[rancid] Cisco 10k sflog Timestamp Cycling

[Alan McKinnon]

On 22/10/2013 17:27, Kenneth Lind wrote:
> We recently implemented IPDR on our Cisco 10K uBRs and are now receiving
> diffs for every rancid run about the timestamp for the sflog:
> 
> - !Flash: 6            0 Oct 22 2013 08:46:10 -04:00 sflog
> + !Flash: 6            0 Oct 22 2013 09:37:28 -04:00 sflog
> 
> We are running Rancid v2.3.6 which according to the change log included the
> fix for this issue (though in our instance it does not appear to be
> filtered, unless there is an option somewhere that we've missed to enable
> the filtering):
> 
> rancid: filter sflog from DirSlotN() for IOS on cisco 10k
> 
> I've been able to find mentions of the issue in the discuss archives, but
> none have included a solution. Has anyone been able to hush the diffs for
> the sflog outside of creating a new rancid type and altering the command
> table to exclude the DirSlotN run?

I'm not familiar with the 10k but Google indicates they will run regular
IOS. Is that correct?

The code in 2.3.6 does support what the Changelog says:

sub DirSlotN {
    ....
    if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
        $_ = "$1" . sprintf("%43s", "") . "$3\n";
    }
    ....
}

but that regex does not match the output you quoted. maybe that was
written for

Personally, I would simply discard the entire line (you don't want to
keep the timestamp and that is the very thing that is changing) so
modify DirSlotN thusly (add it just before the code above):

    next if ($ios eq "IOS" && /^Flash:.*? sflog$);

that regex is quite simplistic, you might want to tweak it to be more
specific.

Don't stress about maintaining your own patches to make the rancid
scripts do what you intent - every installation I know of accumulating a
rather large number of them :-)  It seems to be inevitable considering
the problem we are all using rancid to solve.


-- 
Alan McKinnon
alan.mckinnon at gmail.com