[rancid] Cisco 10k sflog Timestamp Cycling
heasley
heas at shrubbery.net
Thu Jun 5 21:26:36 UTC 2014
Thu, Jun 05, 2014 at 02:24:41PM -0400, Kenneth Lind:
> This is a fairly old issue so I'm including the previous threads for what
> it's worth. We upgraded to Rancid v3.0 and then today to v3.1 without issue.
> The upgrade to 3.0a did hush the actual sflog diffs, however, we are still
> receiving noisy diffs related to the sflog/IPDR data and the fact that n
> bytes are stored in flash before being sent to the collector.
>
> What would be the best method to hush these diffs?
>
> Example of diffs:
> !Flash: sflog
> - !Flash: 821772288 bytes available (202817536 bytes used)
> + !Flash: 821805056 bytes available (202784768 bytes used)
would you show me the output of the command 'dir' or 'show flash' for whatever
device this is? it should be replacing that line with a sumarry line that
ought to be less annoying.
>
>
> > -----Original Message-----
> > From: 'heasley' [mailto:heas at shrubbery.net]
> > Sent: Thursday, November 07, 2013 2:56 PM
> > To: Kenneth Lind
> > Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> >
> > Thu, Nov 07, 2013 at 07:44:33PM +0000, 'heasley':
> > > Thu, Oct 31, 2013 at 11:34:51AM -0400, Kenneth Lind:
> > > > > -----Original Message-----
> > > > > From: heasley [mailto:heas at shrubbery.net]
> > > > > Sent: Wednesday, October 30, 2013 6:42 PM
> > > > > To: Kenneth Lind
> > > > > Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> > > > >
> > > > > Tue, Oct 29, 2013 at 04:26:18PM -0400, Kenneth Lind:
> > > > > > > -----Original Message-----
> > > > > > > From: rancid-discuss-bounces at shrubbery.net
> > > > > > > [mailto:rancid-discuss- bounces at shrubbery.net] On Behalf Of
> > > > > > > Alan McKinnon
> > > > > > > Sent: Tuesday, October 22, 2013 4:19 PM
> > > > > > > To: rancid-discuss at shrubbery.net
> > > > > > > Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> > > > > > >
> > > > > > > On 22/10/2013 17:27, Kenneth Lind wrote:
> > > > > > > > We recently implemented IPDR on our Cisco 10K uBRs and are
> > > > > > > > now receiving diffs for every rancid run about the
> > timestamp
> > > > > > > > for the
> > > > > > > sflog:
> > > > > > > >
> > > > > > > > - !Flash: 6 0 Oct 22 2013 08:46:10 -04:00 sflog
> > > > > > > > + !Flash: 6 0 Oct 22 2013 09:37:28 -04:00 sflog
> > > > > > > >
> > > > > > > > We are running Rancid v2.3.6 which according to the change
> > > > > > > > log included the fix for this issue (though in our instance
> > > > > > > > it does not appear to be filtered, unless there is an
> > option
> > > > > > > > somewhere that we've missed to enable the filtering):
> > > > > > > >
> > > > > > > > rancid: filter sflog from DirSlotN() for IOS on cisco 10k
> > > > > > > >
> > > > > > > > I've been able to find mentions of the issue in the discuss
> > > > > > > > archives, but none have included a solution. Has anyone
> > been
> > > > > > > > able to hush the diffs for the sflog outside of creating a
> > > > > > > > new rancid type and
> > > > > > > altering
> > > > > > > > the command table to exclude the DirSlotN run?
> > > > > > >
> > > > > > > I'm not familiar with the 10k but Google indicates they will
> > > > > > > run regular IOS. Is that correct?
> > > > > >
> > > > > > 10k does run IOS. There are some specialized-for-the-purpose
> > > > > > commands/configuration, but it is still standard IOS
> > (12.2(33)).
> > > > > >
> > > > > > >
> > > > > > > The code in 2.3.6 does support what the Changelog says:
> > > > > > >
> > > > > > > sub DirSlotN {
> > > > > > > ....
> > > > > > > if ($ios eq "IOS" &&
> > /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
> > > > > > > $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > > }
> > > > > > > ....
> > > > > > > }
> > > > > > >
> > > > > > > but that regex does not match the output you quoted. maybe
> > > > > > > that was written for
> > > > > > >
> > > > > > > Personally, I would simply discard the entire line (you don't
> > > > > > > want to keep the timestamp and that is the very thing that is
> > > > > > > changing) so modify DirSlotN thusly (add it just before the
> > code above):
> > > > > > >
> > > > > > > next if ($ios eq "IOS" && /^Flash:.*? sflog$);
> > > > > > >
> > > > > > > that regex is quite simplistic, you might want to tweak it to
> > > > > > > be more specific.
> > > > > > >
> > > > > >
> > > > > > Heasley replied directly to me with the following diff from
> > > > > > Rancid
> > > > > v3.0a:
> > > > > > Index: lib/ios.pm.in
> > > > > >
> > ===================================================================
> > > > > > --- lib/ios.pm.in (revision 2731)
> > > > > > +++ lib/ios.pm.in (working copy)
> > > > > > @@ -884,7 +884,7 @@
> > > > > > # to:
> > > > > > # -rw- vlan.dat
> > > > > > # -rw-
> > vlan.dat
> > > > > > - if (/(dhcp_[^. ]*\.txt|vlan\.dat)\s*$/) {
> > > > > > + if (/(dhcp_[^. ]*\.txt|vlan\.dat|sflog)\s*$/) {
> > > > > > if (/(\s*\d+)(\s+\S+\s+)(\d+)(\s+)(\w+ \d+\s+\d+
> > > > > > \d+:\d+:\d+
> > > > > > .\d+:\d+)/) {
> > > > > > my($fn, $a, $sz, $c, $dt, $rem) = ($1, $2, $3, $4,
> > $5, $');
> > > > > > my($fnl, $szl, $dtl) = (length($fn), length($sz),
> > > > > length($dt)); @@
> > > > > > -921,9 +921,6 @@
> > > > > > if ($ios eq "XE" &&
> > /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/) {
> > > > > > $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > }
> > > > > > - if ($ios eq "IOS" && /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/)
> > {
> > > > > > - $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > - }
> > > > > > # the pager can not be disabled per-session on the PIX
> > > > > > if (/^(<-+ More -+>)/) {
> > > > > > my($len) = length($1);
> > > > > >
> > > > > >
> > > > > > However, our stock Rancid v2.3.6 looks considerably different
> > > > > > and I wasn't able to find the correct location(s) to make the
> > changes.
> > > > > >
> > > > > > I created a proposed diff with changes matching our stock
> > Rancid
> > > > > > as follows and I wonder if anyone has any input (notice the
> > line
> > > > > > numbers are considerably different as well as the 'next if'
> > statement):
> > > > >
> > > > > and i replied about your diff below. did you try it? you can
> > try
> > > > > it without changing your installed based. ./rancid hostname;
> > diff
> > > > > ~rancid/group/ configs/hostname hostname.new
> > > >
> > > >
> > > > Applying the below proposed changes caused the following errors in
> > the log:
> > > >
> > > > Execution of /usr/local/rancid/bin/rancid aborted due to
> > compilation errors.
> > > > syntax error at /usr/local/rancid/bin/rancid line 759, near ") {"
> > > > Can't use global $1 in "my" at /usr/local/rancid/bin/rancid line
> > > > 761, near "($1"
> > > > Missing right curly or square bracket at
> > > > /usr/local/rancid/bin/rancid line 2085, at end of line
> > >
> > > the patch wasnt applied properly.
> > >
> > > >
> > > > >
> > > > > > Index: bin/rancid
> > > > > >
> > ================================================================
> > > > > > ===
> > > > > > @@ -757,9 +757,9 @@
> > > > > > if ($dev =~ /bootflash/) {
> > > > > > next if (/temp_cont\s*$/);
> > > > > > next if (/uptime_cont\s*$/);
> > > > > > }
> > > > > > # Filter dhcp database
> > > > > > - next if (/dhcp_[^. ]*\.txt/);
> > > > > > + next if (/(dhcp_[^. ]*\.txt|vlan\.dat|sflog)\s*$/) {
> > >
> > > eg: next is not valid there. you could just move to rancid 3.0aN,
> > > else you will have to correct the application of the patch.
> >
> > btw, you need ftp://ftp.shrubbery.net/pub/rancid/alpha/rancid-
> > 3.0a3.tar.gz
> > then apply the patch i'd sent to you.
> >
> > > > > > + if (/(\s*\d+)(\s+\S+\s+)(\d+)(\s+)(\w+ \d+\s+\d+
> > > > > > + \d+:\d+:\d+
> > > > > > .\d+:\d+)/) {
> > > > > > + my($fn, $a, $sz, $c, $dt, $rem) = ($1, $2, $3, $4,
> > $5, $');
> > > > > > + my($fnl, $szl, $dtl) = (length($fn), length($sz),
> > > > > > length($dt));
> > > > > >
> > > > > > if ($ios eq "XE" && /.*\((\d+) bytes free\)/) {
> > > > > > my($tmp) = $1;
> > > > > > if ($tmp >= (1024 * 1024 * 1024)) {
> > > > > > $tmp = int($tmp / (1024 * 1024 * 1024));
> > > > > > s/$1 bytes free/$tmp GB free/;
> > > > > > } else {
> > > > > > $tmp = int($tmp / (1024 * 1024));
> > > > > > s/$1 bytes free/$tmp MB free/;
> > > > > > }
> > > > > > }
> > > > > > if ($ios eq "XE" &&
> > > > > > /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/)
> > > > > {
> > > > > > $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > }
> > > > > >
> > > > > > @@ -772,9 +772,9 @@
> > > > > > }
> > > > > > }
> > > > > > if ($ios eq "XE" &&
> > > > > > /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/)
> > > > > {
> > > > > > $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > }
> > > > > > - if ($ios eq "IOS" &&
> > /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
> > > > > > - $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > - }
> > > > > > # the pager can not be disabled per-session on the PIX
> > > > > > if (/^(<-+ More -+>)/) {
> > > > > > my($len) = length($1);
> > > > > > s/^$1\s{$len}//;
> > > > > >
> > > > > > > Don't stress about maintaining your own patches to make the
> > > > > > > rancid scripts do what you intent - every installation I know
> > > > > > > of accumulating a rather large number of them :-) It seems
> > to
> > > > > > > be inevitable considering the problem we are all using rancid
> > > > > > > to
> > > > > solve.
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Alan McKinnon
> > > > > > > alan.mckinnon at gmail.com
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Rancid-discuss mailing list
> > > > > > > Rancid-discuss at shrubbery.net
> > > > > > > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> > > > > >
> > > > > > _______________________________________________
> > > > > > Rancid-discuss mailing list
> > > > > > Rancid-discuss at shrubbery.net
> > > > > > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss
More information about the Rancid-discuss
mailing list