[rancid] Cisco 10k sflog Timestamp Cycling

Kenneth Lind lind108 at hotmail.com
Mon Jun 9 14:18:21 UTC 2014


> -----Original Message-----
> From: heasley [mailto:heas at shrubbery.net]
> Sent: Thursday, June 05, 2014 5:27 PM
> To: Kenneth Lind
> Cc: rancid-discuss at shrubbery.net
> Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> 
> Thu, Jun 05, 2014 at 02:24:41PM -0400, Kenneth Lind:
> > This is a fairly old issue so I'm including the previous threads for
> > what it's worth. We upgraded to Rancid v3.0 and then today to v3.1
> without issue.
> > The upgrade to 3.0a did hush the actual sflog diffs, however, we are
> > still receiving noisy diffs related to the sflog/IPDR data and the
> > fact that n bytes are stored in flash before being sent to the
> collector.
> >
> > What would be the best method to hush these diffs?
> >
> > Example of diffs:
> >   !Flash:                                           sflog
> > - !Flash: 821772288 bytes available (202817536 bytes used)
> > + !Flash: 821805056 bytes available (202784768 bytes used)
> 
> would you show me the output of the command 'dir' or 'show flash' for
> whatever device this is?  it should be replacing that line with a
> sumarry line that ought to be less annoying.

"Dir" and "show flash" look a little different, so I'll include both.

First "dir"
Directory of disk0:/

    1  -rw-    68483912  Dec 14 2010 10:46:02 -05:00  <removed>.bin
    2  -rw-    68495176  Jan 25 2011 01:27:54 -05:00  <removed>.bin
    3  -rw-    54584320  Jan 25 2011 01:30:40 -05:00  <removed>.pkg
    4  -rw-    11060935  Jul 31 2012 10:09:38 -04:00  <removed>.img
    5  -rw-      115639  Mar 28 2013 10:24:54 -04:00  ftp
    6  -rw-           0   Jun 9 2014 10:01:30 -04:00  sflog


"show flash"
-#- --length-- -----date/time------ path
1     68483912 Dec 14 2010 10:46:02 -05:00 <removed>.bin
2     68495176 Jan 25 2011 01:27:54 -05:00 <removed>.bin
3     54584320 Jan 25 2011 01:30:40 -05:00 <removed>.pkg
4     11060935 Jul 31 2012 10:09:38 -04:00 <removed>.img
5       115639 Mar 28 2013 10:24:54 -04:00 ftp
6            0 Jun 9 2014 10:01:30 -04:00 sflog


> 
> >
> >
> > > -----Original Message-----
> > > From: 'heasley' [mailto:heas at shrubbery.net]
> > > Sent: Thursday, November 07, 2013 2:56 PM
> > > To: Kenneth Lind
> > > Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> > >
> > > Thu, Nov 07, 2013 at 07:44:33PM +0000, 'heasley':
> > > > Thu, Oct 31, 2013 at 11:34:51AM -0400, Kenneth Lind:
> > > > > > -----Original Message-----
> > > > > > From: heasley [mailto:heas at shrubbery.net]
> > > > > > Sent: Wednesday, October 30, 2013 6:42 PM
> > > > > > To: Kenneth Lind
> > > > > > Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> > > > > >
> > > > > > Tue, Oct 29, 2013 at 04:26:18PM -0400, Kenneth Lind:
> > > > > > > > -----Original Message-----
> > > > > > > > From: rancid-discuss-bounces at shrubbery.net
> > > > > > > > [mailto:rancid-discuss- bounces at shrubbery.net] On Behalf
> > > > > > > > Of Alan McKinnon
> > > > > > > > Sent: Tuesday, October 22, 2013 4:19 PM
> > > > > > > > To: rancid-discuss at shrubbery.net
> > > > > > > > Subject: Re: [rancid] Cisco 10k sflog Timestamp Cycling
> > > > > > > >
> > > > > > > > On 22/10/2013 17:27, Kenneth Lind wrote:
> > > > > > > > > We recently implemented IPDR on our Cisco 10K uBRs and
> > > > > > > > > are now receiving diffs for every rancid run about the
> > > timestamp
> > > > > > > > > for the
> > > > > > > > sflog:
> > > > > > > > >
> > > > > > > > > - !Flash: 6            0 Oct 22 2013 08:46:10 -04:00
> sflog
> > > > > > > > > + !Flash: 6            0 Oct 22 2013 09:37:28 -04:00
> sflog
> > > > > > > > >
> > > > > > > > > We are running Rancid v2.3.6 which according to the
> > > > > > > > > change log included the fix for this issue (though in
> > > > > > > > > our instance it does not appear to be filtered, unless
> > > > > > > > > there is an
> > > option
> > > > > > > > > somewhere that we've missed to enable the filtering):
> > > > > > > > >
> > > > > > > > > rancid: filter sflog from DirSlotN() for IOS on cisco
> > > > > > > > > 10k
> > > > > > > > >
> > > > > > > > > I've been able to find mentions of the issue in the
> > > > > > > > > discuss archives, but none have included a solution.
> Has
> > > > > > > > > anyone
> > > been
> > > > > > > > > able to hush the diffs for the sflog outside of
> creating
> > > > > > > > > a new rancid type and
> > > > > > > > altering
> > > > > > > > > the command table to exclude the DirSlotN run?
> > > > > > > >
> > > > > > > > I'm not familiar with the 10k but Google indicates they
> > > > > > > > will run regular IOS. Is that correct?
> > > > > > >
> > > > > > > 10k does run IOS. There are some specialized-for-the-
> purpose
> > > > > > > commands/configuration, but it is still standard IOS
> > > (12.2(33)).
> > > > > > >
> > > > > > > >
> > > > > > > > The code in 2.3.6 does support what the Changelog says:
> > > > > > > >
> > > > > > > > sub DirSlotN {
> > > > > > > >     ....
> > > > > > > >     if ($ios eq "IOS" &&
> > > /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
> > > > > > > >         $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > > >     }
> > > > > > > >     ....
> > > > > > > > }
> > > > > > > >
> > > > > > > > but that regex does not match the output you quoted.
> maybe
> > > > > > > > that was written for
> > > > > > > >
> > > > > > > > Personally, I would simply discard the entire line (you
> > > > > > > > don't want to keep the timestamp and that is the very
> > > > > > > > thing that is
> > > > > > > > changing) so modify DirSlotN thusly (add it just before
> > > > > > > > the
> > > code above):
> > > > > > > >
> > > > > > > >     next if ($ios eq "IOS" && /^Flash:.*? sflog$);
> > > > > > > >
> > > > > > > > that regex is quite simplistic, you might want to tweak
> it
> > > > > > > > to be more specific.
> > > > > > > >
> > > > > > >
> > > > > > > Heasley replied directly to me with the following diff from
> > > > > > > Rancid
> > > > > > v3.0a:
> > > > > > > Index: lib/ios.pm.in
> > > > > > >
> > > ===================================================================
> > > > > > > --- lib/ios.pm.in	(revision 2731)
> > > > > > > +++ lib/ios.pm.in	(working copy)
> > > > > > > @@ -884,7 +884,7 @@
> > > > > > >  	# to:
> > > > > > >  	#       -rw-
> vlan.dat
> > > > > > >  	#       -rw-
> > > vlan.dat
> > > > > > > -	if (/(dhcp_[^. ]*\.txt|vlan\.dat)\s*$/) {
> > > > > > > +	if (/(dhcp_[^. ]*\.txt|vlan\.dat|sflog)\s*$/) {
> > > > > > >  	    if (/(\s*\d+)(\s+\S+\s+)(\d+)(\s+)(\w+ \d+\s+\d+
> > > > > > > \d+:\d+:\d+
> > > > > > > .\d+:\d+)/) {
> > > > > > >  		my($fn, $a, $sz, $c, $dt, $rem) = ($1, $2, $3,
> $4,
> > > $5, $');
> > > > > > >  		my($fnl, $szl, $dtl) = (length($fn),
> length($sz),
> > > > > > length($dt)); @@
> > > > > > > -921,9 +921,6 @@
> > > > > > >  	if ($ios eq "XE" &&
> > > /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/) {
> > > > > > >  	    $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > >  	}
> > > > > > > -	if ($ios eq "IOS" &&
> /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/)
> > > {
> > > > > > > -	    $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > > -	}
> > > > > > >  	# the pager can not be disabled per-session on the
> PIX
> > > > > > >  	if (/^(<-+ More -+>)/) {
> > > > > > >  	    my($len) = length($1);
> > > > > > >
> > > > > > >
> > > > > > > However, our stock Rancid v2.3.6 looks considerably
> > > > > > > different and I wasn't able to find the correct location(s)
> > > > > > > to make the
> > > changes.
> > > > > > >
> > > > > > > I created a proposed diff with changes matching our stock
> > > Rancid
> > > > > > > as follows and I wonder if anyone has any input (notice the
> > > line
> > > > > > > numbers are considerably different as well as the 'next if'
> > > statement):
> > > > > >
> > > > > > and i replied about your diff below.  did you try it?  you
> can
> > > try
> > > > > > it without changing your installed based.  ./rancid hostname;
> > > diff
> > > > > > ~rancid/group/ configs/hostname hostname.new
> > > > >
> > > > >
> > > > > Applying the below proposed changes caused the following errors
> > > > > in
> > > the log:
> > > > >
> > > > > Execution of /usr/local/rancid/bin/rancid aborted due to
> > > compilation errors.
> > > > > syntax error at /usr/local/rancid/bin/rancid line 759, near ")
> {"
> > > > > Can't use global $1 in "my" at /usr/local/rancid/bin/rancid
> line
> > > > > 761, near "($1"
> > > > > Missing right curly or square bracket at
> > > > > /usr/local/rancid/bin/rancid line 2085, at end of line
> > > >
> > > > the patch wasnt applied properly.
> > > >
> > > > >
> > > > > >
> > > > > > > Index: bin/rancid
> > > > > > >
> > > ================================================================
> > > > > > > ===
> > > > > > > @@ -757,9 +757,9 @@
> > > > > > >         if ($dev =~ /bootflash/) {
> > > > > > >             next if (/temp_cont\s*$/);
> > > > > > >             next if (/uptime_cont\s*$/);
> > > > > > >         }
> > > > > > >         # Filter dhcp database
> > > > > > > -       next if (/dhcp_[^. ]*\.txt/);
> > > > > > > +	  next if (/(dhcp_[^. ]*\.txt|vlan\.dat|sflog)\s*$/)
> {
> > > >
> > > > eg: next is not valid there.  you could just move to rancid
> 3.0aN,
> > > > else you will have to correct the application of the patch.
> > >
> > > btw, you need ftp://ftp.shrubbery.net/pub/rancid/alpha/rancid-
> > > 3.0a3.tar.gz
> > > then apply the patch i'd sent to you.
> > >
> > > > > > > + 	    if (/(\s*\d+)(\s+\S+\s+)(\d+)(\s+)(\w+ \d+\s+\d+
> > > > > > > + \d+:\d+:\d+
> > > > > > > .\d+:\d+)/) {
> > > > > > > + 		my($fn, $a, $sz, $c, $dt, $rem) = ($1, $2,
$3,
> $4,
> > > $5, $');
> > > > > > > + 		my($fnl, $szl, $dtl) = (length($fn),
> length($sz),
> > > > > > > length($dt));
> > > > > > >
> > > > > > >         if ($ios eq "XE" && /.*\((\d+) bytes free\)/) {
> > > > > > >             my($tmp) = $1;
> > > > > > >             if ($tmp >= (1024 * 1024 * 1024)) {
> > > > > > >                 $tmp = int($tmp / (1024 * 1024 * 1024));
> > > > > > >                 s/$1 bytes free/$tmp GB free/;
> > > > > > >             } else {
> > > > > > >                 $tmp = int($tmp / (1024 * 1024));
> > > > > > >                 s/$1 bytes free/$tmp MB free/;
> > > > > > >             }
> > > > > > >         }
> > > > > > >         if ($ios eq "XE" &&
> > > > > > > /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/)
> > > > > > {
> > > > > > >             $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > >         }
> > > > > > >
> > > > > > > @@ -772,9 +772,9 @@
> > > > > > >             }
> > > > > > >         }
> > > > > > >         if ($ios eq "XE" &&
> > > > > > > /^((\s+)?\d+\s+\S+)\s+\d+.*(tracelogs$)/)
> > > > > > {
> > > > > > >             $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > >         }
> > > > > > > -	  if ($ios eq "IOS" &&
> > > /^((\s+)?\d+\s+\S+)\s+\d+.*(sflog$)/) {
> > > > > > > -           $_ = "$1" . sprintf("%43s", "") . "$3\n";
> > > > > > > -        }
> > > > > > >         # the pager can not be disabled per-session on the
> PIX
> > > > > > >         if (/^(<-+ More -+>)/) {
> > > > > > >             my($len) = length($1);
> > > > > > >             s/^$1\s{$len}//;
> > > > > > >
> > > > > > > > Don't stress about maintaining your own patches to make
> > > > > > > > the rancid scripts do what you intent - every
> installation
> > > > > > > > I know of accumulating a rather large number of them :-)
> > > > > > > > It seems
> > > to
> > > > > > > > be inevitable considering the problem we are all using
> > > > > > > > rancid to
> > > > > > solve.
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Alan McKinnon
> > > > > > > > alan.mckinnon at gmail.com
> > > > > > > >
> > > > > > > > _______________________________________________
> > > > > > > > Rancid-discuss mailing list Rancid-discuss at shrubbery.net
> > > > > > > > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Rancid-discuss mailing list
> > > > > > > Rancid-discuss at shrubbery.net
> > > > > > > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> >
> > _______________________________________________
> > Rancid-discuss mailing list
> > Rancid-discuss at shrubbery.net
> > http://www.shrubbery.net/mailman/listinfo/rancid-discuss



More information about the Rancid-discuss mailing list