| Table of Contents |
|---|
Overview
opEvents provides the ability for the adminstrator to customise an event's properties from a variety of inputs. For example, if a user wanted to set a specific priority for an event it can be done during the input parsing stages. This article will provide a methodology for creating events from SNMP traps, via a generic extensible parser with EventParserRules.
The generic parser rules are defined in EventParserRules.nmis which json which is found in the configuration directory /usr/local/omk/conf. Please read the notes at the top of this file first as they are very informative as to what is possible in regard to the parser rules.
Evaluate The Traps To Be Processed
Create a list of SNMP traps that are required be processed by opEvents.
Correlate Events Into Stateful Pairs
For this discussion we will assume that the concept of 'state' is desirable. i.e. If there is a "down" event, there should be a corresponding "up" event, and opEvents should keep track of the state and ignore duplicate inputs. (It is possible that several "down" events could share a single "up" or clearing event.)
State
opEvents tracks state based on a tuple of three event properties.
...
| Note |
|---|
If any of these three event properties are not set state will not function well. Consider a case where the element property is not set; thus being null. In this case if a 'port down' for gig0/0 was received a 'port up' for gig0/1 would clear the g0/0 'port down' event. Without the element being set opEvents cannot differentiate between interfaces. |
Example parser rule for the element property.
| Code Block |
|---|
53 =>"53" : { IF => qr/"IF" : "IF-MIB::ifIndex\\.\\d+=(\\d+)/", "THEN" : [ THEN => ["capture(element)"], ] }, |
Example parser rule for the stateful property
| Code Block |
|---|
51 =>"51" : { IF => qr/"IF" : "IF-MIB::linkDown/", "THEN" : [ THEN => ["set.event(Interface Down)", "set.stateful(Interface)", "set.stateful(Interface)", "set.state(down)", "set.state(down)", "set.priority(3)" ], ] }, |
Create Parser Rules
opEvents will process the trap log file as specified on opCommon.nmisjson. When parsing the traps, at least the following properties should be extracted:
...
The shipped version of EventParserRules.nmis has json has a traplog section that will extract the date, host, trap and details fields for most situations.
This article focuses on situations where customers want customization for the remaining fields.
Set the Element
Review all the SNMP traps to determine which OID best describes what will become the element property. Write a regular expression that matches this.
...
Based on this we can write the regular expression to set the element.
| Code Block |
|---|
"2 =>": { "DESCRIPTION => '": "Set element for card number.'", "IF => qr/": "(STARENT-MIB::starSlotNum=\d+)/", "THEN": => ["capture(element)"], }, |
Notice the regular expression will catch an number of digits following the '=' character. This rule 'captures' the element. In this way we can dynamically assign event properties based on a regular expression.
Set Other Properties
Generally the other properties that we wish to set can be done with one rule. Consider the following trap received by opEvents.
...
| Info |
|---|
Notice that if the author is creative and accurate with regular expressions the number of rules my be decreased. |
| Code Block |
|---|
"103": => { "IF => qr/": "STARENT-MIB::starCardTempOK/", "THEN => [": [ "set.event(Card Temperature OK)", "set.stateful(temperature)", "set.state(up)", "set.priority(2)" ], }, |
Based on a match of "STARENT-MIB::starCardTempOK", the rule will take action.
- event - "Card Temperature OK"
- stateful - "temperature"
- state - "up"
- priority - "2"
...