Help in pattern matching expression with <>

Dears

How to pattern match below line in a suppression rule within an  snmp interceptor policy,

PhysicalName=10GE1/0/40 FaultCause=Optical Module Removed If Alias=<RESERVA> <CMT=Ampliacion_LAN_LEGACY_Link> If Memo=--

I trying with the following pattern: <*>\\\<RESERVA\\\><*>

if I test with the opcpat utility, I see that the pattern works.

[root@avvlnp00501 mcrespo]#  /opt/OV/bin/OpC/utils/opcpat -fp /tmp/pat.2 -fv /tmp/valor.3
using singlebyte mode

******** next pattern ********
Pattern: "<*>\<RESERVA\><*>" using seps ""
Value:   "PhysicalName=10GE1/0/40 FaultCause=Optical Module Removed If Alias=<RESERVA> <CMT=Ampliacion_LAN_LEGACY_Link> If Memo=--"
"PhysicalName=10GE1/0/40 FaultCause=Optical Module Removed If Alias=" " <CMT=Ampliacion_LAN_LEGACY_Link> If Memo=--"

but the policy is not working and the trap is not being supressed.

Please help.

Tags:

  • Verified Answer

    +1  

    Hello,

    I typically use the logfile policy magic potion bottle to test.  And this worked when using <*>\<RESERVA\><*>:

    The \< and \> look correct to me.

    So I tested with this snmptrap command:
    snmptrap -v 2c -c public localhost '' 1.3.6.1.4.1.9999   1.3.6.1.4.1.9999.1 s "PhysicalName=10GE1/0/40 FaultCause=Optical Module Removed If Alias=<RESERVA> <CMT=Ampliacion_LAN_LEGACY_Link> If Memo=-"

    Knowing how to send test events is really helpful when building SNMP policies.  I find "netsnmp" tools works brilliantly.

    This is how snmptrap sends the test SNMP trap to the OA12 process called opctrapi, listning to port 162:
    -v 2c Specifies SNMP version 2c.
    -c public Sets the SNMP community string to public.
    localhost this is the destination which in this case is loopback. You can add a hostname or IP address here.
    '' This needs to be set. When testing, use '' (these are two ' (I call it a single blip, but it's really an apostrophe) and not a double quote (").
    1.3.6.1.4.1.9999 The enterprise OID that identifies Object Identifier (OID).
    1.3.6.1.4.1.9999.1 The specific trap OID, which definins the type of alert.
    s This means the data being sent is string.
    "PhysicalName=10GE1/0/40 FaultCause=Optical Module Removed If Alias=<RESERVA> <CMT=Ampliacion_LAN_LEGACY_Link> If Memo=-" is the final part. This is the string text you want to send. Please make sure you wrap up the text inside double quotes, else it will not work.

    Here is the event:

    Please cut/paste the following as a "raw" SNMP policy:

    SYNTAX_VERSION 5


    SNMP "Sample SNMP Match for RESERVA"
    DESCRIPTION ""
    SEVERITY Unknown
    SEPARATORS " "
    MSGCONDITIONS
    DESCRIPTION "RESERVA (SNMPv2)"
    CONDITION_ID "5ea44130-a773-41d1-b83f-72332fee9002"
    CONDITION
    $e ".1.3.6.1.4.1"
    $G 6
    $S 9999
    $1 "\\<RESERVA\\>" SEPARATORS " "
    SET
    TEXT "Matched RESERVA event"

    In the policy inside the console looks like this:

    It works because hte policy matches event OID 1.3.6.1.4.1.9999.  Then 1.3.6.1.4.1.9999.1 (that's the $1 part of the condition) matches \<RESERVA\>.

    I hope this helps.