[rancid] Cisco 10k sflog Timestamp Cycling

[Kenneth Lind]

> -----Original Message-----
> From: rancid-discuss-bounces at shrubbery.net [mailto:rancid-discuss-
> bounces at shrubbery.net] On Behalf Of Alan McKinnon
> Sent: Tuesday, October 22, 2013 4:19 PM
> To: rancid-discuss at shrubbery.net
> Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> 
> On 22/10/2013 17:27, Kenneth Lind wrote:
> > We recently implemented IPDR on our Cisco 10K uBRs and are now
> > receiving diffs for every rancid run about the timestamp for the
> sflog:
> >
> > - !Flash: 6            0 Oct 22 2013 08:46:10 -04:00 sflog
> > + !Flash: 6            0 Oct 22 2013 09:37:28 -04:00 sflog
> >
> > We are running Rancid v2.3.6 which according to the change log
> > included the fix for this issue (though in our instance it does not
> > appear to be filtered, unless there is an option somewhere that we've
> > missed to enable the filtering):
> >
> > rancid: filter sflog from DirSlotN() for IOS on cisco 10k
> >
> > I've been able to find mentions of the issue in the discuss archives,
> > but none have included a solution. Has anyone been able to hush the
> > diffs for the sflog outside of creating a new rancid type and
> altering
> > the command table to exclude the DirSlotN run?
> 
> I'm not familiar with the 10k but Google indicates they will run
> regular IOS. Is that correct?

10k does run IOS. There are some specialized-for-the-purpose
commands/configuration, but it is still standard IOS (12.2(33)).

> 
> The code in 2.3.6 does support what the Changelog says:
> 
> sub DirSlotN {
>     ....
>     if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
>         $_ = "$1" . sprintf("%43s", "") . "$3\n";
>     }
>     ....
> }
> 
> but that regex does not match the output you quoted. maybe that was
> written for
> 
> Personally, I would simply discard the entire line (you don't want to
> keep the timestamp and that is the very thing that is changing) so
> modify DirSlotN thusly (add it just before the code above):
> 
>     next if ($ios eq "IOS" && /^Flash:.*? sflog$);
> 
> that regex is quite simplistic, you might want to tweak it to be more
> specific.
> 

Heasley replied directly to me with the following diff from Rancid v3.0a:
Index: lib/ios.pm.in
===================================================================
--- lib/ios.pm.in	(revision 2731)
+++ lib/ios.pm.in	(working copy)
@@ -884,7 +884,7 @@
 	# to:
 	#       -rw-                                   vlan.dat
 	#       -rw-                                           vlan.dat
-	if (/(dhcp_[^. ]*\.txt|vlan\.dat)\s*$/) {
+	if (/(dhcp_[^. ]*\.txt|vlan\.dat|sflog)\s*$/) {
 	    if (/(\s*\d+)(\s+\S+\s+)(\d+)(\s+)(\w+ \d+\s+\d+ \d+:\d+:\d+
.\d+:\d+)/) {
 		my($fn, $a, $sz, $c, $dt, $rem) = ($1, $2, $3, $4, $5, $');
 		my($fnl, $szl, $dtl) = (length($fn), length($sz),
length($dt)); @@ -921,9 +921,6 @@
 	if ($ios eq "XE" && /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/) {
 	    $_ = "$1" . sprintf("%43s", "") . "$3\n";
 	}
-	if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
-	    $_ = "$1" . sprintf("%43s", "") . "$3\n";
-	}
 	# the pager can not be disabled per-session on the PIX
 	if (/^(<-+ More -+>)/) {
 	    my($len) = length($1);


However, our stock Rancid v2.3.6 looks considerably different and I wasn't
able to find the correct location(s) to make the changes.

I created a proposed diff with changes matching our stock Rancid as follows
and I wonder if anyone has any input (notice the line numbers are
considerably different as well as the 'next if' statement):

Index: bin/rancid
===================================================================
@@ -757,9 +757,9 @@
        if ($dev =~ /bootflash/) {
            next if (/temp_cont\s*$/);
            next if (/uptime_cont\s*$/);
        }
        # Filter dhcp database
-       next if (/dhcp_[^. ]*\.txt/);
+	  next if (/(dhcp_[^. ]*\.txt|vlan\.dat|sflog)\s*$/) {
+ 	    if (/(\s*\d+)(\s+\S+\s+)(\d+)(\s+)(\w+ \d+\s+\d+ \d+:\d+:\d+
.\d+:\d+)/) {
+ 		my($fn, $a, $sz, $c, $dt, $rem) = ($1, $2, $3, $4, $5, $');
+ 		my($fnl, $szl, $dtl) = (length($fn), length($sz),
length($dt));

        if ($ios eq "XE" && /.*\((\d+) bytes free\)/) {
            my($tmp) = $1;
            if ($tmp >= (1024 * 1024 * 1024)) {
                $tmp = int($tmp / (1024 * 1024 * 1024));
                s/$1 bytes free/$tmp GB free/;
            } else {
                $tmp = int($tmp / (1024 * 1024));
                s/$1 bytes free/$tmp MB free/;
            }
        }
        if ($ios eq "XE" && /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/) {
            $_ = "$1" . sprintf("%43s", "") . "$3\n";
        }
        
@@ -772,9 +772,9 @@ 
            }
        }
        if ($ios eq "XE" && /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/) {
            $_ = "$1" . sprintf("%43s", "") . "$3\n";
        }
-	  if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
-           $_ = "$1" . sprintf("%43s", "") . "$3\n";
-        }
        # the pager can not be disabled per-session on the PIX
        if (/^(<-+ More -+>)/) {
            my($len) = length($1);
            s/^$1\s{$len}//;

> Don't stress about maintaining your own patches to make the rancid
> scripts do what you intent - every installation I know of accumulating
> a rather large number of them :-)  It seems to be inevitable
> considering the problem we are all using rancid to solve.
> 
> 
> --
> Alan McKinnon
> alan.mckinnon at gmail.com
> 
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss