[rancid] Cisco 10k sflog Timestamp Cycling

[Per-Olof Olsson]

On 10/22/2013 10:18 PM, Alan McKinnon wrote:
> On 22/10/2013 17:27, Kenneth Lind wrote:
>> We recently implemented IPDR on our Cisco 10K uBRs and are now receiving
>> diffs for every rancid run about the timestamp for the sflog:
>>
>> - !Flash: 6            0 Oct 22 2013 08:46:10 -04:00 sflog
>> + !Flash: 6            0 Oct 22 2013 09:37:28 -04:00 sflog
>>
>> We are running Rancid v2.3.6 which according to the change log included the
>> fix for this issue (though in our instance it does not appear to be
>> filtered, unless there is an option somewhere that we've missed to enable
>> the filtering):
>>
>> rancid: filter sflog from DirSlotN() for IOS on cisco 10k
>>
>> I've been able to find mentions of the issue in the discuss archives, but
>> none have included a solution. Has anyone been able to hush the diffs for
>> the sflog outside of creating a new rancid type and altering the command
>> table to exclude the DirSlotN run?
> 
> I'm not familiar with the 10k but Google indicates they will run regular
> IOS. Is that correct?
> 
> The code in 2.3.6 does support what the Changelog says:
> 
> sub DirSlotN {
>     ....
>     if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
>         $_ = "$1" . sprintf("%43s", "") . "$3\n";
>     }
>     ....
> }
> 
> but that regex does not match the output you quoted. maybe that was
> written for
> 
> Personally, I would simply discard the entire line (you don't want to
> keep the timestamp and that is the very thing that is changing) so
> modify DirSlotN thusly (add it just before the code above):
> 
>     next if ($ios eq "IOS" && /^Flash:.*? sflog$);
> 
> that regex is quite simplistic, you might want to tweak it to be more
> specific.
> 
> Don't stress about maintaining your own patches to make the rancid
> scripts do what you intent - every installation I know of accumulating a
> rather large number of them :-)  It seems to be inevitable considering
> the problem we are all using rancid to solve.
> 
> 

"!Flash:" is added later and not part of output from IOS dir command!

...
ProcessHistory("FLASH","","","!Flash: $dev: $_");
...


Looks like Cisco change dir output format.
   3  -rw-       47659  Jul 10 2012 16:53:02 +02:00  file

and not include access flags for some files!
   6            0 Oct 22 2013 09:37:28 -04:00 sflog

Please verify this!
What IOS version?


I have to suggest to duplicate the 3 lines and update
regex to  /^((\s+)?\d+)\s+\d+.*(sflog$)/


...
     if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
         $_ = "$1" . sprintf("%43s", "") . "$3\n";
     }
     if ($ios eq "IOS" && /^((\s+)?\d+)\s+\d+.*(sflog$)/) {
         $_ = "$1" . sprintf("%43s", "") . "$3\n";
     }
...

Possible have to adjust space padding "%43s" to get a nice table.


or just add
  next if ($ios eq "IOS" && /^.* sflog$);
to remove sflog lines until there is a preferable way to match this line.



/Peo
----------------------------------------------------------
Per-Olof Olsson               Email: peo at chalmers.se
Chalmers tekniska högskola    IT-service
Hörsalsvägen 5                412 96 Göteborg
Tel: 031/772 6738  Fax: 031/772 8660
----------------------------------------------------------