Dear all, 

Actually, got my answer from here : https://regex101.com/

Changed to this which works just fine according to the online tester :


Thanks.



From: Youssef Bengelloun-Zahr <ybzahr@prodware.fr>
Date: jeudi 17 novembre 2016 11:05
To: Observium Network Observation System <observium@observium.org>
Subject: Are syslog alerts checkers case sensitive ?

Hello,

I’m starting to play around with syslog alerting. I have implemented a bunch a them like this :


In my logs, they show up like this :

Nov 14 22:09:38:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 285, slot 2, ppcr 0

Nov 14 22:09:11:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 288, slot 1, ppcr 1

Nov 14 22:09:11:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 288, slot 1, ppcr 0

Nov 14 22:08:24:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 283, slot 3, ppcr 0

Nov 14 22:06:34:N:BGP: Peer A.B.C.V DOWN (Hold Timer Expired)

Nov 14 22:06:17:N:BGP: Peer A.B.C.D DOWN (Hold Timer Expired)

Nov 14 22:04:38:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 280, slot 2, ppcr 1

Nov 14 22:04:38:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 280, slot 2, ppcr 0

Nov 14 22:04:09:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 277, slot 1, ppcr 1

Nov 14 22:04:09:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 277, slot 1, ppcr 0

Nov 14 22:03:21:A:CAM IPv6 partition warning: total 32768 (reserved 0), free 277, slot 3, ppcr 0

Nov 14 22:01:05:N:MPLS: VPLS ABCD peer A.B.C.D (VC ID 4094) is up

Nov 14 22:01:05:N:MPLS: VPLS ABCD peer A.B.C.D (VC ID 4094) is down

Nov 14 22:01:03:I:Security: ssh logout by bna from src IP 172.16.49.211 from USER EXEC mode using RSA as Server Host Key.

Nov 14 22:01:03:I:SCP: Upload by bna from runconfig to dst IP 172.16.49.211.

Nov 14 22:01:02:N:MPLS: VPLS A.B.C.D peer A.B.C.D (VC ID 4094) is up

Nov 14 22:01:00:I:Security: ssh login by abcd from src IP A.B.C.D to PRIVILEGED EXEC mode using RSA as Server Host Key.

Nov 14 22:01:00:N:MPLS: VPLS A.B.C.D peer A.B.C.D (VC ID 4094) is down

Nov 14 22:00:57:N:BFD: Session DOWN for A.B.C.D on eth 1/2 Reason:Administratively Down

Nov 14 22:00:57:N:ISIS: L2 Neighbor er01-fra01 Down on eth 1/2 due to Interface Down

Nov 14 22:00:57:N:MPLS: LDP IGP sync state for port 1/2 is Not In Sync

Nov 14 22:00:57:I:SYSTEM: port 1/2 link fault status is cleared(physical link goes down 23)  

Nov 14 22:00:57:I:System: Interface ethernet 1/2, state down - remote fault


I was wondering if regular expressions were case sensitive ?  For example : SYSTEM vs System ?

If so, what would be a good implementation example to to create a generic checker that would match both ?

Thank you for your help.

Best regards.  

 

Youssef BENGELLOUN - ZAHR - Consultant Expert
Prodware France
T : +33 979 999 000 - F : +33 988 814 001 - ybzahr@prodware.fr
Web : prodware.fr