From david.byers at liu.se  Wed Feb  6 17:16:47 2019
From: david.byers at liu.se (David Byers)
Date: Wed, 6 Feb 2019 17:16:47 +0000
Subject: [rancid] Alcatel script,
 not parsing the commands and/or output well (/partially)
In-Reply-To: <20190130225108.GF62383@shrubbery.net>
References: <FAE9FD28-293C-4B48-92D9-515E3DB8F9DD@FreeBSD.org>
 <20190116173943.GB36528@shrubbery.net>
 <7F973CD4-9D89-4524-B80A-20ECDCAA0801@FreeBSD.org>
 <20190117184403.GE61757@shrubbery.net> <20190130225108.GF62383@shrubbery.net>
Message-ID: <f8a112d9-8314-32b5-b7d2-a039fabd1708@liu.se>

Alcatel-Lucent Enterprise (Omniswitch) is indeed not at all the same as
Alcatel-Lucent (Nokia). Furthermore, old versions of AOS behave very
differently from new versions. We've got some ugly Python hacks for
rancid that pull configs and a little more information from ALE
switches. I'm happy to share them after we've cleaned them up a bit. We
use them all the time, but a word of warning: they are not configurable,
and I won't even guarantee that they don't set your switch on fire.


David Byers

Link?ping University


On 2019-01-30 23:51, heasley wrote:
> Thu, Jan 17, 2019 at 06:44:03PM +0000, heasley:
>> Thu, Jan 17, 2019 at 08:07:02AM +0100, Remko Lodder:
>>> Hi,
>>>
>>> I also have ?3.99.99? on the system to compare the output. The regular version on the system is 3.6 it seems.
>>> But, the noklogin works after modifying the u_prompt and p_prompt. When running rancid -d -t sros <devicename>
>>> it wants to execute commands that are not available at all on the Alcatel.
>>>
>>> The ones that I use from Burgalio?s :
>>>
>>>         {'show chassis'                 => 'ShowChassis'},
>>>         {'show system'                  => 'ShowSystem'},
>>>         {'show module'                  => 'ShowModule'},
>>>         {'show stack topology'          => 'ShowStackTopolgy'},
>>>         {'show lanpower 1'              => 'ShowLanPower'},
>>>         {'show lanpower 2'              => 'ShowLanPower'},
>>>         {'show user'                    => 'ShowUser'},
>>>         {'ls'                           => 'GenericParse'},
>>>         {'ls certified/'                => 'GenericParse'},
>>>         {'ls working/'                  => 'GenericParse'},
>>>         {'ls switch/'                   => 'GenericParse'},
>>>         {'ls network/'                  => 'GenericParse'},
>>>         {'show vlan'                    => 'ShowVLAN'},
>>>         {'show interfaces status'       => 'ShowInterfaces'},
>>>         {'show running'                 => 'ShowConf'},
>>>         {'show configuration snapshot'  => 'ShowConf?},
>>>
>>> which does not match:
>>>
>>> xecuting noklogin -t 90 -c"show system information;file type bootlog.txt;show redundancy synchronization;show chassis;show chassis environment;show chassis power-supply;show chassis power-management;show card state;show card detail;show debug;show bof;admin display-config index;admin display-config? <devicename>
>>>
>>> Do note that it seems that the SROS is on a very different architecture based then what my Omniswitches use. So it seems incompatible to start with, where the alu* scripts might not entirely work with every command on the OS6000 that I have, but most of them are accepted in older (legacy) components but also on the newer
>>> versions.
>> testing & dev was done with 7750.  I will enquire with my nokia contact
>> about the omniswitch.
> I'm told that these are totally separate from the Nokia systems I know and
> will never converge.  so, they should be handled separately, but I have
> none to poke for debugging/testing.
>
>>> Thanks
>>> Remko
>>>
>>>> On 16 Jan 2019, at 18:39, heasley <heas at shrubbery.net> wrote:
>>>>
>>>> Wed, Jan 16, 2019 at 12:02:14PM +0100, Remko Lodder:
>>>>> Hi all,
>>>>>
>>>>> First of all, thank you for Rancid, it?s a great tool to monitor configuration changes and pushing back changes.
>>>>>
>>>>> Having Said that;
>>>>>
>>>>> I fetched some alcatel switches which I modified a little to work on various types . These changes are trivial
>>>>> changes from upstream so no real changes there actually.
>>>>>
>>>>> It seems that most switches work just fine, but that one particular switch is not able to keep up  with the
>>>>> requests. It seems that this specific switch misses commands (like ls and show interface status).
>>>>> If I look back in the raw output it appears to miss characters:
>>>>>
>>>>> # how interfaces status
>>>>>                  ^
>>>>> ERROR: Invalid entry: ?how?
> I suspect that the login script it out of sync (ahead of) the cli.  possibly
> due to incorrectly matching a rogue prompt in some output or banner.
>
>>>>> The same goes for ls, where ?s' is the command being send. Or for exit at the end which is send as ?xit?.
>>>>>
>>>>> The scripts are from: https://github.com/buraglio/alurancid (Thanks buraglio) and apart from one switch work
>>>>> fine it seems.
>>>>>
>>>>> Switching from SSH to Telnet does not make a difference.
>>>>> Does someone have an suggestion on where to look?
>>>> can you try the sros support that is in rancid 3.8 or the current alpha?
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190206/93ee7fe1/attachment.sig>

From rancid at uuuuuu.net  Thu Feb  7 03:12:58 2019
From: rancid at uuuuuu.net (rancid)
Date: Thu, 7 Feb 2019 16:12:58 +1300
Subject: [rancid] 3.99.99 and Nokia/Alcatel/Alu/SROS
Message-ID: <CA+pJZ2gb6YhxPw4Lk4QTAGb-u0TxBhoqNCG5aX_cHR=NVhwQTQ@mail.gmail.com>

We've a number of SAR-8 SAR-AX SAS-S devices which I'm wanting to
collect configs of.  My test device is "TiMOS-B-10.0.R6 both/hops
Nokia SAS-S 24T4SFP+ 7210 Copyright (c) 2000-2018 Nokia"

I've run into a few minor issues which I've worked around.
- extra calls to turn off the paging in addition to "environment no more"
- A few commands that I apparently don't have permissions to run e.g.
I can't run "admin display-config index" but can run "admin
display-config"
- a few commands that don't seem to be present on this hardware/software version

I've configured a new base type "ttsros" to work around these issues
but (and this is the biggie) I seem to be hitting an "End of run not
found" error

e.g.

rancid at dev-test:/usr/local/rancid/bin$ export PATH=$PATH:/usr/local/rancid/bin
rancid at dev-test:/usr/local/rancid/bin$ ./rancid -d -t ttsros
OBFUSCATED.domain.net
loadtype: device type ttsros
loadtype: found device type ttsros in /usr/local/rancid/etc/rancid.types.conf
executing noklogin -t 90 -c"show system information;file type
bootlog.txt;show redundancy synchronization;show chassis;show chassis
power-supply;show chassis power-management;show card state;show card
detail;show debug;show bof;admin display-config" OBFUSCATED.domain.net
PROMPT MATCH: [*]?A:OBFUSCATED#
HIT COMMAND:*A:OBFUSCATED#  show system information
    In ShowSystemInfo: A:OBFUSCATED#  show system information
HIT COMMAND:*A:OBFUSCATED# file type bootlog.txt
    In BootLog: A:OBFUSCATED# file type bootlog.txt
HIT COMMAND:*A:OBFUSCATED# show redundancy synchronization
    In ShowRedundancy: A:OBFUSCATED# show redundancy synchronization
HIT COMMAND:*A:OBFUSCATED# show chassis
    In ShowChassis: A:OBFUSCATED# show chassis
OBFUSCATED.domain.net: missed cmd(s): show chassis power-supply, show
chassis power-management, show card state, show card detail, show
debug, show bof
OBFUSCATED.domain.net: End of run not found
OBFUSCATED.domain.net: clean_run is false
OBFUSCATED.domain.net: found_end is false
# A:OBFUSCATED# show chassis

Questions:

Should I be using 3.99.99?
Should it work on this device?
Should it work on the other devices?

Any suggestions on how to further debug this issue if the answers to
the above are yes ?


From titoyosua at gmail.com  Thu Feb  7 03:49:45 2019
From: titoyosua at gmail.com (razor max)
Date: Thu, 7 Feb 2019 10:49:45 +0700
Subject: [rancid] Using rancid with jump server
Message-ID: <CAEjNZZrPPgm0Ze+FS+7Gbd_k1YKGjOJj+O3WucE474UB7CQhdA@mail.gmail.com>

I'm already install rancid and used it with cisco router and switch. in the
next case i should use jump server who have access to network device inside
a lan. so the topology is  rancid server access >  jump server (router)
access > network device (router & switch) is it possible? if yes what
should i modify? .clogin file or?? for your information yes the jump server
is a cisco router.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190207/c2dc6dfc/attachment.html>

From yosuatito at gmail.com  Thu Feb  7 03:22:03 2019
From: yosuatito at gmail.com (Yosua tito)
Date: Thu, 7 Feb 2019 10:22:03 +0700
Subject: [rancid] Using rancid with jump server
Message-ID: <CALOjbjnTXNYxtw1kA_gG50MkAfMwCXJHJbL-5kPH2MvVz6JaUw@mail.gmail.com>

I'm already install rancid and used it with cisco router and switch. in the
next case i should use jump server who have access to network device inside
a lan. so the topology is  rancid server access >  jump server (router)
access > network device (router & switch) is it possible? if yes what
should i do modify .clogin file or?? for your information yes the jump
server is a cisco router.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190207/8cdf7cd4/attachment.html>

From heas at shrubbery.net  Thu Feb  7 18:46:10 2019
From: heas at shrubbery.net (Heasley)
Date: Thu, 7 Feb 2019 10:46:10 -0800
Subject: [rancid] 3.99.99 and Nokia/Alcatel/Alu/SROS
In-Reply-To: <CA+pJZ2gb6YhxPw4Lk4QTAGb-u0TxBhoqNCG5aX_cHR=NVhwQTQ@mail.gmail.com>
References: <CA+pJZ2gb6YhxPw4Lk4QTAGb-u0TxBhoqNCG5aX_cHR=NVhwQTQ@mail.gmail.com>
Message-ID: <A5E7E4B5-29FC-4CA9-86BF-DBD96003B1DA@shrubbery.net>

Am 06.02.2019 um 19:12 schrieb rancid <rancid at uuuuuu.net>:
> 
> We've a number of SAR-8 SAR-AX SAS-S devices which I'm wanting to
> collect configs of.  My test device is "TiMOS-B-10.0.R6 both/hops
> Nokia SAS-S 24T4SFP+ 7210 Copyright (c) 2000-2018 Nokia"
> 
> I've run into a few minor issues which I've worked around.
> - extra calls to turn off the paging in addition to "environment no more"

What do you mean by this? What is the spurce of extra commands?

> - A few commands that I apparently don't have permissions to run e.g.
> I can't run "admin display-config index" but can run "admin
> display-config"

Fix the permissions! /-)

> - a few commands that don't seem to be present on this hardware/software version

Thats does not matter.  That should be ignored; if not i?d like to know so that it can be fixed. 

> 
> I've configured a new base type "ttsros" to work around these issues
> but (and this is the biggie) I seem to be hitting an "End of run not
> found" error
> 
> e.g.
> 
> rancid at dev-test:/usr/local/rancid/bin$ export PATH=$PATH:/usr/local/rancid/bin
> rancid at dev-test:/usr/local/rancid/bin$ ./rancid -d -t ttsros
> OBFUSCATED.domain.net
> loadtype: device type ttsros
> loadtype: found device type ttsros in /usr/local/rancid/etc/rancid.types.conf
> executing noklogin -t 90 -c"show system information;file type
> bootlog.txt;show redundancy synchronization;show chassis;show chassis
> power-supply;show chassis power-management;show card state;show card
> detail;show debug;show bof;admin display-config" OBFUSCATED.domain.net
> PROMPT MATCH: [*]?A:OBFUSCATED#
> HIT COMMAND:*A:OBFUSCATED#  show system information
>    In ShowSystemInfo: A:OBFUSCATED#  show system information
> HIT COMMAND:*A:OBFUSCATED# file type bootlog.txt
>    In BootLog: A:OBFUSCATED# file type bootlog.txt
> HIT COMMAND:*A:OBFUSCATED# show redundancy synchronization
>    In ShowRedundancy: A:OBFUSCATED# show redundancy synchronization
> HIT COMMAND:*A:OBFUSCATED# show chassis
>    In ShowChassis: A:OBFUSCATED# show chassis
> OBFUSCATED.domain.net: missed cmd(s): show chassis power-supply, show
> chassis power-management, show card state, show card detail, show
> debug, show bof
> OBFUSCATED.domain.net: End of run not found
> OBFUSCATED.domain.net: clean_run is false
> OBFUSCATED.domain.net: found_end is false
> # A:OBFUSCATED# show chassis
> 
> Questions:
> 
> Should I be using 3.99.99?

Shrug. 3.9 would be better

> Should it work on this device?

Afaik, yes.  Nokiafolks helped test on various timos devices, though i do not know if they tested your particular device. 

> Should it work on the other devices?

Yes, i expect all sros devices and srosmd. My nokia experience is limited though. 

> 
> Any suggestions on how to further debug this issue if the answers to
> the above are yes ?

The log looks weird; show chassis both found and missing.  Id ask that you use the sros type for testing, so i dont have to debug what youve changed

> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From cbs at noc.ucla.edu  Fri Feb  8 19:02:07 2019
From: cbs at noc.ucla.edu (Chris Stromsoe)
Date: Fri, 8 Feb 2019 11:02:07 -0800 (PST)
Subject: [rancid] FXOS on FirePower 4140
Message-ID: <alpine.DEB.2.20.1902081101550.3845@potato.noc.ucla.edu>

I'm using fxlogin and fxos.pm from the development branch against a FirePoweer 
4140 running 2.4(1.122).  The default command table from rancid.types.base 
isn't working.

After logging in to the 4110, I have access to:

fw# show
chassis              cli                  clock
cloud-connector      configuration        eth-uplink
event                fabric-interconnect  fault
identity             license              ntp-overall-status
org                  post                 registry-repository
security             sel                  server
service-profile      system               timezone
ucspe-tech-support   version


If I do a 'connect fxos' I can get running-config and other information:

fw(fxos)# show
aaa                   incompatibility       role
access-lists          ingress-vlan-groups   routing
accounting            ingress-vp-groups     routing-context
banner                install               rscn
boot                  interface             running-config
callhome              inventory             san-port-channel
cdp                   ip                    scsi-target
cfs                   ipmc-groups           snm_batch_status
class-map             ipv6                  snmp
cli                   klm                   sprom
clock                 l2-class-id           ssh
cluster-state         l2-table              startup-config
configuration         lacp                  svs
copyright             ldap-server           switchname
debug                 line                  system
device-alias          lldp                  tacacs-server
diagnostic            loadbalancing         tech-support
ecmp-groups           locator-led           telnet
environment           logging               terminal
fc2                   mac                   topology
fc2d                  module                track
fcalias               monitor               trunk
fcdomain              msp                   udld
fcdroplatency         nsm                   user-account
fcflow                ntp                   users
fcid-allocation       phy-bypass            vdc
fcns                  platform              version
fcroute               policy-map            vifs
fcs                   port                  vlan
fctimer               port-channel          vms
fdmi                  port-profile          vmware
flogi                 port-security         vrf
fp                    queuing               vsan
fspf                  radius-server         wwn
hardware              redundancy            xml
hostname              resource              zone
hosts                 rlir                  zoneset
in-order-guarantee    rmon



Does the fxos module assume a FirePower running FTD?  I also have access to an 
FP 2110 running FTD and fxos works fine there.

I don't have enough experience with the FirePower platform and fxos to know if 
the current fxos module depends on running FTD, or if there are other 
differences in fxos on the 2110 with FTD and the 4140 that are causing the fxos 
module to fail.

Any pointers or suggestions?



-Chris


From erikm at buh.org  Fri Feb  8 20:26:49 2019
From: erikm at buh.org (Erik Muller)
Date: Fri, 8 Feb 2019 15:26:49 -0500
Subject: [rancid] FXOS on FirePower 4140
In-Reply-To: <alpine.DEB.2.20.1902081101550.3845@potato.noc.ucla.edu>
References: <alpine.DEB.2.20.1902081101550.3845@potato.noc.ucla.edu>
Message-ID: <60f72fd1-7dbb-b346-c155-789303b34869@buh.org>

On 2/8/19 14:02 , Chris Stromsoe wrote:
> I'm using fxlogin and fxos.pm from the development branch against a 
> FirePoweer 4140 running 2.4(1.122).? The default command table from 
> rancid.types.base isn't working.
> 
> After logging in to the 4110, I have access to:
> 
> fw# show
> chassis????????????? cli????????????????? clock
...

> If I do a 'connect fxos' I can get running-config and other information:
> 
> fw(fxos)# show
> aaa?????????????????? incompatibility?????? role
> access-lists????????? ingress-vlan-groups?? routing
...
> Does the fxos module assume a FirePower running FTD?? I also have access to 
> an FP 2110 running FTD and fxos works fine there.
> 
> I don't have enough experience with the FirePower platform and fxos to know 
> if the current fxos module depends on running FTD, or if there are other 
> differences in fxos on the 2110 with FTD and the 4140 that are causing the 
> fxos module to fail.
> 
> Any pointers or suggestions?

The current fxos module assumes FTD on a 2100 platform (and I'm currently 
testing support for ASA on 2100).  My understanding is that the 4100 and 
9300 have a bit of a different architecture from the 2100, but I've not 
touched those to be able to say how exactly they differ.

It looks like the initial login layer on the 4100 must be different.  Is 
there any other "connect" option from either the initial login layer or the 
fxos layer, where the actual firewall functions are exposed?

On a 2100 the first layer you connect to is the FTD application (similar to 
legacy ASA platform), with a simple ">" prompt and a config syntax like:
 > show running-config
: Serial Number: J..........
: Hardware:   FPR-2130, 14854 MB RAM, CPU MIPS 1200 MHz, 1 CPU (12 cores)
:
NGFW Version 6.2.3.4
!
hostname firepower
...
!
interface Ethernet1/1
  nameif border1
...

After that in the fxos layer, the config is more like the the UCS FI:
  > connect fxos
Cisco Firepower Extensible Operating System (FX-OS) Software
xxx-fw01# sho configuration
  scope org
      enter bios-policy SRIOV
          set acpi10-support-config acpi10-support platform-default
...


and there's a much more limited command list available:
xxx-fw01# show
chassis              cli                  clock
configuration        eth-uplink           event
fabric-interconnect  fault                identity
ntp-overall-status   registry-repository  security
sel                  server               system
tech-support         timezone             version


From cbs at noc.ucla.edu  Fri Feb  8 21:35:15 2019
From: cbs at noc.ucla.edu (Chris Stromsoe)
Date: Fri, 8 Feb 2019 13:35:15 -0800 (PST)
Subject: [rancid] FXOS on FirePower 4140
In-Reply-To: <60f72fd1-7dbb-b346-c155-789303b34869@buh.org>
References: <alpine.DEB.2.20.1902081101550.3845@potato.noc.ucla.edu>
 <60f72fd1-7dbb-b346-c155-789303b34869@buh.org>
Message-ID: <alpine.DEB.2.20.1902081230590.30063@potato.noc.ucla.edu>

On Fri, 8 Feb 2019, Erik Muller wrote:

> The current fxos module assumes FTD on a 2100 platform (and I'm 
> currently testing support for ASA on 2100).  My understanding is that 
> the 4100 and 9300 have a bit of a different architecture from the 2100, 
> but I've not touched those to be able to say how exactly they differ.
>
> It looks like the initial login layer on the 4100 must be different. 
> Is there any other "connect" option from either the initial login layer 
> or the fxos layer, where the actual firewall functions are exposed?

It looks like logging in to the 4100 drops you straight into fxos.

Options for connect are

fw# connect
   adapter     Mezzanine Adapter
   cimc        Cisco Integrated Management Controller
   fxos        Connect to FXOS CLI
   local-mgmt  Connect to Local Management CLI
   module      Security Module Console


The connect command is not available after running "connect fxos".  You 
have to "exit" to return to the initial layer.



> On a 2100 the first layer you connect to is the FTD application (similar to 
> legacy ASA platform), with a simple ">" prompt and a config syntax like:
>> show running-config
> : Serial Number: J..........
> : Hardware:   FPR-2130, 14854 MB RAM, CPU MIPS 1200 MHz, 1 CPU (12 cores)
> :
> NGFW Version 6.2.3.4
> !
> hostname firepower
> ...
> !
> interface Ethernet1/1
> nameif border1
> ...
>
> After that in the fxos layer, the config is more like the the UCS FI:
> > connect fxos
> Cisco Firepower Extensible Operating System (FX-OS) Software
> xxx-fw01# sho configuration
> scope org
>     enter bios-policy SRIOV
>         set acpi10-support-config acpi10-support platform-default
> ...


The login layers on the 4100 seems to be reversed when compared to the 
2100 with ftd.

The initial login layer on the 4100 resembles the 2100 after having run 
"connect fxos", and has a limited command list.

Running "connect fxos" on the 4100 resembles the initial login layer on 
the 2100, and has an extensive command list.

I've copied all of the fxos definitions in rancid.types.base to fxos-ftd 
and updated router.db for my 2100/FTD devices.  I removed the fxos entries 
that don't run on the 4100 and re-ordered the commands.  I have a working 
configuration for the 4140, though none of the output from "show 
running-config" is getting picked up.  Maybe using WriteTermFTD isn't 
right for that.

fxos;command;fxos::RunCommand;term len 0
fxos;command;fxos::RunCommand;connect fxos; prompt changes
fxos;command;fxos::ShowInventory;show inventory
fxos;command;fxos::WriteTermFTD;show running-config
fxos;command;fxos::RunCommand;exit; prompt changes
fxos;command;fxos::ShowFirmware;show system firmware detail
fxos;command;fxos::ShowChassis;show chassis detail
fxos;command;fxos::ShowChassis;show chassis inventory detail
fxos;command;fxos::ShowChassis;show chassis environment expand detail
fxos;command;fxos::WriteTerm;show configuration




-Chris


From cgauthier at comscore.com  Mon Feb 11 15:14:28 2019
From: cgauthier at comscore.com (Gauthier, Chris)
Date: Mon, 11 Feb 2019 15:14:28 +0000
Subject: [rancid] FXOS on FirePower 4140
In-Reply-To: <alpine.DEB.2.20.1902081230590.30063@potato.noc.ucla.edu>
References: <alpine.DEB.2.20.1902081101550.3845@potato.noc.ucla.edu>
 <60f72fd1-7dbb-b346-c155-789303b34869@buh.org>
 <alpine.DEB.2.20.1902081230590.30063@potato.noc.ucla.edu>
Message-ID: <BFA594F9-D94D-4AD2-91C2-201FDCAC268B@comscore.com>

We have a FirePower 2110 and it is architected differently than the 4100's.  This Cisco blog post explains it well: https://blogs.cisco.com/perspectives/firepower-2100-the-architectural-need-to-know.  We are using the ASA mode on the 2110.  For SSH purposes, the IPs are different between FX-OS CLI and ASA CLI, so you do not have to use the "connect asa" CLI commands.  I don't know what the best method is, separate or not.  On the 2110, the FX-OS configuration is primarily setting up the ethernet interfaces (enable/disable, LACP).  Also, there is no "connect fxos" that I really saw, though we are also still just deploying this platform.

--Chris


?
Chris Gauthier Senior Network Engineer | Comscore
t +1 (503) 331-2704 | 
cgauthier at comscore.com
comscore.com
???This e-mail (including any attachments) may contain information that is private, confidential, or protected by attorney-client or other privilege. If you received this e-mail in error, please delete it from your system and notify sender.
-----Original Message-----
From: Rancid-discuss <rancid-discuss-bounces at shrubbery.net> on behalf of Chris Stromsoe <cbs at noc.ucla.edu>
Date: Friday, February 8, 2019 at 1:35 PM
To: Erik Muller <erikm at buh.org>
Cc: rancid list <rancid-discuss at shrubbery.net>
Subject: Re: [rancid] FXOS on FirePower 4140

On Fri, 8 Feb 2019, Erik Muller wrote:

> The current fxos module assumes FTD on a 2100 platform (and I'm 
> currently testing support for ASA on 2100).  My understanding is that 
> the 4100 and 9300 have a bit of a different architecture from the 2100, 
> but I've not touched those to be able to say how exactly they differ.
>
> It looks like the initial login layer on the 4100 must be different. 
> Is there any other "connect" option from either the initial login layer 
> or the fxos layer, where the actual firewall functions are exposed?

It looks like logging in to the 4100 drops you straight into fxos.

Options for connect are

fw# connect
   adapter     Mezzanine Adapter
   cimc        Cisco Integrated Management Controller
   fxos        Connect to FXOS CLI
   local-mgmt  Connect to Local Management CLI
   module      Security Module Console


The connect command is not available after running "connect fxos".  You 
have to "exit" to return to the initial layer.



> On a 2100 the first layer you connect to is the FTD application (similar to 
> legacy ASA platform), with a simple ">" prompt and a config syntax like:
>> show running-config
> : Serial Number: J..........
> : Hardware:   FPR-2130, 14854 MB RAM, CPU MIPS 1200 MHz, 1 CPU (12 cores)
> :
> NGFW Version 6.2.3.4
> !
> hostname firepower
> ...
> !
> interface Ethernet1/1
> nameif border1
> ...
>
> After that in the fxos layer, the config is more like the the UCS FI:
> > connect fxos
> Cisco Firepower Extensible Operating System (FX-OS) Software
> xxx-fw01# sho configuration
> scope org
>     enter bios-policy SRIOV
>         set acpi10-support-config acpi10-support platform-default
> ...


The login layers on the 4100 seems to be reversed when compared to the 
2100 with ftd.

The initial login layer on the 4100 resembles the 2100 after having run 
"connect fxos", and has a limited command list.

Running "connect fxos" on the 4100 resembles the initial login layer on 
the 2100, and has an extensive command list.

I've copied all of the fxos definitions in rancid.types.base to fxos-ftd 
and updated router.db for my 2100/FTD devices.  I removed the fxos entries 
that don't run on the 4100 and re-ordered the commands.  I have a working 
configuration for the 4140, though none of the output from "show 
running-config" is getting picked up.  Maybe using WriteTermFTD isn't 
right for that.

fxos;command;fxos::RunCommand;term len 0
fxos;command;fxos::RunCommand;connect fxos; prompt changes
fxos;command;fxos::ShowInventory;show inventory
fxos;command;fxos::WriteTermFTD;show running-config
fxos;command;fxos::RunCommand;exit; prompt changes
fxos;command;fxos::ShowFirmware;show system firmware detail
fxos;command;fxos::ShowChassis;show chassis detail
fxos;command;fxos::ShowChassis;show chassis inventory detail
fxos;command;fxos::ShowChassis;show chassis environment expand detail
fxos;command;fxos::WriteTerm;show configuration




-Chris

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss at shrubbery.net
https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.shrubbery.net%2fmailman%2flistinfo%2francid-discuss&c=E,1,Agg4564IheFG90UwbAiAvZo1BLU69Z103Kv4VMySZ9xUTsjcwcvBBjtDdFnki_6XviMgM65aIammA_v80clw10SrZ9ffw-PSCud_gVcZhZE,&typo=1

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190211/89083ef1/attachment.html>

From cra at wpi.edu  Tue Feb 12 23:56:31 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Tue, 12 Feb 2019 23:56:31 +0000
Subject: [rancid] Juniper SRX cluster {primary:nodeX},
 {secondary:nodeX} filtering
Message-ID: <20190212235629.h3kld66wddlr2kgw@angus.ind.wpi.edu>

I'm using the "juniper" type on RANCID 3.9 collecting from Juniper EX/QFX/MX devices and SRX clusters.  On the EX/QFX/MX devices the {master:N} and {backup:N} first line of the prompt (related to RE redundancy) is filtered out.  But on the SRX clusters, they use a different type of clustering compared with MX/EX, and the first line of the prompt there has {primary:node0}, {secondary:node1} etc.  Additionlly, it is possible for {linecard:X) to appear there for non-RE members of a EX/QFX Virtual Chassis.  For many years we've been using a local change to RANCID that filters out these with code such as:

       next if (/^\{(master|backup|primary|secondary)/);

I'd like to get this changed upstream so we no longer have to use our local customizations.  Would you consider a patch similar to below (applied everywhere master|backup is already filtered):

-       next if (/^\{(master|backup)(:\d+)?\}/);
+       next if (/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);

I've attached the entire patch against 3.9 which I've tested with all my EX/QFX/MX/SRX devices.  Thanks.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: rancid-3.9-junos-linecard-primary-secondary-node.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190212/94af7dc1/attachment.ksh>

From cra at wpi.edu  Wed Feb 13 02:23:16 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Wed, 13 Feb 2019 02:23:16 +0000
Subject: [rancid] Juniper SRX cluster {primary:nodeX},
 {secondary:nodeX} filtering
In-Reply-To: <20190212235629.h3kld66wddlr2kgw@angus.ind.wpi.edu>
References: <20190212235629.h3kld66wddlr2kgw@angus.ind.wpi.edu>
Message-ID: <20190213022314.ujbxfi5px6zwrjsp@angus.ind.wpi.edu>

The ShowSystemCoreDumps function was missing this filter.  I updated the patch to add this.

On Tue, Feb 12, 2019 at 11:56:31PM +0000, Anderson, Charles R wrote:
> I'm using the "juniper" type on RANCID 3.9 collecting from Juniper EX/QFX/MX devices and SRX clusters.  On the EX/QFX/MX devices the {master:N} and {backup:N} first line of the prompt (related to RE redundancy) is filtered out.  But on the SRX clusters, they use a different type of clustering compared with MX/EX, and the first line of the prompt there has {primary:node0}, {secondary:node1} etc.  Additionlly, it is possible for {linecard:X) to appear there for non-RE members of a EX/QFX Virtual Chassis.  For many years we've been using a local change to RANCID that filters out these with code such as:
> 
>        next if (/^\{(master|backup|primary|secondary)/);
> 
> I'd like to get this changed upstream so we no longer have to use our local customizations.  Would you consider a patch similar to below (applied everywhere master|backup is already filtered):
> 
> -       next if (/^\{(master|backup)(:\d+)?\}/);
> +       next if (/^\{(master|backup|linecard|primary|secondary)(:(node)?\d+)?\}/);
> 
> I've attached the entire patch against 3.9 which I've tested with all my EX/QFX/MX/SRX devices.  Thanks.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: rancid-3.9-junos-linecard-primary-secondary-node.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190213/cb3d1933/attachment.ksh>

From ufaro186102 at gmail.com  Fri Feb 15 15:14:39 2019
From: ufaro186102 at gmail.com (Umar Farooq)
Date: Fri, 15 Feb 2019 10:14:39 -0500
Subject: [rancid] Device PacketShaper
Message-ID: <CAOj4tF_3gW3Z8byoK50Z_ws5LU2-czkh3+OyPTfK8jTcvYeH5Q@mail.gmail.com>

Hello,

I am trying to add my device packetshaper in rancid router.db. I am not
sure which device name should I use for it.

For example if it is a cisco device then
Router01.example.com;cisco;up
works fine but with packetshaper I tried
Router02.example.com;packetshaper;up
However, this does not work.

Please if you could guide me I would truly appreciate it.

Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190215/cc46ee17/attachment.html>

From cra at wpi.edu  Sun Feb 17 22:04:33 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Sun, 17 Feb 2019 22:04:33 +0000
Subject: [rancid] Device PacketShaper
In-Reply-To: <CAOj4tF_3gW3Z8byoK50Z_ws5LU2-czkh3+OyPTfK8jTcvYeH5Q@mail.gmail.com>
References: <CAOj4tF_3gW3Z8byoK50Z_ws5LU2-czkh3+OyPTfK8jTcvYeH5Q@mail.gmail.com>
Message-ID: <20190217220431.mum4gycdmfsbbhuz@angus.ind.wpi.edu>

Who manufactured your packetshaper?

On Fri, Feb 15, 2019 at 10:14:39AM -0500, Umar Farooq wrote:
> Hello,
> 
> I am trying to add my device packetshaper in rancid router.db. I am not
> sure which device name should I use for it.
> 
> For example if it is a cisco device then
> Router01.example.com;cisco;up
> works fine but with packetshaper I tried
> Router02.example.com;packetshaper;up
> However, this does not work.
> 
> Please if you could guide me I would truly appreciate it.
> 
> Thank you


From cra at wpi.edu  Mon Feb 18 17:58:52 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Mon, 18 Feb 2019 17:58:52 +0000
Subject: [rancid] Device PacketShaper
Message-ID: <20190218175850.vch2y72zp4zfehok@angus.ind.wpi.edu>

Let's please keep the discussion on-list so that others may participate.  Thanks.

I believe Blue Coat packetshapers were an acquisition from Packeteer.  I do not think RANCID supports them out of the box, but you may have luck searching for "rancid packeteer" instead of "rancid bluecoat" to see if someone else has gotten them to work.

https://www.google.com/search?client=firefox-b-1-d&q=rancid+packeteer

http://www.shrubbery.net/rancid/search.cgi

It seems there was discussion on this very list in 2004 and 2007:

http://www.shrubbery.net/pipermail/rancid-discuss/2004-May/000783.html

----- Forwarded message from Umar Farooq <ufaro186102 at gmail.com> -----

Date: Mon, 18 Feb 2019 09:25:23 -0500
From: Umar Farooq <ufaro186102 at gmail.com>
To: "Anderson, Charles R" <cra at wpi.edu>
Subject: Re: [rancid] Device PacketShaper
Return-Path: ufaro186102 at gmail.com

Hello Charles R,

Blue Coat

On Sun, Feb 17, 2019 at 5:04 PM Anderson, Charles R <cra at wpi.edu> wrote:

> Who manufactured your packetshaper?
>
> On Fri, Feb 15, 2019 at 10:14:39AM -0500, Umar Farooq wrote:
> > Hello,
> >
> > I am trying to add my device packetshaper in rancid router.db. I am not
> > sure which device name should I use for it.
> >
> > For example if it is a cisco device then
> > Router01.example.com;cisco;up
> > works fine but with packetshaper I tried
> > Router02.example.com;packetshaper;up
> > However, this does not work.
> >
> > Please if you could guide me I would truly appreciate it.
> >
> > Thank you


From cra at wpi.edu  Mon Feb 18 18:20:20 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Mon, 18 Feb 2019 18:20:20 +0000
Subject: [rancid] [PATCH] escape double quotes in command string
Message-ID: <20190218182017.m5koolzkllwp5fqk@angus.ind.wpi.edu>

I'd like to add some custom Junos commands in rancid.types.conf such as:

wpi-juniper;command;junos::ShowChassisHardware;show lldp neighbors | match "^Local | ae[0-9]+ "
wpi-juniper;command;junos::ShowChassisHardware;show system commit | except ^rescue | trim 4 | except "by apipush via"

These are rather WPI-specific, filtering output based on local conventions, so they are not suitable for distribution with upstream
RANCID (although the "show system commit | except ^rescue | trim 4" part could be worthy of upstream inclusion--it shows the commit messages people gave when they changed the config--but the rollback numbers rotate and need to be trimmed out, hence the "| trim 4" part).  By doing filtering in the Junos CLI, it allows local customizations without the need to write a new RANCID module to filter the output.  This works fine except for the " double quote characters, which mess up when passed to system() and open() calls.  The attached patch escapes these double quotes before passing the command to the system() or open().  The \" escaping cannot be done in rancid.types.conf because it will cause problems with the command name not matching the CLI output.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: rancid-3.9-escape-doublequotes-in-commandstr.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190218/09d8b337/attachment.ksh>

From cra at wpi.edu  Tue Feb 19 14:49:45 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Tue, 19 Feb 2019 14:49:45 +0000
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
Message-ID: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>

One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:

  # Temp  FPC 0 GEPHY1                   OK
  #       FPC 0 GEPHY2                   OK
  #       FPC 0 GEPHY3                   OK
- #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
+ #       FPC 0 GEPHY4                   OK
  #

The attached patch fixes ShowChassisEnvironment so it matches the - sign.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: rancid-3.9-junos-negative-temperature.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190219/e91da4db/attachment.ksh>

From erikm at buh.org  Wed Feb 20 03:43:09 2019
From: erikm at buh.org (Erik Muller)
Date: Tue, 19 Feb 2019 19:43:09 -0800
Subject: [rancid] [PATCH] ignore ASA log files in ShowFlash
Message-ID: <935a7164-b24e-f7e5-98a7-cf3d057bc3c1@buh.org>

With ASA 9.8 running on FTD2100s, there are a bunch of log files included in "show flash" that are regularly appended and archived, which makes for a lot of noise in diffs. 
- !Flash: 537549601  38345       Feb 14 2019 22:54:53  log/ssp_tz/ssp_tz.log.4.gz
- !Flash: 537549599  38703       Feb 13 2019 17:30:00  log/ssp_tz/ssp_tz.log.5.gz
+ !Flash: 537549601  38345       Feb 14 2019 22:54:53  log/ssp_tz/ssp_tz.log.5.gz
+ !Flash: 537549611  38412       Feb 16 2019 04:24:48  log/ssp_tz/ssp_tz.log.4.gz
...
- !Flash: 268440067  81510       Feb 19 2019 15:38:53  log/ssp_ntpd/ssp_ntp.log
+ !Flash: 268440067  87698       Feb 19 2019 23:38:39  log/ssp_ntpd/ssp_ntp.log


The attached patch adds them to the list of files where properties should be ignored, giving a nice stable output.

thanks,
-e

-------------- next part --------------
--- ios.pm.orig	2019-02-19 16:48:24.000000000 -0800
+++ ios.pm	2019-02-19 17:30:37.000000000 -0800
@@ -996,12 +996,15 @@
 	    next;
 
 	if (/(dhcp_[^. ]*\.txt|vlan\.dat|sflog|snooping)/ ||
-		 /(smart-log\/agentlog|syslog)\s*$/) {
-	    # filter frequently changing files (dhcp & vlan database) from flash
+		 /(smart-log\/agentlog|syslog)\s*$/ ||
+		 /(log\/(?:ssp_tz\/)?[^. ]+\.log(?:\.[0-9]+\.gz)?)\s*$/) {
+	    # filter frequently changing files (dhcp & vlan database, logs) from flash
 	    # change from:
+	    # 537549598  38354       Feb 19 2019 20:59:32  log/ssp_tz/ssp_tz.log.1.gz
 	    # 9          660 Jan 15 2011 20:43:54 vlan.dat
 	    # 9          660 Jan 15 2011 20:43:54 +00:00 vlan.dat
 	    # to:
+	    #                                              log/ssp_tz/ssp_tz.log.1.gz
 	    #                                     vlan.dat
 	    #                                            vlan.dat
 	    if (/(\s*\d+)(\s+[-rwx]+\s+)(\d+)(\s+)(\w+ \d+\s+\d+ \d+:\d+:\d+ .\d+:\d+)/) {

From emille at abccommunications.com  Wed Feb 20 16:54:39 2019
From: emille at abccommunications.com (Emille Blanc)
Date: Wed, 20 Feb 2019 08:54:39 -0800
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
Message-ID: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>

Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.

However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
I've attached a patch to cover this circumstance.

  # Class Item                           Status
  # Power FPC 0 Power Supply 0           OK        
  # Temp  FPC 0 GEPHY1                   OK        
- #       FPC 0 GEPHY2                   OK         N/A
+ #       FPC 0 GEPHY2                   OK        
  #       FPC 0 GEPHY3                   OK        
  #       FPC 0 GEPHY4                   OK        
  # 

-----Original Message-----
From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
Sent: Tuesday, February 19, 2019 6:50 AM
To: rancid-discuss at shrubbery.net
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment

One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:

  # Temp  FPC 0 GEPHY1                   OK
  #       FPC 0 GEPHY2                   OK
  #       FPC 0 GEPHY3                   OK
- #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
+ #       FPC 0 GEPHY4                   OK
  #

The attached patch fixes ShowChassisEnvironment so it matches the - sign.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: junos.pm.na.patch
Type: application/octet-stream
Size: 594 bytes
Desc: junos.pm.na.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190220/bd6ace06/attachment.obj>

From cra at wpi.edu  Wed Feb 20 17:20:09 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Wed, 20 Feb 2019 17:20:09 +0000
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
Message-ID: <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>

My example below WAS from an EX2200.  We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure?  I have also seen N/A in 2016, but not lately.  What software version are you running?  We are running 12.3R12-S2 on this particular outdoor EX2200.  I can try to find out what version we were running in 2016 when we last saw N/A.  I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.

On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote:
> Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
> Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.
> 
> However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
> I've attached a patch to cover this circumstance.
> 
>   # Class Item                           Status
>   # Power FPC 0 Power Supply 0           OK        
>   # Temp  FPC 0 GEPHY1                   OK        
> - #       FPC 0 GEPHY2                   OK         N/A
> + #       FPC 0 GEPHY2                   OK        
>   #       FPC 0 GEPHY3                   OK        
>   #       FPC 0 GEPHY4                   OK        
>   # 
> 
> -----Original Message-----
> From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> Sent: Tuesday, February 19, 2019 6:50 AM
> To: rancid-discuss at shrubbery.net
> Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> 
> One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:
> 
>   # Temp  FPC 0 GEPHY1                   OK
>   #       FPC 0 GEPHY2                   OK
>   #       FPC 0 GEPHY3                   OK
> - #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
> + #       FPC 0 GEPHY4                   OK
>   #
> 
> The attached patch fixes ShowChassisEnvironment so it matches the - sign.


From emille at abccommunications.com  Wed Feb 20 17:35:38 2019
From: emille at abccommunications.com (Emille Blanc)
Date: Wed, 20 Feb 2019 09:35:38 -0800
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
 <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>
Message-ID: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0135@exchange>

These are all from an EX2200-C-12T-2G's, running 12.3R12.4
We're stuck at that release for the 2200-C's, as 15.x bricks them in our environment (TSB17138 does warn to not use 15.x).

> I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.

Correct - last I dug into this, it only reports N/A at 0 (zero), and -1 degrees. It always struck me as an odd cosmetic.

-----Original Message-----
From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
Sent: Wednesday, February 20, 2019 9:20 AM
To: rancid-discuss at shrubbery.net
Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment

My example below WAS from an EX2200.  We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure?  I have also seen N/A in 2016, but not lately.  What software version are you running?  We are running 12.3R12-S2 on this particular outdoor EX2200.  I can try to find out what version we were running in 2016 when we last saw N/A.  I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.

On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote:
> Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
> Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.
> 
> However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
> I've attached a patch to cover this circumstance.
> 
>   # Class Item                           Status
>   # Power FPC 0 Power Supply 0           OK        
>   # Temp  FPC 0 GEPHY1                   OK        
> - #       FPC 0 GEPHY2                   OK         N/A
> + #       FPC 0 GEPHY2                   OK        
>   #       FPC 0 GEPHY3                   OK        
>   #       FPC 0 GEPHY4                   OK        
>   # 
> 
> -----Original Message-----
> From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> Sent: Tuesday, February 19, 2019 6:50 AM
> To: rancid-discuss at shrubbery.net
> Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> 
> One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:
> 
>   # Temp  FPC 0 GEPHY1                   OK
>   #       FPC 0 GEPHY2                   OK
>   #       FPC 0 GEPHY3                   OK
> - #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
> + #       FPC 0 GEPHY4                   OK
>   #
> 
> The attached patch fixes ShowChassisEnvironment so it matches the - sign.

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss at shrubbery.net
http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From adudek16 at gmail.com  Wed Feb 20 17:55:32 2019
From: adudek16 at gmail.com (Aaron Dudek)
Date: Wed, 20 Feb 2019 12:55:32 -0500
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0135@exchange>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
 <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0135@exchange>
Message-ID: <CAA0LXWXDS5T2madWe9gBP6FrjCzN-LZt=s4hk-4608C5RHkxgg@mail.gmail.com>

so -2 or lower works?

On Wed, Feb 20, 2019 at 12:37 PM Emille Blanc
<emille at abccommunications.com> wrote:
>
> These are all from an EX2200-C-12T-2G's, running 12.3R12.4
> We're stuck at that release for the 2200-C's, as 15.x bricks them in our environment (TSB17138 does warn to not use 15.x).
>
> > I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
>
> Correct - last I dug into this, it only reports N/A at 0 (zero), and -1 degrees. It always struck me as an odd cosmetic.
>
> -----Original Message-----
> From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> Sent: Wednesday, February 20, 2019 9:20 AM
> To: rancid-discuss at shrubbery.net
> Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
>
> My example below WAS from an EX2200.  We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure?  I have also seen N/A in 2016, but not lately.  What software version are you running?  We are running 12.3R12-S2 on this particular outdoor EX2200.  I can try to find out what version we were running in 2016 when we last saw N/A.  I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
>
> On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote:
> > Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
> > Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.
> >
> > However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
> > I've attached a patch to cover this circumstance.
> >
> >   # Class Item                           Status
> >   # Power FPC 0 Power Supply 0           OK
> >   # Temp  FPC 0 GEPHY1                   OK
> > - #       FPC 0 GEPHY2                   OK         N/A
> > + #       FPC 0 GEPHY2                   OK
> >   #       FPC 0 GEPHY3                   OK
> >   #       FPC 0 GEPHY4                   OK
> >   #
> >
> > -----Original Message-----
> > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > Sent: Tuesday, February 19, 2019 6:50 AM
> > To: rancid-discuss at shrubbery.net
> > Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> >
> > One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:
> >
> >   # Temp  FPC 0 GEPHY1                   OK
> >   #       FPC 0 GEPHY2                   OK
> >   #       FPC 0 GEPHY3                   OK
> > - #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
> > + #       FPC 0 GEPHY4                   OK
> >   #
> >
> > The attached patch fixes ShowChassisEnvironment so it matches the - sign.
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From emille at abccommunications.com  Wed Feb 20 18:05:16 2019
From: emille at abccommunications.com (Emille Blanc)
Date: Wed, 20 Feb 2019 10:05:16 -0800
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <CAA0LXWXDS5T2madWe9gBP6FrjCzN-LZt=s4hk-4608C5RHkxgg@mail.gmail.com>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
 <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0135@exchange>
 <CAA0LXWXDS5T2madWe9gBP6FrjCzN-LZt=s4hk-4608C5RHkxgg@mail.gmail.com>
Message-ID: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D014E@exchange>

I'm fairly certain -2 and below does work - but can't find evidence to support that presently.
I'll fire off a search in my outlook archive to grind away over lunch to confirm.

-----Original Message-----
From: Aaron Dudek [mailto:adudek16 at gmail.com] 
Sent: Wednesday, February 20, 2019 9:56 AM
To: Emille Blanc
Cc: Anderson, Charles R; rancid-discuss at shrubbery.net
Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment

so -2 or lower works?

On Wed, Feb 20, 2019 at 12:37 PM Emille Blanc
<emille at abccommunications.com> wrote:
>
> These are all from an EX2200-C-12T-2G's, running 12.3R12.4
> We're stuck at that release for the 2200-C's, as 15.x bricks them in our environment (TSB17138 does warn to not use 15.x).
>
> > I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
>
> Correct - last I dug into this, it only reports N/A at 0 (zero), and -1 degrees. It always struck me as an odd cosmetic.
>
> -----Original Message-----
> From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> Sent: Wednesday, February 20, 2019 9:20 AM
> To: rancid-discuss at shrubbery.net
> Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
>
> My example below WAS from an EX2200.  We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure?  I have also seen N/A in 2016, but not lately.  What software version are you running?  We are running 12.3R12-S2 on this particular outdoor EX2200.  I can try to find out what version we were running in 2016 when we last saw N/A.  I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
>
> On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote:
> > Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
> > Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.
> >
> > However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
> > I've attached a patch to cover this circumstance.
> >
> >   # Class Item                           Status
> >   # Power FPC 0 Power Supply 0           OK
> >   # Temp  FPC 0 GEPHY1                   OK
> > - #       FPC 0 GEPHY2                   OK         N/A
> > + #       FPC 0 GEPHY2                   OK
> >   #       FPC 0 GEPHY3                   OK
> >   #       FPC 0 GEPHY4                   OK
> >   #
> >
> > -----Original Message-----
> > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > Sent: Tuesday, February 19, 2019 6:50 AM
> > To: rancid-discuss at shrubbery.net
> > Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> >
> > One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:
> >
> >   # Temp  FPC 0 GEPHY1                   OK
> >   #       FPC 0 GEPHY2                   OK
> >   #       FPC 0 GEPHY3                   OK
> > - #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
> > + #       FPC 0 GEPHY4                   OK
> >   #
> >
> > The attached patch fixes ShowChassisEnvironment so it matches the - sign.
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From heas at shrubbery.net  Wed Feb 20 18:51:52 2019
From: heas at shrubbery.net (heasley)
Date: Wed, 20 Feb 2019 18:51:52 +0000
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D014E@exchange>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
 <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0135@exchange>
 <CAA0LXWXDS5T2madWe9gBP6FrjCzN-LZt=s4hk-4608C5RHkxgg@mail.gmail.com>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D014E@exchange>
Message-ID: <20190220185152.GB2888@shrubbery.net>

Wed, Feb 20, 2019 at 10:05:16AM -0800, Emille Blanc:
> I'm fairly certain -2 and below does work - but can't find evidence to support that presently.
> I'll fire off a search in my outlook archive to grind away over lunch to confirm.

beause its treating a signed interger as unsighned...and -1 = fire?

i'm more inclined to take Anderson's patch; drop any temps.  rancid does not
make for a good monitoring tool of things such as temps.  can you not use a
secondary NMS to cover the data points that the primary is incapable of?

> -----Original Message-----
> From: Aaron Dudek [mailto:adudek16 at gmail.com] 
> Sent: Wednesday, February 20, 2019 9:56 AM
> To: Emille Blanc
> Cc: Anderson, Charles R; rancid-discuss at shrubbery.net
> Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> 
> so -2 or lower works?
> 
> On Wed, Feb 20, 2019 at 12:37 PM Emille Blanc
> <emille at abccommunications.com> wrote:
> >
> > These are all from an EX2200-C-12T-2G's, running 12.3R12.4
> > We're stuck at that release for the 2200-C's, as 15.x bricks them in our environment (TSB17138 does warn to not use 15.x).
> >
> > > I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
> >
> > Correct - last I dug into this, it only reports N/A at 0 (zero), and -1 degrees. It always struck me as an odd cosmetic.
> >
> > -----Original Message-----
> > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > Sent: Wednesday, February 20, 2019 9:20 AM
> > To: rancid-discuss at shrubbery.net
> > Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> >
> > My example below WAS from an EX2200.  We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure?  I have also seen N/A in 2016, but not lately.  What software version are you running?  We are running 12.3R12-S2 on this particular outdoor EX2200.  I can try to find out what version we were running in 2016 when we last saw N/A.  I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
> >
> > On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote:
> > > Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
> > > Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.
> > >
> > > However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
> > > I've attached a patch to cover this circumstance.
> > >
> > >   # Class Item                           Status
> > >   # Power FPC 0 Power Supply 0           OK
> > >   # Temp  FPC 0 GEPHY1                   OK
> > > - #       FPC 0 GEPHY2                   OK         N/A
> > > + #       FPC 0 GEPHY2                   OK
> > >   #       FPC 0 GEPHY3                   OK
> > >   #       FPC 0 GEPHY4                   OK
> > >   #
> > >
> > > -----Original Message-----
> > > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > > Sent: Tuesday, February 19, 2019 6:50 AM
> > > To: rancid-discuss at shrubbery.net
> > > Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> > >
> > > One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:
> > >
> > >   # Temp  FPC 0 GEPHY1                   OK
> > >   #       FPC 0 GEPHY2                   OK
> > >   #       FPC 0 GEPHY3                   OK
> > > - #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
> > > + #       FPC 0 GEPHY4                   OK
> > >   #
> > >
> > > The attached patch fixes ShowChassisEnvironment so it matches the - sign.
> >
> > _______________________________________________
> > Rancid-discuss mailing list
> > Rancid-discuss at shrubbery.net
> > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> >
> > _______________________________________________
> > Rancid-discuss mailing list
> > Rancid-discuss at shrubbery.net
> > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> 
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From emille at abccommunications.com  Wed Feb 20 18:55:51 2019
From: emille at abccommunications.com (Emille Blanc)
Date: Wed, 20 Feb 2019 10:55:51 -0800
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <20190220185152.GB2888@shrubbery.net>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
 <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0135@exchange>
 <CAA0LXWXDS5T2madWe9gBP6FrjCzN-LZt=s4hk-4608C5RHkxgg@mail.gmail.com>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D014E@exchange>
 <20190220185152.GB2888@shrubbery.net>
Message-ID: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0177@exchange>

Oh, I have no problem with Charles' patch.  I just wanted to point out that in our environment we see "N/A" for some devices, so wanted to add that in.

We just never bothered to patch either circumstance on our side, as it's rather convenient.

We are long overdue for a better NMS, but time...

-----Original Message-----
From: heasley [mailto:heas at shrubbery.net] 
Sent: Wednesday, February 20, 2019 10:52 AM
To: Emille Blanc
Cc: Aaron Dudek; rancid-discuss at shrubbery.net
Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment

Wed, Feb 20, 2019 at 10:05:16AM -0800, Emille Blanc:
> I'm fairly certain -2 and below does work - but can't find evidence to support that presently.
> I'll fire off a search in my outlook archive to grind away over lunch to confirm.

beause its treating a signed interger as unsighned...and -1 = fire?

i'm more inclined to take Anderson's patch; drop any temps.  rancid does not
make for a good monitoring tool of things such as temps.  can you not use a
secondary NMS to cover the data points that the primary is incapable of?

> -----Original Message-----
> From: Aaron Dudek [mailto:adudek16 at gmail.com] 
> Sent: Wednesday, February 20, 2019 9:56 AM
> To: Emille Blanc
> Cc: Anderson, Charles R; rancid-discuss at shrubbery.net
> Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> 
> so -2 or lower works?
> 
> On Wed, Feb 20, 2019 at 12:37 PM Emille Blanc
> <emille at abccommunications.com> wrote:
> >
> > These are all from an EX2200-C-12T-2G's, running 12.3R12.4
> > We're stuck at that release for the 2200-C's, as 15.x bricks them in our environment (TSB17138 does warn to not use 15.x).
> >
> > > I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
> >
> > Correct - last I dug into this, it only reports N/A at 0 (zero), and -1 degrees. It always struck me as an odd cosmetic.
> >
> > -----Original Message-----
> > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > Sent: Wednesday, February 20, 2019 9:20 AM
> > To: rancid-discuss at shrubbery.net
> > Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> >
> > My example below WAS from an EX2200.  We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure?  I have also seen N/A in 2016, but not lately.  What software version are you running?  We are running 12.3R12-S2 on this particular outdoor EX2200.  I can try to find out what version we were running in 2016 when we last saw N/A.  I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
> >
> > On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote:
> > > Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
> > > Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.
> > >
> > > However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
> > > I've attached a patch to cover this circumstance.
> > >
> > >   # Class Item                           Status
> > >   # Power FPC 0 Power Supply 0           OK
> > >   # Temp  FPC 0 GEPHY1                   OK
> > > - #       FPC 0 GEPHY2                   OK         N/A
> > > + #       FPC 0 GEPHY2                   OK
> > >   #       FPC 0 GEPHY3                   OK
> > >   #       FPC 0 GEPHY4                   OK
> > >   #
> > >
> > > -----Original Message-----
> > > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > > Sent: Tuesday, February 19, 2019 6:50 AM
> > > To: rancid-discuss at shrubbery.net
> > > Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> > >
> > > One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:
> > >
> > >   # Temp  FPC 0 GEPHY1                   OK
> > >   #       FPC 0 GEPHY2                   OK
> > >   #       FPC 0 GEPHY3                   OK
> > > - #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
> > > + #       FPC 0 GEPHY4                   OK
> > >   #
> > >
> > > The attached patch fixes ShowChassisEnvironment so it matches the - sign.
> >
> > _______________________________________________
> > Rancid-discuss mailing list
> > Rancid-discuss at shrubbery.net
> > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> >
> > _______________________________________________
> > Rancid-discuss mailing list
> > Rancid-discuss at shrubbery.net
> > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> 
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From cra at wpi.edu  Wed Feb 20 19:40:34 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Wed, 20 Feb 2019 19:40:34 +0000
Subject: [rancid] [PATCH] panos.pm: filter secrets
Message-ID: <20190220194031.d5bt3hfcoq6cd7f6@angus.ind.wpi.edu>

The attached patch filters out snmp-community-string and all "key " values (encryption/authentication keys for OSPF and other protocols, IPsec pre-shared-keys, etc.) in PanOS/Panorama configs and fixes the initial comment line to begin with # like all the other comments.

Result:

- !RANCID-CONTENT-TYPE: paloalto
+ #RANCID-CONTENT-TYPE: paloalto

-                             snmp-community-string XXXXXXXX;
+ #                            snmp-community-string <removed>;

-                                   key XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX;
+ #                                  key <removed>;
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: rancid-3.9-panos-filter-secrets.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190220/04aff400/attachment.ksh>

From cra at wpi.edu  Wed Feb 20 19:47:53 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Wed, 20 Feb 2019 19:47:53 +0000
Subject: [rancid] [PATCH] Ciena Waveserver wavesvros.pm: fix filtering user
 passwords
Message-ID: <20190220194752.hkiznhajljwqt5f4@angus.ind.wpi.edu>

The attached patch for Ciena Waveserver devices fixes the filter for user passwords to also filter the "user set" command not just "user create" and also fixes the spacing before the <removed> secret.

Result:

- !user create user rancid access-level limited secret<removed>
- user set user su access-level super secret $6$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ !user create user rancid access-level limited secret <removed>
+ !user set user su access-level super secret <removed>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: rancid-3.9-wavesvros-filter-secrets.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190220/4e760319/attachment.ksh>

From nick.nauwelaerts at aquafin.be  Thu Feb 21 11:48:34 2019
From: nick.nauwelaerts at aquafin.be (Nick Nauwelaerts)
Date: Thu, 21 Feb 2019 11:48:34 +0000
Subject: [rancid] rancid 3.9 aerohive/hiveos support
Message-ID: <08c8a6b0ea774e388f917792531c6b71@aquafin.be>

hello all,
rancid aerohive/hiveos support has been updated to track rancid 3.9. from now on i will track rancid releases for this instead of rancid svn. for support specific to hiveos/aerohive access points please email me directly or open a github issue. the code is documented and rancid docs have also been updated wherever needed for aerohive. this is not yet merged back into mainline rancid.

(aerohive switches are dell oem's iirc. the code here is for aerohive access points running hiveos only)

if you would like to see this back in mainline rancid please report to this mailinglist with success or failure stories.

https://github.com/inphobia/rancid-aerohive-support

a tarball is available on github for the rancid 3.9 release + aerohive/hiveos support under "releases" but i will not link to it directly so people don't get confused what the official release/download link is.

thx for any feedback.

// nick





________________________________

Volg Aquafin op Facebook<https://www.facebook.com/AquafinNV> | Twitter<https://twitter.com/aquafinnv> | YouTube<http://www.youtube.com/channel/UCk_4P5BJ-MtEEDCkCsR_KqQ?feature=mhee> | LinkedIN<http://www.linkedin.com/company/aquafin/products>

In het kader van de uitoefening van onze taken verzamelen we bij Aquafin persoonsgegevens. Hoe we omgaan met deze gegevens en wat de rechten van de betrokkenen zijn, kan je nalezen in onze privacy policy<https://www.aquafin.be/nl-be/privacy-policy>.

  P Denk aan het milieu. Druk deze mail niet onnodig af.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190221/d58ddd3a/attachment.html>

From mayoye at seacom.mu  Thu Feb 21 14:03:34 2019
From: mayoye at seacom.mu (Simon Mayoye)
Date: Thu, 21 Feb 2019 14:03:34 +0000
Subject: [rancid] RANCID-2 to RANCID-3 upgrade
Message-ID: <1550757814744.61227@seacom.mu>

Hi All,

Just checking for support on an issue encountered after upgrading from RANCID-2 to RANCID-3. The version being run is 3.7, and unlike version 2.X, the config change notifications on devices do not show the name of the user that made the changes. Any library that could be missing?


Regards,

Simon



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190221/1c567ba1/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RSImage.png
Type: image/png
Size: 28920 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190221/1c567ba1/attachment.png>

From cra at wpi.edu  Thu Feb 21 18:53:07 2019
From: cra at wpi.edu (Anderson, Charles R)
Date: Thu, 21 Feb 2019 18:53:07 +0000
Subject: [rancid] [PATCH] Nortel/Avaya BayStack/ERS support
Message-ID: <20190221185305.stwkzag5zzeizhyc@angus.ind.wpi.edu>

The attached files add support for Bay Networks/Nortel/Avaya BayStack/BPS/ERS switches.  I based these changes on ones we've been running in production for over a decade and I've tested this extensively on models BPS 2000, 470, and ERS 25xx/45xx/55xx/56xx.

Initially I copied clogin to bslogin, but I've attached a diff from the original clogin because I believe it should be safe to apply to the original and eliminate the need for a separate login script.  I rearranged a few conditionals related to Extreme support to make the logic easier for the BayStack and other future differences.  

It was a PITA to get past the BayStack login banner, but I finally found a workable solution that should hopefully not interfere with other device types and should support BayStacks that have the stock banner, a custom banner, or the banner turned off.  The only potential concern for impact to non-BayStack devices is the matching on "##+" used to skip past the banner to avoid it being interpreted as a "#" prompt character.  I'm now running this in production as my "clogin" and so far there have been no impacts to Aruba devices, the only other devices I have that use clogin.

rancid.types.conf entry:

# Nortel BayStack
baystack;script;rancid -t baystack
baystack;login;clogin
baystack;module;baystack
baystack;inloop;baystack::inloop
baystack;command;baystack::ShowSysInfo;show sys-info
baystack;command;baystack::ShowSysInfo;show stack-info
baystack;command;baystack::ShowSysInfo;show system verbose
baystack;command;baystack::ShowSysInfo;show interfaces gbic-info
baystack;command;baystack::ShowConfig;show running-config
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: rancid-3.9-bslogin.patch
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190221/7ad8088a/attachment.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: baystack.pm
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20190221/7ad8088a/attachment-0001.ksh>

From heas at shrubbery.net  Mon Feb 25 23:05:04 2019
From: heas at shrubbery.net (heasley)
Date: Mon, 25 Feb 2019 23:05:04 +0000
Subject: [rancid] [PATCH] escape double quotes in command string
In-Reply-To: <20190218182017.m5koolzkllwp5fqk@angus.ind.wpi.edu>
References: <20190218182017.m5koolzkllwp5fqk@angus.ind.wpi.edu>
Message-ID: <20190225230504.GM78274@shrubbery.net>

Mon, Feb 18, 2019 at 06:20:20PM +0000, Anderson, Charles R:
> I'd like to add some custom Junos commands in rancid.types.conf such as:
> 
> wpi-juniper;command;junos::ShowChassisHardware;show lldp neighbors | match "^Local | ae[0-9]+ "
> wpi-juniper;command;junos::ShowChassisHardware;show system commit | except ^rescue | trim 4 | except "by apipush via"
> 
> These are rather WPI-specific, filtering output based on local conventions, so they are not suitable for distribution with upstream
> RANCID (although the "show system commit | except ^rescue | trim 4" part could be worthy of upstream inclusion--it shows the commit messages people gave when they changed the config--but the rollback numbers rotate and need to be trimmed out, hence the "| trim 4" part).  By doing filtering in the Junos CLI, it allows local customizations without the need to write a new RANCID module to filter the output.  This works fine except for the " double quote characters, which mess up when passed to system() and open() calls.  The attached patch escapes these double quotes before passing the command to the system() or open().  The \" escaping cannot be done in rancid.types.conf because it will cause problems with the command name not matching the CLI output.

Seems reasonable to me.  Thanks for the patch!

> --- rancid.orig	2019-02-06 02:03:28.000000000 -0500
> +++ rancid	2019-02-13 13:32:04.103689467 -0500
> @@ -116,12 +116,14 @@
>      print(STDERR "opening file $host\n") if ($debug || $log);
>      open(INPUT,"<$host") || die "open failed for $host: $!\n";
>  } else {
> -    print(STDERR "executing $lscript -t $timeo -c\"$commandstr\" $host\n") if ($debug || $log);
> +    my $cstr = $commandstr;
> +    $cstr =~ s/\"/\\\"/g;
> +    print(STDERR "executing $lscript -t $timeo -c\"$cstr\" $host\n") if ($debug || $log);
>      if (defined($ENV{NOPIPE}) && $ENV{NOPIPE} =~ /^YES/i) {
> -	system "$lscript -t $timeo -c \"$commandstr\" $host </dev/null > $host.raw 2>&1" || die "clogin failed for $host: $!\n";
> +	system "$lscript -t $timeo -c \"$cstr\" $host </dev/null > $host.raw 2>&1" || die "clogin failed for $host: $!\n";
>  	open(INPUT, "< $host.raw") || die "clogin failed for $host: $!\n";
>      } else {
> -	open(INPUT,"$lscript -t $timeo -c \"$commandstr\" $host </dev/null |") || die "clogin failed for $host: $!\n";
> +	open(INPUT,"$lscript -t $timeo -c \"$cstr\" $host </dev/null |") || die "clogin failed for $host: $!\n";
>      }
>  }
>  

> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From emille at abccommunications.com  Tue Feb 26 16:45:14 2019
From: emille at abccommunications.com (Emille Blanc)
Date: Tue, 26 Feb 2019 08:45:14 -0800
Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in
 ShowChassisEnvironment
In-Reply-To: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0177@exchange>
References: <20190219144943.xvkk6vwefom52ytr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D011E@exchange>
 <20190220172007.zmcprzqfikgcdizr@angus.ind.wpi.edu>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0135@exchange>
 <CAA0LXWXDS5T2madWe9gBP6FrjCzN-LZt=s4hk-4608C5RHkxgg@mail.gmail.com>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D014E@exchange>
 <20190220185152.GB2888@shrubbery.net>
 <4FBAFC2ECF5D6244BA4A26C1C94A1E2715254D0177@exchange>
Message-ID: <4FBAFC2ECF5D6244BA4A26C1C94A1E2715261C4A00@exchange>

It seems that I can't reproduce this behavior after moving to 12.3R12-S12
On that basis, I would say the 'N/A' patch I proposed is irrelevant;

Class Item                           Status     Measurement
Power FPC 0 Power Supply 0           OK
Temp  FPC 0 GEPHY1                   OK         0 degrees C / 32 degrees F
      FPC 0 GEPHY2                   OK         0 degrees C / 32 degrees F
      FPC 0 GEPHY3                   OK         0 degrees C / 32 degrees F
      FPC 0 GEPHY4                   OK         -1 degrees C / 30 degrees F

Sorry for the noise!

-----Original Message-----
From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Emille Blanc
Sent: Wednesday, February 20, 2019 10:56 AM
To: heasley
Cc: rancid-discuss at shrubbery.net
Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment

Oh, I have no problem with Charles' patch.  I just wanted to point out that in our environment we see "N/A" for some devices, so wanted to add that in.

We just never bothered to patch either circumstance on our side, as it's rather convenient.

We are long overdue for a better NMS, but time...

-----Original Message-----
From: heasley [mailto:heas at shrubbery.net] 
Sent: Wednesday, February 20, 2019 10:52 AM
To: Emille Blanc
Cc: Aaron Dudek; rancid-discuss at shrubbery.net
Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment

Wed, Feb 20, 2019 at 10:05:16AM -0800, Emille Blanc:
> I'm fairly certain -2 and below does work - but can't find evidence to support that presently.
> I'll fire off a search in my outlook archive to grind away over lunch to confirm.

beause its treating a signed interger as unsighned...and -1 = fire?

i'm more inclined to take Anderson's patch; drop any temps.  rancid does not
make for a good monitoring tool of things such as temps.  can you not use a
secondary NMS to cover the data points that the primary is incapable of?

> -----Original Message-----
> From: Aaron Dudek [mailto:adudek16 at gmail.com] 
> Sent: Wednesday, February 20, 2019 9:56 AM
> To: Emille Blanc
> Cc: Anderson, Charles R; rancid-discuss at shrubbery.net
> Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> 
> so -2 or lower works?
> 
> On Wed, Feb 20, 2019 at 12:37 PM Emille Blanc
> <emille at abccommunications.com> wrote:
> >
> > These are all from an EX2200-C-12T-2G's, running 12.3R12.4
> > We're stuck at that release for the 2200-C's, as 15.x bricks them in our environment (TSB17138 does warn to not use 15.x).
> >
> > > I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
> >
> > Correct - last I dug into this, it only reports N/A at 0 (zero), and -1 degrees. It always struck me as an odd cosmetic.
> >
> > -----Original Message-----
> > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > Sent: Wednesday, February 20, 2019 9:20 AM
> > To: rancid-discuss at shrubbery.net
> > Subject: Re: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> >
> > My example below WAS from an EX2200.  We have some others that always report -10 (even in toasty closets)--I wonder if that is off-scale low due to a sensor failure?  I have also seen N/A in 2016, but not lately.  What software version are you running?  We are running 12.3R12-S2 on this particular outdoor EX2200.  I can try to find out what version we were running in 2016 when we last saw N/A.  I just saw your comment in the patch that N/A only appeared for a temperature in the range -1 to 0.
> >
> > On Wed, Feb 20, 2019 at 08:54:39AM -0800, Emille Blanc wrote:
> > > Ironically, we rely on RANCID to tell us when our cabinets get too cold on such devices.
> > > Mostly because our NMS is hopeless, and can't do it (Enterprise! Closed source!), so it never occurred to me to submit a patch for this.
> > >
> > > However, some devices (namely, EX2200's) don't understand zero, or sub-zero degrees and report it as N/A.
> > > I've attached a patch to cover this circumstance.
> > >
> > >   # Class Item                           Status
> > >   # Power FPC 0 Power Supply 0           OK
> > >   # Temp  FPC 0 GEPHY1                   OK
> > > - #       FPC 0 GEPHY2                   OK         N/A
> > > + #       FPC 0 GEPHY2                   OK
> > >   #       FPC 0 GEPHY3                   OK
> > >   #       FPC 0 GEPHY4                   OK
> > >   #
> > >
> > > -----Original Message-----
> > > From: Rancid-discuss [mailto:rancid-discuss-bounces at shrubbery.net] On Behalf Of Anderson, Charles R
> > > Sent: Tuesday, February 19, 2019 6:50 AM
> > > To: rancid-discuss at shrubbery.net
> > > Subject: [rancid] [PATCH] junos.pm: filter negative temperatures in ShowChassisEnvironment
> > >
> > > One of our switches is in an outdoor cabinet.  It gets below 0 sometimes so we see output like this:
> > >
> > >   # Temp  FPC 0 GEPHY1                   OK
> > >   #       FPC 0 GEPHY2                   OK
> > >   #       FPC 0 GEPHY3                   OK
> > > - #       FPC 0 GEPHY4                   OK         -5 degrees C / 23 degrees F
> > > + #       FPC 0 GEPHY4                   OK
> > >   #
> > >
> > > The attached patch fixes ShowChassisEnvironment so it matches the - sign.
> >
> > _______________________________________________
> > Rancid-discuss mailing list
> > Rancid-discuss at shrubbery.net
> > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> >
> > _______________________________________________
> > Rancid-discuss mailing list
> > Rancid-discuss at shrubbery.net
> > http://www.shrubbery.net/mailman/listinfo/rancid-discuss
> 
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss at shrubbery.net
http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From pokui at psg.com  Wed Feb 27 13:53:13 2019
From: pokui at psg.com (Patrick Okui)
Date: Wed, 27 Feb 2019 16:53:13 +0300
Subject: [rancid] RANCID-2 to RANCID-3 upgrade
In-Reply-To: <1550757814744.61227@seacom.mu>
References: <1550757814744.61227@seacom.mu>
Message-ID: <D96A53A3-E0D5-4403-BBD0-44A3263AC6E4@psg.com>

Hi Simon, all,

On 21 Feb 2019, at 17:03 EAT, Simon Mayoye wrote:

> Hi All,
>
> Just checking for support on an issue encountered after upgrading from 
> RANCID-2 to RANCID-3. The version being run is 3.7, and unlike version 
> 2.X, the config change notifications on devices do not show the name 
> of the user that made the changes. Any library that could be missing?

You probably want to use tacacs for this rather than rely on the text 
inside rancid.

Rancid gets that data from devices (like cisco) who will say who last 
saved the config. So imagine user x saves config, user y saves more 
config, then rancid runs. The changes by both users x and y will be 
attributed to y.

With tacacs you can turn on per command accounting and probably stream 
that to centralised logging to make it more manageable.

--
patrick


From heas at shrubbery.net  Wed Feb 27 15:48:09 2019
From: heas at shrubbery.net (heasley)
Date: Wed, 27 Feb 2019 15:48:09 +0000
Subject: [rancid] rancid 3.9 aerohive/hiveos support
In-Reply-To: <08c8a6b0ea774e388f917792531c6b71@aquafin.be>
References: <08c8a6b0ea774e388f917792531c6b71@aquafin.be>
Message-ID: <20190227154809.GB29313@shrubbery.net>

Thu, Feb 21, 2019 at 11:48:34AM +0000, Nick Nauwelaerts:
> hello all,
> rancid aerohive/hiveos support has been updated to track rancid 3.9. from now on i will track rancid releases for this instead of rancid svn. for support specific to hiveos/aerohive access points please email me directly or open a github issue. the code is documented and rancid docs have also been updated wherever needed for aerohive. this is not yet merged back into mainline rancid.
> 
> (aerohive switches are dell oem's iirc. the code here is for aerohive access points running hiveos only)
> 
> if you would like to see this back in mainline rancid please report to this mailinglist with success or failure stories.
> 
> https://github.com/inphobia/rancid-aerohive-support
> 
> a tarball is available on github for the rancid 3.9 release + aerohive/hiveos support under "releases" but i will not link to it directly so people don't get confused what the official release/download link is.

Please, those who use this hiveos support, report your successes/failures.

> thx for any feedback.
> 
> // nick
> 
> 
> 
> 
> 
> ________________________________
> 
> Volg Aquafin op Facebook<https://www.facebook.com/AquafinNV> | Twitter<https://twitter.com/aquafinnv> | YouTube<http://www.youtube.com/channel/UCk_4P5BJ-MtEEDCkCsR_KqQ?feature=mhee> | LinkedIN<http://www.linkedin.com/company/aquafin/products>
> 
> In het kader van de uitoefening van onze taken verzamelen we bij Aquafin persoonsgegevens. Hoe we omgaan met deze gegevens en wat de rechten van de betrokkenen zijn, kan je nalezen in onze privacy policy<https://www.aquafin.be/nl-be/privacy-policy>.
> 
>   P Denk aan het milieu. Druk deze mail niet onnodig af.

> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at shrubbery.net
> http://www.shrubbery.net/mailman/listinfo/rancid-discuss


From lind108 at hotmail.com  Wed Feb 27 20:24:12 2019
From: lind108 at hotmail.com (Kenneth Lind)
Date: Wed, 27 Feb 2019 20:24:12 +0000
Subject: [rancid] Filter/Change filesize thresholds IOS-XE/NXOS
Message-ID: <BL0PR03MB4100841B5CEBB5CF315EC0ADF9740@BL0PR03MB4100.namprd03.prod.outlook.com>

We have been long time members of this list and see similar issues mentioned but we would like to be able to fine tune some of the controls related to how diffs are generated in relation to file size changes such as the following:

NXOS:
- !Flash: logflash: 7 GB total (89% free)
+ !Flash: logflash: 7 GB total (90% free)

IOSXE:
- !Flash: harddisk: 118084341760 bytes total (104 GB free)
+ !Flash: harddisk: 118084341760 bytes total (103 GB free)


We are on RANCiD latest (v3.9) and everything is working great as always. I would simply like to reduce the chatter emails. We know we can remove the checks altogether but think there is a more elegant solution that would perhaps allow us to not care about the 1GB changes (as big logs sometimes churn on our IOS-XE devices).

Thank you Heasley and everyone that has made this such a great product!

--Ken