right now, if there a way to put in the .cloginrc file to not have an enable password?

"to not have an enable password"? you mean do not enable?  see noenable in
cloginrc(5).


From heas at shrubbery.net  Fri Dec 16 17:44:03 2016
From: heas at shrubbery.net (heasley)
Date: Fri, 16 Dec 2016 17:44:03 +0000
Subject: [rancid] IBM BNT Layer 2/3 Copper Gigabit Ethernet Switch no
 config collected
In-Reply-To: <CANkm-Fgst5dfm=_k7KdNkftEGE0Ju_eZCbekCtX_8uwUe-NCDw@mail.gmail.com>
References: <CANkm-FiUSx9CnNe2B_WT=J4H=1F0pNB1KD=SJfkr1ojz60WuHw@mail.gmail.com>
 <20161212211951.GE57590@shrubbery.net>
 <CANkm-Fgst5dfm=_k7KdNkftEGE0Ju_eZCbekCtX_8uwUe-NCDw@mail.gmail.com>
Message-ID: <20161216174403.GH96654@shrubbery.net>

Tue, Dec 13, 2016 at 10:30:08AM +0300, Alexander R:
> On Tue, Dec 13, 2016 at 12:19 AM, heasley <heas at shrubbery.net> wrote:
> 
> > Mon, Dec 12, 2016 at 12:01:24PM +0300, Alexander R:
> > > my configuration:
> > > centos 7 x86_64
> > > i've issue in rancid 3.5.1 and 3.6.0
> >
> > thank you for including this.
> >
> > > i've issue to collect configs from switch modules "BNT Layer 2/3 Copper
> > > Gigabit Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH
> > image1))",
> > > it has IP 192.168.1.11
> > >
> > > It's cisco-like CLI, so i've created my own "ibm" type in
> > rancid.types.conf:
> > >
> > > # cat /etc/rancid/rancid.types.conf
> > > ibm;script;rancid -t ibm
> > > ibm;login;clogin
> > > ibm;module;ios
> > > ibm;inloop;ios::inloop
> > > ibm;command;ios::WriteTerm;show running-config
> > >
> > > It's working fine with other switch module  "IBM Networking OS Virtual
> > > Fabric 10Gb Switch Module for IBM BladeCenter (7.8.3 (FLASH image1))" and
> > > it have IP 192.168.1.12, but not with "BNT Layer 2/3 Copper Gigabit
> > > Ethernet Switch Module for IBM BladeCenter (5.2.8 (FLASH image1))"
> > >
> > > Fail device:
> > > # rancid -t ibm -d 192.168.1.11
> > > loadtype: device type ibm
> > > loadtype: found device type ibm in /etc/rancid/rancid.types.conf
> > > executing clogin -t 90 -c"show running-config" 192.168.1.11
> > > PROMPT MATCH: sw11#
> > > HIT COMMAND:sw11#show running-config
> > >     In WriteTerm: sw11#show running-config
> > > 192.168.1.11: End of run not found
> > > end
> > >
> > > In 192.168.1.11.raw i see config issued by "show run..."
> > >
> > > Ok device:
> > > # rancid -t ibm -d 192.168.1.12
> > > loadtype: device type ibm
> > > loadtype: found device type ibm in /etc/rancid/rancid.types.conf
> > > executing clogin -t 90 -c"show running-config" 192.168.1.12
> > > PROMPT MATCH: sw12#
> > > HIT COMMAND:sw12#show running-config
> > >     In WriteTerm: sw12#show running-config
> > > 192.168.1.12: End of run not found
> > > end
> > >
> > > ps. 192.168.1.11 has NO words "exit" in config, because interface isn't
> > > configured (such a configuration plan).
> > > 192.168.1.12 has words "exit", because interfaces is configured.
> > >
> > > Could you help me?
> >
> > ios::WriteTerM() will expect to find and "end" marker in the config,
> > without
> > which it will not set $found_end.  if this device does not have this marker
> > or something similar that a customer version of ios::WriteTerm could use,
> > you can use a custom version of ios::WriteTerm that just counts lines,
> > which
> > ios::WriteTerm already does if the input is an ASA (or a few others), which
> > lack an end marker.
> >
> 
> Hi,
> thank you for responce.
> 
> It's my configs
> 
> Ok device:
> rancid]# tail -n5 192.168.1.12.raw
> ntp secondary-server 192.168.1.1
> !
> end
> 
> sw12#exitReceived disconnect from 192.168.1.12: 11: Logged out.
> rancid]#
> 
> Fail device:
> rancid]# tail -n5 192.168.1.11.raw
> ntp secondary-server 192.168.1.1
> !
> end
> 
> sw11#exitReceived disconnect from 192.168.1.11: 11: Logged out.
          ^^ this is likely the problem; the lousy thing didnt echo the
CR.  inloop() expects the CR and set $clean_run.  you'll have to adjust
the match; the lousy exos does this too.

> rancid]#
> 
> So, both switches have "end" word at the end of file. Any ideas? I don't
> know why it's not worked on same "text" files
> 
> 
> > the purpose of this is that some devices behave poorly in low memory
> > conditions, eg: memory leaks.  some appear to succeed to produce a config,
> > but output nothing.  requiring the marker prevents rancid from dropping
> > the config from the repo.
> >


From heas at shrubbery.net  Fri Dec 16 20:08:37 2016
From: heas at shrubbery.net (heasley)
Date: Fri, 16 Dec 2016 20:08:37 +0000
Subject: [rancid] Support for Dell EqualLogic PS-Series Storages in
 RANCID
In-Reply-To: <20161213213442.GA22690@dyndns.org>
References: <20161213213442.GA22690@dyndns.org>
Message-ID: <20161216200837.GA1019@shrubbery.net>

Tue, Dec 13, 2016 at 10:34:42PM +0100, Frank Fegert:
> Hello all,
> 
> i'd like to propose to add support for Dell EqualLogic PS-Series
> storage arrays to RANCID. I've described the necessary extensions
> and changes here:
>   http://www.bityard.org/blog/2016/12/13/dell_equallogic_ps-series_rancid
> 
> and there is a Git branch containing the changes available here:
>   https://github.com/frank-fegert/rancid/tree/equallogic
> 
> Besides some minor changes to the build system and documentation,
> the only major additions are "bin/eqllogin(.in)" and "lib/equal-
> logic.pm(.in)".
> 
> The extensions have been successfully tested against the following
> Dell EqualLogic PS-Series models:
>   Dell EqualLogic PS-M4110
>   Dell EqualLogic PS-4210
>   Dell EqualLogic PS-6210
> 
> and have been in production use for over a month now.
> 
> Can you please consider the provided extensions for inclusion in
> the next rancid release?

Can anyone who has these devices test Frank's module?


From heas at shrubbery.net  Mon Dec 19 18:04:32 2016
From: heas at shrubbery.net (heasley)
Date: Mon, 19 Dec 2016 18:04:32 +0000
Subject: [rancid] Rancid and Cisco Small Business SG500
In-Reply-To: <8739a2be3c47473bbe078c68c509c72f@THQ-MAIL01.timicogroup.local>
References: <8739a2be3c47473bbe078c68c509c72f@THQ-MAIL01.timicogroup.local>
Message-ID: <20161219180432.GC90301@shrubbery.net>

Wed, Apr 13, 2016 at 09:44:49AM +0000, Richard Savage:
> Hi All
> 
> Im using rancid 2.3.8 and am backup up around 100 cisco small business switches SG300's and SG500's.  Im using the type cisco-sb.
> 
> When backing up the SG500's on every diff the following is coming up:
> 
> Index: configs/rc-pr-sw1
> ===================================================================
> - -- configs/rc-pr-sw1     (revision 1333)
> @@ -16,12 +16,12 @@
>   !---- ------------------------- -------------------------
>   ! 1              24                        OK
>   ! 2              23                        OK
> - ! 3              24                        OK
> + ! 3              22                        OK
>   !Unit     Up time
>   !---- ---------------
> - ! 1     06,07:16:42
> - ! 2     06,07:16:46
> - ! 3     06,07:16:42
> + ! 1     06,13:16:41
> + ! 2     06,13:16:45
> + ! 3     06,13:16:41
>   !
>   !       Unit             SW version         Boot version         HW version
>   !------------------- ------------------- ------------------- -------------------
> 
> Is there a way that rancid can ignore this so that we don't get a diff everytime rancid is run?

I've imported a version of cisco-sb for rancid 4.0, but need a little more
info to address this problem.  Can you tell me from which command this
output comes and show me the raw output?


From xq1xq1xq1 at gmail.com  Mon Dec 19 16:42:28 2016
From: xq1xq1xq1 at gmail.com (JP)
Date: Mon, 19 Dec 2016 10:42:28 -0600
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
Message-ID: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>

Setting up RANCID on CENTOS6

in .cloginrc I put this line:

add password x.x.x.45 {xxxxxx!} {xxxxxx!}



When I try and test my password configuration it fails:

[rancid at tools rancid]$ /usr/libexec/rancid/clogin x.x.x.45
x.x.x.45
spawn telnet x.x.x.45
Trying x.x.x.45...
Connected to x.x.x.45.
Escape character is '^]'.


User Access Verification

Password:
Password:
Password:
% Bad passwords


Error: Check your passwd for x.x.x.45


My password works fine when I enter it manually.

My password contains a " ! " character - could this be causing the problem?

I removed the " ! " with the same results.

I am sure it is something simple - guidance appreciated!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161219/17b6a760/attachment.html>

From heas at shrubbery.net  Mon Dec 19 18:43:05 2016
From: heas at shrubbery.net (heasley)
Date: Mon, 19 Dec 2016 18:43:05 +0000
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
Message-ID: <20161219184305.GJ90301@shrubbery.net>

Mon, Dec 19, 2016 at 10:42:28AM -0600, JP:
> Setting up RANCID on CENTOS6
> 
> in .cloginrc I put this line:
> 
> add password x.x.x.45 {xxxxxx!} {xxxxxx!}
> 
> 
> 
> When I try and test my password configuration it fails:
> 
> [rancid at tools rancid]$ /usr/libexec/rancid/clogin x.x.x.45
> x.x.x.45
> spawn telnet x.x.x.45
> Trying x.x.x.45...
> Connected to x.x.x.45.
> Escape character is '^]'.
> 
> 
> User Access Verification
> 
> Password:
> Password:
> Password:
> % Bad passwords
> 
> 
> Error: Check your passwd for x.x.x.45
> 
> 
> My password works fine when I enter it manually.
> 
> My password contains a " ! " character - could this be causing the problem?
> 
> I removed the " ! " with the same results.
> 
> I am sure it is something simple - guidance appreciated!

add password glob {foo\!bar}


From ler762 at gmail.com  Mon Dec 19 19:09:20 2016
From: ler762 at gmail.com (Lee)
Date: Mon, 19 Dec 2016 14:09:20 -0500
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <20161219184305.GJ90301@shrubbery.net>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
Message-ID: <CAD8GWssVKCUtKSGBCJYh=Q_HuapnGW6dA-LsVBeY9gnwEwR-GQ@mail.gmail.com>

On 12/19/16, heasley <heas at shrubbery.net> wrote:
> Mon, Dec 19, 2016 at 10:42:28AM -0600, JP:
>> Setting up RANCID on CENTOS6
>>
>> in .cloginrc I put this line:
>>
>> add password x.x.x.45 {xxxxxx!} {xxxxxx!}
>>
>> When I try and test my password configuration it fails:
>>
  <.. snip ..>
>>
>> My password works fine when I enter it manually.
>>
>> My password contains a " ! " character - could this be causing the
>> problem?
>
> add password glob {foo\!bar}

Just out of curiosity - why would you need to escape the ! when it's inside {}s?

I've got a ! in one of my passwords and
add password devname {pass!word}
works fine for ssh (I don't use telnet any more).

Thanks,
Lee


From heas at shrubbery.net  Mon Dec 19 23:24:41 2016
From: heas at shrubbery.net (John Heasley)
Date: Mon, 19 Dec 2016 18:24:41 -0500
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <CAD8GWssVKCUtKSGBCJYh=Q_HuapnGW6dA-LsVBeY9gnwEwR-GQ@mail.gmail.com>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
 <CAD8GWssVKCUtKSGBCJYh=Q_HuapnGW6dA-LsVBeY9gnwEwR-GQ@mail.gmail.com>
Message-ID: <4F4DB345-A55B-48D9-A9A4-C0EC4B6556F5@shrubbery.net>

Am 19.12.2016 um 14:09 schrieb Lee <ler762 at gmail.com>:
> 
>> On 12/19/16, heasley <heas at shrubbery.net> wrote:
>> Mon, Dec 19, 2016 at 10:42:28AM -0600, JP:
>>> Setting up RANCID on CENTOS6
>>> 
>>> in .cloginrc I put this line:
>>> 
>>> add password x.x.x.45 {xxxxxx!} {xxxxxx!}
>>> 
>>> When I try and test my password configuration it fails:
>>> 
>  <.. snip ..>
>>> 
>>> My password works fine when I enter it manually.
>>> 
>>> My password contains a " ! " character - could this be causing the
>>> problem?
>> 
>> add password glob {foo\!bar}
> 
> Just out of curiosity - why would you need to escape the ! when it's inside {}s?
> 
> I've got a ! in one of my passwords and
> add password devname {pass!word}
> works fine for ssh (I don't use telnet any more).

Maybe the escaping isnt necessary for !, but it shouldnt hurt. I think i put a list in the manpage. 

> 
> Thanks,
> Lee


From xq1xq1xq1 at gmail.com  Mon Dec 19 23:21:03 2016
From: xq1xq1xq1 at gmail.com (JP)
Date: Mon, 19 Dec 2016 23:21:03 +0000
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <20161219184305.GJ90301@shrubbery.net>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
Message-ID: <CAOYvYswRUkLFjm9eTu+8zkCTK1JbiTpKC97EPuK-Dnn4nqnJ6Q@mail.gmail.com>

Found the issue

Default configuration in the sample cloginrc file was overriding my value -
I should have caught that but was still learning how rancid operated. ?

Relagated to use of telnet since would cost about 5k to get it on my Switch
?

Looks like an awesome tool - will try to get juniper srx firewall backed up
tomorrow ?

On Mon, Dec 19, 2016 at 12:43 PM heasley <heas at shrubbery.net> wrote:

> Mon, Dec 19, 2016 at 10:42:28AM -0600, JP:
>
> > Setting up RANCID on CENTOS6
>
> >
>
> > in .cloginrc I put this line:
>
> >
>
> > add password x.x.x.45 {xxxxxx!} {xxxxxx!}
>
> >
>
> >
>
> >
>
> > When I try and test my password configuration it fails:
>
> >
>
> > [rancid at tools rancid]$ /usr/libexec/rancid/clogin x.x.x.45
>
> > x.x.x.45
>
> > spawn telnet x.x.x.45
>
> > Trying x.x.x.45...
>
> > Connected to x.x.x.45.
>
> > Escape character is '^]'.
>
> >
>
> >
>
> > User Access Verification
>
> >
>
> > Password:
>
> > Password:
>
> > Password:
>
> > % Bad passwords
>
> >
>
> >
>
> > Error: Check your passwd for x.x.x.45
>
> >
>
> >
>
> > My password works fine when I enter it manually.
>
> >
>
> > My password contains a " ! " character - could this be causing the
> problem?
>
> >
>
> > I removed the " ! " with the same results.
>
> >
>
> > I am sure it is something simple - guidance appreciated!
>
>
>
> add password glob {foo\!bar}
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161219/25bf956a/attachment.html>

From rancid at ale.cx  Tue Dec 20 11:57:48 2016
From: rancid at ale.cx (Alex DEKKER)
Date: Tue, 20 Dec 2016 11:57:48 +0000
Subject: [rancid] Rancid and Cisco Small Business SG500
In-Reply-To: <20161219180432.GC90301@shrubbery.net>
References: <8739a2be3c47473bbe078c68c509c72f@THQ-MAIL01.timicogroup.local>
 <20161219180432.GC90301@shrubbery.net>
Message-ID: <d14b29e0306e3223dcfbb135130b0f35@ale.cx>

On 2016-12-19 18:04, heasley wrote:
> Wed, Apr 13, 2016 at 09:44:49AM +0000, Richard Savage:

>> + ! 1     06,13:16:41
>> + ! 2     06,13:16:45
>> + ! 3     06,13:16:41
>>   !
>>   !       Unit             SW version         Boot version         HW 
>> version
>>   !------------------- ------------------- ------------------- 
>> -------------------
>> 
>> Is there a way that rancid can ignore this so that we don't get a diff 
>> everytime rancid is run?
> 
> I've imported a version of cisco-sb for rancid 4.0, but need a little 
> more
> info to address this problem.  Can you tell me from which command this
> output comes and show me the raw output?

show system:

$ csblogin sg500x



User Name:cisco
Password:***********


SG500X#sho system
System Description:                       SG500X-24P 24-Port Gigabit 
with 4-Port 10-Gigabit PoE Stackable Managed Switch
System Up Time (days,hour:min:sec):       486,05:08:01
System Contact:
System Name:                              SG500X
System Location:                          SG500X
System MAC Address:                       d4:d7:48:d3:8e:16
System Object ID:                         1.3.6.1.4.1.9.6.1.85.24.2

Fans Status:                              OK


           Unit            Temperature (Celsius)            Status
------------------------ ------------------------ 
------------------------
            1                        39                       OK


SG500X#quit


alexd


From xq1xq1xq1 at gmail.com  Tue Dec 20 14:09:02 2016
From: xq1xq1xq1 at gmail.com (JP)
Date: Tue, 20 Dec 2016 08:09:02 -0600
Subject: [rancid] Trying to Backup Juniper SRX Firewall
Message-ID: <CAOYvYswsFyS51ViCYE+4fytyMXp__TW=JTO3f=qM9P3D0gfjew@mail.gmail.com>

I have configured RANCID to backup my Cisco switches.

using these commands:

/usr/libexec/rancid/clogin -c 'write term' x.x.x.45 > 45.cfg
/usr/libexec/rancid/clogin -c 'write term' x.x.x..41 > 41.cfg


This works as designed

I have a Juniper SRX-210 firewall that I want to backup.

I am using this command to backup the config:

/usr/libexec/rancid/clogin -c 'set cli screen-length 0;show configuration'
x.x.x.200 > 200.cfg


I think that the problem is that the prompt is not recognized and the
commands are not executed after login:

[rancid at tools rancid]$ /usr/libexec/rancid/clogin -c 'set cli screen-length
0;show configuration' x.x.x.200
x.x.x.200
spawn ssh -c 3des -x -l root x.x.x.200



This system is for the use of authorized users only.
Individuals using this computer system without
authority, or in excess of their authority, are subject
to having all of their activities on this system
monitored and recorded by system personnel.  In the
course of monitoring individuals improperly using this
system, or in the course of system maintenance, the
activities of authorized users may also be monitored.
Anyone using this system expressly consents to such
monitoring and is advised that if such monitoring
reveals possible evidence of criminal activity, system
personnel may provide the evidence of such monitoring
to law enforcement officials.


Password:
--- JUNOS 12.1X46-D50.4 built 2016-04-17 11:15:31 UTC
root at SRX210%

Error: TIMEOUT reached



The rancid logs for the firewall are empty

Does anyone have any words of wisdom to resolve?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161220/add65ba7/attachment.html>

From heas at shrubbery.net  Tue Dec 20 14:27:45 2016
From: heas at shrubbery.net (heasley)
Date: Tue, 20 Dec 2016 14:27:45 +0000
Subject: [rancid] Trying to Backup Juniper SRX Firewall
In-Reply-To: <CAOYvYswsFyS51ViCYE+4fytyMXp__TW=JTO3f=qM9P3D0gfjew@mail.gmail.com>
References: <CAOYvYswsFyS51ViCYE+4fytyMXp__TW=JTO3f=qM9P3D0gfjew@mail.gmail.com>
Message-ID: <20161220142745.GA18847@shrubbery.net>

Tue, Dec 20, 2016 at 08:09:02AM -0600, JP:
> I have configured RANCID to backup my Cisco switches.
> 
> using these commands:
> 
> /usr/libexec/rancid/clogin -c 'write term' x.x.x.45 > 45.cfg
> /usr/libexec/rancid/clogin -c 'write term' x.x.x..41 > 41.cfg
> 
> 
> This works as designed
> 
> I have a Juniper SRX-210 firewall that I want to backup.
> 
> I am using this command to backup the config:
> 
> /usr/libexec/rancid/clogin -c 'set cli screen-length 0;show configuration'
> x.x.x.200 > 200.cfg
> 
> 
> I think that the problem is that the prompt is not recognized and the
> commands are not executed after login:
> 
> [rancid at tools rancid]$ /usr/libexec/rancid/clogin -c 'set cli screen-length
> 0;show configuration' x.x.x.200
> x.x.x.200
> spawn ssh -c 3des -x -l root x.x.x.200
> 
> 
> 
> This system is for the use of authorized users only.
> Individuals using this computer system without
> authority, or in excess of their authority, are subject
> to having all of their activities on this system
> monitored and recorded by system personnel.  In the
> course of monitoring individuals improperly using this
> system, or in the course of system maintenance, the
> activities of authorized users may also be monitored.
> Anyone using this system expressly consents to such
> monitoring and is advised that if such monitoring
> reveals possible evidence of criminal activity, system
> personnel may provide the evidence of such monitoring
> to law enforcement officials.
> 
> 
> Password:
> --- JUNOS 12.1X46-D50.4 built 2016-04-17 11:15:31 UTC
> root at SRX210%
> 
> Error: TIMEOUT reached
> 
> 
> 
> The rancid logs for the firewall are empty
> 
> Does anyone have any words of wisdom to resolve?

dont use the root user for one.  two, if its junos, configure it as a
juniper, then the command will be jlogin.  also see plogin.


From heas at shrubbery.net  Tue Dec 20 14:48:57 2016
From: heas at shrubbery.net (heasley)
Date: Tue, 20 Dec 2016 14:48:57 +0000
Subject: [rancid] Rancid and Cisco Small Business SG500
In-Reply-To: <20161220144220.F131F273EE@sea.shrubbery.net>
 <d14b29e0306e3223dcfbb135130b0f35@ale.cx>
Message-ID: <20161220144857.GB18847@shrubbery.net>

Tue, Dec 20, 2016 at 11:57:48AM +0000, Alex DEKKER:
> On 2016-12-19 18:04, heasley wrote:
> > Wed, Apr 13, 2016 at 09:44:49AM +0000, Richard Savage:
> 
> >> + ! 1     06,13:16:41
> >> + ! 2     06,13:16:45
> >> + ! 3     06,13:16:41
> >>   !
> >>   !       Unit             SW version         Boot version         HW 
> >> version
> >>   !------------------- ------------------- ------------------- 
> >> -------------------
> >> 
> >> Is there a way that rancid can ignore this so that we don't get a diff 
> >> everytime rancid is run?
> > 
> > I've imported a version of cisco-sb for rancid 4.0, but need a little 
> > more
> > info to address this problem.  Can you tell me from which command this
> > output comes and show me the raw output?
> 
> show system:
> 
> $ csblogin sg500x
> 
> 
> 
> User Name:cisco
> Password:***********
> 
> 
> SG500X#sho system
> System Description:                       SG500X-24P 24-Port Gigabit 
> with 4-Port 10-Gigabit PoE Stackable Managed Switch
> System Up Time (days,hour:min:sec):       486,05:08:01
> System Contact:
> System Name:                              SG500X
> System Location:                          SG500X
> System MAC Address:                       d4:d7:48:d3:8e:16
> System Object ID:                         1.3.6.1.4.1.9.6.1.85.24.2
> 
> Fans Status:                              OK
> 
> 
>            Unit            Temperature (Celsius)            Status
> ------------------------ ------------------------ 
> ------------------------
>             1                        39                       OK
> 
> 
> SG500X#quit

Thats not the output that richard is complaining about, but the temperature
(per card?) that you have supplied seems like it needs to be filtered.  Does
the following do it?

Index: lib/iossb.pm.in
===================================================================
--- lib/iossb.pm.in	(revision 3568)
+++ lib/iossb.pm.in	(working copy)
@@ -133,6 +133,17 @@
 	/system description:\s+(.*)$/i &&
 	    ProcessHistory("COMMENTS","keysort","B0","! Chassis type: $1\n") &&
 	    next;
+	# filter individual card temperature
+	if (/unit\stemperature/i) {
+	    while (<$INPUT>) {
+		tr/\015//d;
+		return(0) if (/^$prompt/);
+		next if (/^(\s*|\s*$cmd\s*)$/);
+		next if (/^\s+\^$/);
+
+		last if (/^\s*$/);
+	    }
+	}
     }
     return(0);
 }

and can you me a 'show version'?


From jason at biel-tech.com  Tue Dec 20 14:24:29 2016
From: jason at biel-tech.com (Jason Biel)
Date: Tue, 20 Dec 2016 08:24:29 -0600
Subject: [rancid] Trying to Backup Juniper SRX Firewall
In-Reply-To: <CAOYvYswsFyS51ViCYE+4fytyMXp__TW=JTO3f=qM9P3D0gfjew@mail.gmail.com>
References: <CAOYvYswsFyS51ViCYE+4fytyMXp__TW=JTO3f=qM9P3D0gfjew@mail.gmail.com>
Message-ID: <CAGpNY1EZ2W9VBLd=_fHdOqPx1iJ1HTfUoz0kV5HxRtX=YN=3dg@mail.gmail.com>

SRX runs JUNOS so you want to use jlogin vice clogin

On Tue, Dec 20, 2016 at 8:09 AM, JP <xq1xq1xq1 at gmail.com> wrote:

> I have configured RANCID to backup my Cisco switches.
>
> using these commands:
>
> /usr/libexec/rancid/clogin -c 'write term' x.x.x.45 > 45.cfg
> /usr/libexec/rancid/clogin -c 'write term' x.x.x..41 > 41.cfg
>
>
> This works as designed
>
> I have a Juniper SRX-210 firewall that I want to backup.
>
> I am using this command to backup the config:
>
> /usr/libexec/rancid/clogin -c 'set cli screen-length 0;show configuration'
> x.x.x.200 > 200.cfg
>
>
> I think that the problem is that the prompt is not recognized and the
> commands are not executed after login:
>
> [rancid at tools rancid]$ /usr/libexec/rancid/clogin -c 'set cli
> screen-length 0;show configuration' x.x.x.200
> x.x.x.200
> spawn ssh -c 3des -x -l root x.x.x.200
>
>
>
> This system is for the use of authorized users only.
> Individuals using this computer system without
> authority, or in excess of their authority, are subject
> to having all of their activities on this system
> monitored and recorded by system personnel.  In the
> course of monitoring individuals improperly using this
> system, or in the course of system maintenance, the
> activities of authorized users may also be monitored.
> Anyone using this system expressly consents to such
> monitoring and is advised that if such monitoring
> reveals possible evidence of criminal activity, system
> personnel may provide the evidence of such monitoring
> to law enforcement officials.
>
>
> Password:
> --- JUNOS 12.1X46-D50.4 built 2016-04-17 11:15:31 UTC
> root at SRX210%
>
> Error: TIMEOUT reached
>
>
>
> The rancid logs for the firewall are empty
>
> Does anyone have any words of wisdom to resolve?
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss
>



-- 
Jason
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161220/0a7cd9b0/attachment.html>

From heas at shrubbery.net  Tue Dec 20 15:05:06 2016
From: heas at shrubbery.net (heasley)
Date: Tue, 20 Dec 2016 15:05:06 +0000
Subject: [rancid] Rancid and Cisco Small Business SG500
In-Reply-To: <20161220144857.GB18847@shrubbery.net>
References: <20161220144220.F131F273EE@sea.shrubbery.net>
 <d14b29e0306e3223dcfbb135130b0f35@ale.cx>
 <20161220144857.GB18847@shrubbery.net>
Message-ID: <20161220150506.GC18847@shrubbery.net>

Tue, Dec 20, 2016 at 02:48:57PM +0000, heasley:
> Thats not the output that richard is complaining about, but the temperature
> (per card?) that you have supplied seems like it needs to be filtered.  Does
> the following do it?

blech; that patch shouldnt be necessary.


From ler762 at gmail.com  Tue Dec 20 15:58:59 2016
From: ler762 at gmail.com (Lee)
Date: Tue, 20 Dec 2016 10:58:59 -0500
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <4F4DB345-A55B-48D9-A9A4-C0EC4B6556F5@shrubbery.net>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
 <CAD8GWssVKCUtKSGBCJYh=Q_HuapnGW6dA-LsVBeY9gnwEwR-GQ@mail.gmail.com>
 <4F4DB345-A55B-48D9-A9A4-C0EC4B6556F5@shrubbery.net>
Message-ID: <CAD8GWsvHx97exBLX-e2VNMUY5e=GFRFUsPFm17x2iGtseu2KDg@mail.gmail.com>

On 12/19/16, John Heasley <heas at shrubbery.net> wrote:
> Am 19.12.2016 um 14:09 schrieb Lee <ler762 at gmail.com>:
>>
>>> On 12/19/16, heasley <heas at shrubbery.net> wrote:
>>> Mon, Dec 19, 2016 at 10:42:28AM -0600, JP:
>>>> Setting up RANCID on CENTOS6
>>>>
>>>> in .cloginrc I put this line:
>>>>
>>>> add password x.x.x.45 {xxxxxx!} {xxxxxx!}
>>>>
>>>> When I try and test my password configuration it fails:
>>>>
>>  <.. snip ..>
>>>>
>>>> My password works fine when I enter it manually.
>>>>
>>>> My password contains a " ! " character - could this be causing the
>>>> problem?
>>>
>>> add password glob {foo\!bar}
>>
>> Just out of curiosity - why would you need to escape the ! when it's
>> inside {}s?
>>
>> I've got a ! in one of my passwords and
>> add password devname {pass!word}
>> works fine for ssh (I don't use telnet any more).
>
> Maybe the escaping isnt necessary for !, but it shouldnt hurt. I think i put
> a list in the manpage.

man cloginrc only mentions space & left/right squiggly brackets

Lee


From heas at shrubbery.net  Tue Dec 20 16:31:31 2016
From: heas at shrubbery.net (John Heasley)
Date: Tue, 20 Dec 2016 16:31:31 +0000
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <CAD8GWsvHx97exBLX-e2VNMUY5e=GFRFUsPFm17x2iGtseu2KDg@mail.gmail.com>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
 <CAD8GWssVKCUtKSGBCJYh=Q_HuapnGW6dA-LsVBeY9gnwEwR-GQ@mail.gmail.com>
 <4F4DB345-A55B-48D9-A9A4-C0EC4B6556F5@shrubbery.net>
 <CAD8GWsvHx97exBLX-e2VNMUY5e=GFRFUsPFm17x2iGtseu2KDg@mail.gmail.com>
Message-ID: <20161220163131.GE18847@shrubbery.net>

Tue, Dec 20, 2016 at 10:58:59AM -0500, Lee:
> > Maybe the escaping isnt necessary for !, but it shouldnt hurt. I think i put
> > a list in the manpage.
> 
> man cloginrc only mentions space & left/right squiggly brackets

it says "or special character" :)  the interpretter reads the file as if it
were a script and *login use the value in send and join.


From ler762 at gmail.com  Tue Dec 20 17:14:16 2016
From: ler762 at gmail.com (Lee)
Date: Tue, 20 Dec 2016 12:14:16 -0500
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <20161220163131.GE18847@shrubbery.net>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
 <CAD8GWssVKCUtKSGBCJYh=Q_HuapnGW6dA-LsVBeY9gnwEwR-GQ@mail.gmail.com>
 <4F4DB345-A55B-48D9-A9A4-C0EC4B6556F5@shrubbery.net>
 <CAD8GWsvHx97exBLX-e2VNMUY5e=GFRFUsPFm17x2iGtseu2KDg@mail.gmail.com>
 <20161220163131.GE18847@shrubbery.net>
Message-ID: <CAD8GWssHOBG3HJh9FE36bSQ==04iAP1r-FmAzn8Wru0r09oppA@mail.gmail.com>

On 12/20/16, John Heasley <heas at shrubbery.net> wrote:
> Tue, Dec 20, 2016 at 10:58:59AM -0500, Lee:
>> > Maybe the escaping isnt necessary for !, but it shouldnt hurt. I think i
>> > put
>> > a list in the manpage.
>>
>> man cloginrc only mentions space & left/right squiggly brackets
>
> it says "or special character" :)  the interpretter reads the file as if it
> were a script and *login use the value in send and join.

Are you going from memory or an actual man page?  man cloginrc for
rancid 3.6.1 has
  ... always enclose the values in braces.  If a value includes a
(left or right) brace or space character, it must be backslash-escaped
...
which, at least to me, implies the only thing one has to worry about
if the value is inside {} are those three characters.

In any case, on a related note - how hard would it be to have
something like the clogin -x option that treats the input file as
straight text with no meta-chars?   Using rancid for things like
setting the banner, snmp community string, etc. is a pain.  I'd much
prefer not having to figure out what all had to be escaped.

Thanks,
Lee


From ler762 at gmail.com  Tue Dec 20 16:03:12 2016
From: ler762 at gmail.com (Lee)
Date: Tue, 20 Dec 2016 11:03:12 -0500
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <CAOYvYswRUkLFjm9eTu+8zkCTK1JbiTpKC97EPuK-Dnn4nqnJ6Q@mail.gmail.com>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
 <CAOYvYswRUkLFjm9eTu+8zkCTK1JbiTpKC97EPuK-Dnn4nqnJ6Q@mail.gmail.com>
Message-ID: <CAD8GWstqAL+-HviQ0aOSMRUHT0jwOJk-tB_nG3ThaKJSPgMEBw@mail.gmail.com>

On 12/19/16, JP <xq1xq1xq1 at gmail.com> wrote:
> Found the issue
>
> Default configuration in the sample cloginrc file was overriding my value

Thanks for coming back with the answer.  I thought it was a bit weird
that it works for me & not you..

Lee


From Brad.Shifflett at micromenders.com  Tue Dec 20 18:20:00 2016
From: Brad.Shifflett at micromenders.com (Brad Shifflett)
Date: Tue, 20 Dec 2016 18:20:00 +0000
Subject: [rancid] Hillstone firewalls support
Message-ID: <B9F20958E6FB394F9DC7B81C9B607E64EDC1FA9C@MM-EXMB1.micromenders.com>

Anyone know if you can add hillstone firewalls to rancid? If so, how would this be set?


Brad Shifflett
---------------------------------------------------------------------------------------
 This email has been scanned for email related threats and delivered safely by Mimecast.
 For more information please visit http://www.mimecast.com
---------------------------------------------------------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161220/2f577d85/attachment.html>

From xq1xq1xq1 at gmail.com  Tue Dec 20 16:27:43 2016
From: xq1xq1xq1 at gmail.com (JP)
Date: Tue, 20 Dec 2016 10:27:43 -0600
Subject: [rancid] Trying to Backup Juniper SRX Firewall
In-Reply-To: <20161220142745.GA18847@shrubbery.net>
References: <CAOYvYswsFyS51ViCYE+4fytyMXp__TW=JTO3f=qM9P3D0gfjew@mail.gmail.com>
 <20161220142745.GA18847@shrubbery.net>
Message-ID: <CAOYvYsws4YLiDBvPeee69j0BJ661d9K8ZFkDPRUAz8DLN+LmeA@mail.gmail.com>

Thanx for the guidance

I created a new group and user:

Set system login class NOC permissions view
Set system login class NOC permissions view-configuration
Set system login user rancid uid 2002
Set system login user rancid class NOC


I then changed the password for this new user:

edit groups global system login user rancid
set authentication plain-text-password


I then applied the new group:

set apply-groups global

Now it works as designed

Thanx everyone!

On Tue, Dec 20, 2016 at 8:27 AM, heasley <heas at shrubbery.net> wrote:

> Tue, Dec 20, 2016 at 08:09:02AM -0600, JP:
> > I have configured RANCID to backup my Cisco switches.
> >
> > using these commands:
> >
> > /usr/libexec/rancid/clogin -c 'write term' x.x.x.45 > 45.cfg
> > /usr/libexec/rancid/clogin -c 'write term' x.x.x..41 > 41.cfg
> >
> >
> > This works as designed
> >
> > I have a Juniper SRX-210 firewall that I want to backup.
> >
> > I am using this command to backup the config:
> >
> > /usr/libexec/rancid/clogin -c 'set cli screen-length 0;show
> configuration'
> > x.x.x.200 > 200.cfg
> >
> >
> > I think that the problem is that the prompt is not recognized and the
> > commands are not executed after login:
> >
> > [rancid at tools rancid]$ /usr/libexec/rancid/clogin -c 'set cli
> screen-length
> > 0;show configuration' x.x.x.200
> > x.x.x.200
> > spawn ssh -c 3des -x -l root x.x.x.200
> >
> >
> >
> > This system is for the use of authorized users only.
> > Individuals using this computer system without
> > authority, or in excess of their authority, are subject
> > to having all of their activities on this system
> > monitored and recorded by system personnel.  In the
> > course of monitoring individuals improperly using this
> > system, or in the course of system maintenance, the
> > activities of authorized users may also be monitored.
> > Anyone using this system expressly consents to such
> > monitoring and is advised that if such monitoring
> > reveals possible evidence of criminal activity, system
> > personnel may provide the evidence of such monitoring
> > to law enforcement officials.
> >
> >
> > Password:
> > --- JUNOS 12.1X46-D50.4 built 2016-04-17 11:15:31 UTC
> > root at SRX210%
> >
> > Error: TIMEOUT reached
> >
> >
> >
> > The rancid logs for the firewall are empty
> >
> > Does anyone have any words of wisdom to resolve?
>
> dont use the root user for one.  two, if its junos, configure it as a
> juniper, then the command will be jlogin.  also see plogin.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161220/bfd2e81d/attachment.html>

From heas at shrubbery.net  Wed Dec 21 04:37:06 2016
From: heas at shrubbery.net (heasley)
Date: Wed, 21 Dec 2016 04:37:06 +0000
Subject: [rancid] Hillstone firewalls support
In-Reply-To: <B9F20958E6FB394F9DC7B81C9B607E64EDC1FA9C@MM-EXMB1.micromenders.com>
References: <B9F20958E6FB394F9DC7B81C9B607E64EDC1FA9C@MM-EXMB1.micromenders.com>
Message-ID: <20161221043706.GF27612@shrubbery.net>

Tue, Dec 20, 2016 at 06:20:00PM +0000, Brad Shifflett:
> Anyone know if you can add hillstone firewalls to rancid? If so, how would this be set?
> 

they are not supported, but see Q2 of section 4 of the rancid FAQ.


From heas at shrubbery.net  Wed Dec 21 04:49:03 2016
From: heas at shrubbery.net (heasley)
Date: Wed, 21 Dec 2016 04:49:03 +0000
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <CAD8GWstqAL+-HviQ0aOSMRUHT0jwOJk-tB_nG3ThaKJSPgMEBw@mail.gmail.com>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
 <CAOYvYswRUkLFjm9eTu+8zkCTK1JbiTpKC97EPuK-Dnn4nqnJ6Q@mail.gmail.com>
 <CAD8GWstqAL+-HviQ0aOSMRUHT0jwOJk-tB_nG3ThaKJSPgMEBw@mail.gmail.com>
Message-ID: <20161221044903.GH27612@shrubbery.net>

Tue, Dec 20, 2016 at 11:03:12AM -0500, Lee:
> On 12/19/16, JP <xq1xq1xq1 at gmail.com> wrote:
> > Found the issue
> >
> > Default configuration in the sample cloginrc file was overriding my value

clogin -[mM] devicename

is rather useful for finding such things.

> Thanks for coming back with the answer.  I thought it was a bit weird
> that it works for me & not you..
> 
> Lee
> 
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From heas at shrubbery.net  Wed Dec 21 05:08:58 2016
From: heas at shrubbery.net (John Heasley)
Date: Wed, 21 Dec 2016 05:08:58 +0000
Subject: [rancid] RANCID - Password Error using Telnet on Cisco Switch
In-Reply-To: <CAD8GWssHOBG3HJh9FE36bSQ==04iAP1r-FmAzn8Wru0r09oppA@mail.gmail.com>
References: <CAOYvYswSSwH2HjD3wzuBbP9A_OP=MPX72JXuyVK5UE0W5YkkUg@mail.gmail.com>
 <20161219184305.GJ90301@shrubbery.net>
 <CAD8GWssVKCUtKSGBCJYh=Q_HuapnGW6dA-LsVBeY9gnwEwR-GQ@mail.gmail.com>
 <4F4DB345-A55B-48D9-A9A4-C0EC4B6556F5@shrubbery.net>
 <CAD8GWsvHx97exBLX-e2VNMUY5e=GFRFUsPFm17x2iGtseu2KDg@mail.gmail.com>
 <20161220163131.GE18847@shrubbery.net>
 <CAD8GWssHOBG3HJh9FE36bSQ==04iAP1r-FmAzn8Wru0r09oppA@mail.gmail.com>
Message-ID: <20161221050858.GI27612@shrubbery.net>

Tue, Dec 20, 2016 at 12:14:16PM -0500, Lee:
> In any case, on a related note - how hard would it be to have
> something like the clogin -x option that treats the input file as
> straight text with no meta-chars?   Using rancid for things like
> setting the banner, snmp community string, etc. is a pain.  I'd much
> prefer not having to figure out what all had to be escaped.

another user asked about this; there was a catch with doing this that I
am now struggling to remember and when that user did not reply I dropped
it.  ISTR it was just not wanting to alter -x, rather use a different
option.  grumble; I'll have to look at it again.


From mischa.diehm at unibas.ch  Wed Dec 21 17:50:11 2016
From: mischa.diehm at unibas.ch (Mischa Diehm)
Date: Wed, 21 Dec 2016 17:50:11 +0000
Subject: [rancid] rancid extension to pass commit message
Message-ID: <D4807F5E.A7F98%mischa.diehm@unibas.ch>

Hi,

First of all thanks for this great and useful software. We use it
extensively and are very happy with it!

History for the diff: Since some time we use elasticsearch and logstash for
our central NOC log management system. To detect changes on our devices
(firewalls, routers, switches ?) we check for specific log lines and trigger
a rancid-run from there. Usually we see in the logline who has made the
change. To have this visible in our commit message and our mails received
from rancid I have extended rancid-run and control_rancid to be able to pass
a commit message like:

# rancid-run  -c "$msg?
(diff attached)

What do you think is this sth. useful and worth adding?

Cheers Mischa


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161221/0f3dab01/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: control_rancid-3.6.1.diff
Type: application/octet-stream
Size: 2132 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161221/0f3dab01/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rancid-run-3.6.1.diff
Type: application/octet-stream
Size: 739 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161221/0f3dab01/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2202 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161221/0f3dab01/attachment.bin>

From heas at shrubbery.net  Thu Dec 22 18:23:53 2016
From: heas at shrubbery.net (heasley)
Date: Thu, 22 Dec 2016 18:23:53 +0000
Subject: [rancid] rancid extension to pass commit message
In-Reply-To: <D4807F5E.A7F98%mischa.diehm@unibas.ch>
References: <D4807F5E.A7F98%mischa.diehm@unibas.ch>
Message-ID: <20161222182353.GC90071@shrubbery.net>

Wed, Dec 21, 2016 at 05:50:11PM +0000, Mischa Diehm:
> Hi,
> 
> First of all thanks for this great and useful software. We use it
> extensively and are very happy with it!
> 
> History for the diff: Since some time we use elasticsearch and logstash for
> our central NOC log management system. To detect changes on our devices
> (firewalls, routers, switches ?) we check for specific log lines and trigger
> a rancid-run from there. Usually we see in the logline who has made the
> change. To have this visible in our commit message and our mails received
> from rancid I have extended rancid-run and control_rancid to be able to pass
> a commit message like:
> 
> # rancid-run  -c "$msg?
> (diff attached)
> 
> What do you think is this sth. useful and worth adding?

Yes, the idea seems fine to me.  I'll add it for rancid 4.0.


From nicotine at warningg.com  Thu Dec 22 21:49:22 2016
From: nicotine at warningg.com (Brandon Ewing)
Date: Thu, 22 Dec 2016 15:49:22 -0600
Subject: [rancid] rancid extension to pass commit message
In-Reply-To: <20161222182353.GC90071@shrubbery.net>
References: <D4807F5E.A7F98%mischa.diehm@unibas.ch>
 <20161222182353.GC90071@shrubbery.net>
Message-ID: <20161222214922.GA12582@radiological.warningg.com>

On Thu, Dec 22, 2016 at 06:23:53PM +0000, heasley wrote:
> 
> Yes, the idea seems fine to me.  I'll add it for rancid 4.0.
> 

An option to set the author would make git blame more fun

-- 
Brandon Ewing                                     (nicotine at warningg.com)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161222/df59f5a0/attachment.sig>

From heas at shrubbery.net  Fri Dec 23 02:59:42 2016
From: heas at shrubbery.net (heasley)
Date: Fri, 23 Dec 2016 02:59:42 +0000
Subject: [rancid] rancid extension to pass commit message
In-Reply-To: <20161222214922.GA12582@radiological.warningg.com>
References: <D4807F5E.A7F98%mischa.diehm@unibas.ch>
 <20161222182353.GC90071@shrubbery.net>
 <20161222214922.GA12582@radiological.warningg.com>
Message-ID: <20161223025942.GA14941@shrubbery.net>

Thu, Dec 22, 2016 at 03:49:22PM -0600, Brandon Ewing:
> On Thu, Dec 22, 2016 at 06:23:53PM +0000, heasley wrote:
> > 
> > Yes, the idea seems fine to me.  I'll add it for rancid 4.0.
> > 
> 
> An option to set the author would make git blame more fun

the author, of the commit, should be the rancid user :)  and, rancid-cvs
sets:

            git config user.name RANCiD
            git config user.email $USER$MAILDOMAIN


From mischa.diehm at unibas.ch  Fri Dec 23 09:29:52 2016
From: mischa.diehm at unibas.ch (Mischa Diehm)
Date: Fri, 23 Dec 2016 09:29:52 +0000
Subject: [rancid] rancid extension to pass commit message
In-Reply-To: <20161223025942.GA14941@shrubbery.net>
References: <D4807F5E.A7F98%mischa.diehm@unibas.ch>
 <20161222182353.GC90071@shrubbery.net>
 <20161222214922.GA12582@radiological.warningg.com>
 <20161223025942.GA14941@shrubbery.net>
Message-ID: <D482AC7A.7DB6E%mischa.diehm@unibas.ch>

Thu, Dec 22, 2016 at 03:49:22PM -0600, Brandon Ewing:
On Thu, Dec 22, 2016 at 06:23:53PM +0000, heasley wrote:
>
> Yes, the idea seems fine to me.  I'll add it for rancid 4.0.
>
An option to set the author would make git blame more fun

the author, of the commit, should be the rancid user :)  and, rancid-cvs
sets:

            git config user.name RANCiD
            git config user.email $USER$MAILDOMAIN

yes I was thinking about this too but in our case we detect change by users not being valid svn/git users. So we just write the username inside the commit message and leave the repository to a single user: rancid.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161223/1f1d362d/attachment.html>

From nicotine at warningg.com  Fri Dec 23 21:39:35 2016
From: nicotine at warningg.com (Brandon Ewing)
Date: Fri, 23 Dec 2016 15:39:35 -0600
Subject: [rancid] snmp-server host on nx-os
Message-ID: <20161223213935.GB12582@radiological.warningg.com>

Looks like the snmp-server host stuff got missed when nxos.pm got created.
One can still set an SNMP string in a snmp-server host <ip> trap statement,
so we should probably match and filter if filterstr is set.  

Patch (cut 'n pasted from ios.pm) attached.

-- 
Brandon Ewing                                     (nicotine at warningg.com)
-------------- next part --------------
--- lib/nxos.pm.in.orig	2016-12-23 15:14:26.035813372 -0600
+++ lib/nxos.pm.in	2016-12-23 15:16:06.626807943 -0600
@@ -847,6 +847,34 @@
 		}
 	    }
 	}
+    if (/^snmp-server host (\d+\.\d+\.\d+\.\d+) /) {
+	    if ($filter_commstr) {
+		my($ip) = $1;
+		my($line) = "snmp-server host $ip";
+		my(@tokens) = split(' ', $');
+		my($token);
+		while ($token = shift(@tokens)) {
+		    if ($token eq 'version') {
+			$line .= " " . join(' ', ($token, shift(@tokens)));
+			if ($token eq '3') {
+			    $line .= " " . join(' ', ($token, shift(@tokens)));
+			}
+		    } elsif ($token eq 'vrf') {
+			$line .= " " . join(' ', ($token, shift(@tokens)));
+		    } elsif ($token =~ /^(informs?|traps?|(no)?auth)$/) {
+			$line .= " " . $token;
+		    } else {
+			$line = "!$line " . join(' ', ("<removed>",
+						 join(' ', at tokens)));
+			last;
+		    }
+		}
+		ProcessHistory("SNMPSERVERHOST","ipsort","$ip","$line\n");
+	    } else {
+		ProcessHistory("SNMPSERVERHOST","ipsort","$1","$_");
+	    }
+	    next;
+    }
 
 	# Why was this commented out? It shows up in the raw text...
 	if (/^(snmp-server community) (\S+)/) {
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161223/69e5e8a4/attachment.sig>

From weylin at bu.edu  Thu Dec 29 03:08:32 2016
From: weylin at bu.edu (Piegorsch, Weylin William)
Date: Thu, 29 Dec 2016 03:08:32 +0000
Subject: [rancid] Nexus 9k Login Crypto
Message-ID: <0A59B51D-EDC0-4395-816A-B8B803E3A948@bu.edu>

Regarding type ?cisco-nx?, is there a need to take into account the Nexus 9000 crypto support?

See here:
http://www.cisco.com/c/en/us/support/docs/switches/nexus-9000-series-switches/200663-Unable-to-SSH-into-Nexus-9K-fatal.html

I found that my default setting yielded:

[rancid at localhost ~]$ clogin Nexus-9k
Nexus-9k
spawn telnet Nexus-9k
Trying 10.123.12.241...
telnet: connect to address 10.123.12.241: Connection refused
spawn ssh -c 3des -x -l rancid Nexus-9k
no matching cipher found: client 3des-cbc server aes128-ctr,aes192-ctr,aes256-ctr

Error: Couldn't login: Nexus-9k
[rancid at localhost ~]$

However, if I added the line to my .cloginrc:
add cyphertype Nexus-9k {aes128-ctr,aes192-ctr,aes256-ctr}

Then everything worked fine (I?ll spare everyone the output).

I?m not clear this is a rancid issue, or a local system issue.  Is it something at least worth noting?

weylin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161229/f0a4bad9/attachment.html>

From heas at shrubbery.net  Thu Dec 29 17:53:31 2016
From: heas at shrubbery.net (heasley)
Date: Thu, 29 Dec 2016 17:53:31 +0000
Subject: [rancid] Nexus 9k Login Crypto
In-Reply-To: <0A59B51D-EDC0-4395-816A-B8B803E3A948@bu.edu>
References: <0A59B51D-EDC0-4395-816A-B8B803E3A948@bu.edu>
Message-ID: <20161229175331.GL79453@shrubbery.net>

Thu, Dec 29, 2016 at 03:08:32AM +0000, Piegorsch, Weylin William:
> Regarding type ?cisco-nx?, is there a need to take into account the Nexus 9000 crypto support?
> 
> See here:
> http://www.cisco.com/c/en/us/support/docs/switches/nexus-9000-series-switches/200663-Unable-to-SSH-into-Nexus-9K-fatal.html
> 
> I found that my default setting yielded:
> 
> [rancid at localhost ~]$ clogin Nexus-9k
> Nexus-9k
> spawn telnet Nexus-9k
> Trying 10.123.12.241...
> telnet: connect to address 10.123.12.241: Connection refused
> spawn ssh -c 3des -x -l rancid Nexus-9k
> no matching cipher found: client 3des-cbc server aes128-ctr,aes192-ctr,aes256-ctr
> 
> Error: Couldn't login: Nexus-9k
> [rancid at localhost ~]$
> 
> However, if I added the line to my .cloginrc:
> add cyphertype Nexus-9k {aes128-ctr,aes192-ctr,aes256-ctr}

thats fine.

> Then everything worked fine (I?ll spare everyone the output).
> 
> I?m not clear this is a rancid issue, or a local system issue.  Is it something at least worth noting?

previous versions of rancid forced 3des, apparently including your version.
just use the cyphertype or upgrade, and you may still need to specify
cyphertype for the device.  also see the FAQ.


From weylin at bu.edu  Thu Dec 29 03:25:49 2016
From: weylin at bu.edu (Piegorsch, Weylin William)
Date: Thu, 29 Dec 2016 03:25:49 +0000
Subject: [rancid] cisco-nx and debug: filesystem
Message-ID: <4A6FC2FE-C069-48B6-B258-A2194F5F441F@bu.edu>

Hello,

I?ll put the details below, but basically: for the Nexus 9k, the debug: filesystem is constantly filling with information, and there?s no way to turn it off.  I can manually alter my cisco-nx output (or create a special-purpose 9k variant) to remove the ?dir debug:? and do something about ?dir logflash:? output, but I?d prefer to avoid that if I can.  What other options do I have, except ?live with it??

weylin

I noticed every time rancid grabbed an archive of my Nexus 9k (specifically a 9372PX-E in NX-OS mode), I would get output similar to:

Index: configs/Nexus-9k
===================================================================
retrieving revision 1.6
diff -U 4 -r1.6 Nexus-9k
@@ -140,26 +140,26 @@
  !Flash: bootflash:  1736 MB used
  !Flash: bootflash: 47763 MB free
  !Flash: bootflash: 49500 MB total
  !
- !Flash: debug:       32782    Dec 27 14:29:15 2016  bootvar_debug.log
- !Flash: debug:           5    Dec 27 14:29:15 2016  bootvar_debug.meta
+ !Flash: debug:       32971    Dec 28 02:29:12 2016  bootvar_debug.log
+ !Flash: debug:           5    Dec 28 02:29:12 2016  bootvar_debug.meta
  !Flash: debug: Usage for debug://sup-local
  !Flash: debug:       0 MB used
  !Flash: debug:     4 MB free
  !Flash: debug:     5 MB total
  !
  !Flash: logflash:        4096    Aug 20 00:52:52 2016  ISSU_debug_logs/
  !Flash: logflash:        4096    May 15 16:59:01 2016  core/
  !Flash: logflash:        4096    Feb 20 15:08:00 2016  debug/
- !Flash: logflash:     2449408    Dec 28 02:01:06 2016  debug_logs/
+ !Flash: logflash:     2449408    Dec 28 13:06:36 2016  debug_logs/
  !Flash: logflash:        4096    Feb 20 15:08:00 2016  generic/
  !Flash: logflash:        4096                          log/
  !Flash: logflash:       16384    Feb 20 15:07:57 2016  lost+found/
  !Flash: logflash:        4096    Aug 29 23:21:18 2016  vdc_1/
  !Flash: logflash: Usage for logflash://sup-local
- !Flash: logflash:   660 MB used
- !Flash: logflash:  7403 MB free
+ !Flash: logflash:   665 MB used
+ !Flash: logflash:  7398 MB free
  !Flash: logflash:  8063 MB total
  !
  !Flash: volatile:          40    Aug 20 02:07:39 2016  virtual-instance/
  !Flash: volatile: Usage for volatile://sup-local

I opened a TAC case about, I?m copying the email thread here (with modifications to email to protect spam harvesters).

From: "William Chong (wilchong)" <wilchong at cisco dot com>
Date: Wednesday, December 28, 2016 at 01:50
To: Weylin Piegorsch < weylin at bu dot edu >
Cc: "attach at cisco.com" <attach at cisco.com>
Subject: RE: SR 681520039 : Increasing Log Size

Hi Weylin,

This isn?t documented externally, however, these communications can be treated as official documentation if required.

Let me know if you have any further questions.

Thanks!
William

William Chong
Customer Support Engineer
Asia Pacific TAC - Sydney

Cisco Systems
Direct: +61 2 8446 7739
Aust: +61 2 1800 805 227
USA: +1 800 553 2447

Shift Schedule:
Mon ? Fri 1200-1800 AEDT (+11GMT/UTC)

Email: wilchong at cisco dot com

Global TAC Contacts:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html

From: Piegorsch, Weylin William [mailto: weylin at bu dot edu]
Sent: Wednesday, 28 December 2016 5:29 PM
To: William Chong (wilchong) < wilchong at cisco dot com >
Cc: attach at cisco.com
Subject: Re: SR 681520039 : Increasing Log Size

Thanks William.  Is this documented anywhere?
weylin

From: "William Chong (wilchong)" < wilchong at cisco dot com >
Date: Tuesday, December 27, 2016 at 00:46
To: Weylin Piegorsch <weylin at bu dot edu>
Cc: "attach at cisco.com<mailto:attach at cisco.com>" <attach at cisco.com<mailto:attach at cisco.com>>
Subject: SR 681520039 : Increasing Log Size

Hi Weylin,

This is William Chong from Cisco TAC ? LAN Switching Team and I have ownership of this case. It is my understanding that you are seeing an increase in file size of the debug logs on your Nexus 9k.


Answers to your questions below:

If this is expected behaviour:
The switch will update the bootvar_debug.log file as part of its normal operation. This data is intended for Cisco engineering and TAC.

What I would need to do to disable it
Preventing these logs from updating is not an option as it is part of the switch?s normal operation.

If I need to be worried about exhausting storage capacity.
The debug directory will have a dedicated amount of flash storage for the file, as such, it will not have an impact on the other functions of the switch. You will not need to be worried about exhausting the capacity.

Please let know if you have any further questions.

Thanks!
William

William Chong
Customer Support Engineer
Asia Pacific TAC - Sydney

Cisco Systems
Direct: +61 2 8446 7739
Aust: +61 2 1800 805 227
USA: +1 800 553 2447

Shift Schedule:
Mon ? Fri 1200-1800 AEDT (+11GMT/UTC)

Email: wilchong at cisco dot com

Global TAC Contacts:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161229/0ee5b775/attachment.html>

From Sebastien.Boulianne at cpu.ca  Sat Dec 31 23:52:17 2016
From: Sebastien.Boulianne at cpu.ca (Sebastien.Boulianne at cpu.ca)
Date: Sat, 31 Dec 2016 18:52:17 -0500
Subject: [rancid] Backup Fortigate configuration including all vdoms.
Message-ID: <5FE0959288C73D448BB44CB7E9CC320F5E2F6E79D0@CPUMAIL2.cpu.qc.ca>

Hi,

Most of our routers / FW are Fortigates.
I would like take full config backup including all vdoms using Rancid.
How can I do that ?
I have 3 VDOMs on a FGT80C : Global, root, ROUTER
How can I take those 3 vdoms in backup ?

I have the global admin account for all those devices.
I have the same problem with a FGT300B.

Thanks you very much and merry Christmas + happy new year all!

S?bastien.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20161231/4020c734/attachment.html>