[rancid] Cisco 10k sflog Timestamp Cycling

[Alan McKinnon]

On 23/10/2013 08:07, Per-Olof Olsson wrote:
> On 10/22/2013 10:18 PM, Alan McKinnon wrote:
>> On 22/10/2013 17:27, Kenneth Lind wrote:
>>> We recently implemented IPDR on our Cisco 10K uBRs and are now receiving
>>> diffs for every rancid run about the timestamp for the sflog:
>>>
>>> - !Flash: 6            0 Oct 22 2013 08:46:10 -04:00 sflog
>>> + !Flash: 6            0 Oct 22 2013 09:37:28 -04:00 sflog
>>>
>>> We are running Rancid v2.3.6 which according to the change log included the
>>> fix for this issue (though in our instance it does not appear to be
>>> filtered, unless there is an option somewhere that we've missed to enable
>>> the filtering):
>>>
>>> rancid: filter sflog from DirSlotN() for IOS on cisco 10k
>>>
>>> I've been able to find mentions of the issue in the discuss archives, but
>>> none have included a solution. Has anyone been able to hush the diffs for
>>> the sflog outside of creating a new rancid type and altering the command
>>> table to exclude the DirSlotN run?
>>
>> I'm not familiar with the 10k but Google indicates they will run regular
>> IOS. Is that correct?
>>
>> The code in 2.3.6 does support what the Changelog says:
>>
>> sub DirSlotN {
>>     ....
>>     if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
>>         $_ = "$1" . sprintf("%43s", "") . "$3\n";
>>     }
>>     ....
>> }
>>
>> but that regex does not match the output you quoted. maybe that was
>> written for
>>
>> Personally, I would simply discard the entire line (you don't want to
>> keep the timestamp and that is the very thing that is changing) so
>> modify DirSlotN thusly (add it just before the code above):
>>
>>     next if ($ios eq "IOS" && /^Flash:.*? sflog$);
>>
>> that regex is quite simplistic, you might want to tweak it to be more
>> specific.
>>
>> Don't stress about maintaining your own patches to make the rancid
>> scripts do what you intent - every installation I know of accumulating a
>> rather large number of them :-)  It seems to be inevitable considering
>> the problem we are all using rancid to solve.
>>
>>
> 
> "!Flash:" is added later and not part of output from IOS dir command!
> 
> ...
> ProcessHistory("FLASH","","","!Flash: $dev: $_");
> ...
> 
> 
> Looks like Cisco change dir output format.
>    3  -rw-       47659  Jul 10 2012 16:53:02 +02:00  file
> 
> and not include access flags for some files!
>    6            0 Oct 22 2013 09:37:28 -04:00 sflog
> 
> Please verify this!
> What IOS version?
> 
> 
> I have to suggest to duplicate the 3 lines and update
> regex to  /^((\s+)?\d+)\s+\d+.*(sflog$)/
> 
> 
> ...
>      if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
>          $_ = "$1" . sprintf("%43s", "") . "$3\n";
>      }
>      if ($ios eq "IOS" && /^((\s+)?\d+)\s+\d+.*(sflog$)/) {
>          $_ = "$1" . sprintf("%43s", "") . "$3\n";
>      }
> ...
> 
> Possible have to adjust space padding "%43s" to get a nice table.
> 
> 
> or just add
>   next if ($ios eq "IOS" && /^.* sflog$);
> to remove sflog lines until there is a preferable way to match this line.


Thanks for spotting that. I noticed how "!Flash" is handled when reading
the code but then added it to the regex when typing it. Good catch.

My feeling on these rapidly changing file listings is that they aren't
worth keeping in the rancid output at all. They are expected to change
frequently so the entire timestamp is worthless from a rancid POV,
leaving only the filename. Is it worth recording merely that the file
does exist, when we already know that it almost certainly will?



-- 
Alan McKinnon
alan.mckinnon at gmail.com