Solved

Parser with multiple variables

2 years ago
July 8, 2022
6 replies
449 views

6ix9ine
New Participant

Hello

I’m trying to create a parser for repeated use in my company. My goal is to identify intrefaces that haven’t been used in over 6 months by using the “sh int” command and parsing the “Last input” portion of the output.

GigabitEthernet1/0/19 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is 1111.1111.111 (bia 1111.1111.111)
Description: Example
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 6w4d, output 6w4d, output hang never

In theory this should be easy but because of how Cisco shows the dates it is fairly hard to put into a string and parse it.

I have this so far as to identify interfaces:

$int is $int_status, line protocol is

And this for the last input portion:

Last input $string:last_time_in_traffic, output $string:last_time_out_traffic, output hang never

My whole goal is to identify just GigabitEthernet X/0/X (I dont need modules) that havent been use in over 6 months but if someone could perhaps give me an idea or just point me in the right direction I’d greatly appreciate it

Best answer by 6ix9ine

hi Pramod,

That solved it, I guess I should have skipped the dummy variable explanation in the documentation haha.

Anyways thank you so much, this has really helped me fix this problem.

Sincerely

6ix

View original

Did this topic help you find an answer to your question?

6ix9ine
New Participant
2 years ago
July 11, 2022

Ive worked on my parser some more and here is a better version, but I still need some help ironning out some details

Im using the paragraph parser:

ID Line Pattern

$interface is down, line protocol is down (notconnect)

Variable Line Pattern

regex[$uptime]:Last input ((?:\d+y)?(?:2[5-9]|[3-9][0-9])w(?:\d+d)?|\d+y(?:\d+w)?(?:\d+d)?|never)

My problem now lies that this picks up all the “never”s incluing the one on interfaces and vlans that do not match the variable id pattern.

Any ideas would be welcomed, sorry the first post looks like garbage

prallu
Frequent Participant
2 years ago
July 28, 2022

Hi.

I hope you are able to fix the problem. Else please see below if it’s useful.

Since you have mentioned your goal is to identify just GigabitEthernet X/0/X that haven’t been used in over 6 months.

My suggestion for you is to use ID Line pattern as below.

GigabitEthernet$mstring:gigeth is down, line protocol is down (notconnect)

For above, output table will have interfaces named as “0/0/0”. Like below.

Your variable line pattern looks good to parse what you intend to parse.

This way - you will not see all the other unnecessary interfaces here.

Hope this helps.

Thanks,

Pramod

pallu

prallu
Frequent Participant
2 years ago
July 28, 2022

prallu wrote:

Hi.

I hope you are able to fix the problem. Else please see below if it’s useful.

Since you have mentioned your goal is to identify just GigabitEthernet X/0/X that haven’t been used in over 6 months.

My suggestion for you is to use ID Line pattern as below.

GigabitEthernet$mstring:gigeth is down, line protocol is down (notconnect)

For above, output table will have interfaces named as “0/0/0”. Like below.

For full interface names, you can use ID line pattern as below, using regex.

regex[$interface]:^(Ethernet\S+)\s+is\s+down,\s+line\s+protocol\s+is\s+down\s+\(notconnect\)

Output will look as below. (you could use GigabitEthernet instead of Ethernet, at the regex)

prallu wrote:

Your variable line pattern looks good to parse what you intend to parse.

This way - you will not see all the other unnecessary interfaces here.

Hope this helps.

Thanks,

Pramod

pallu

6ix9ine
New Participant
2 years ago
July 28, 2022

Hi Pramod,

Your regex expression is very nice it does make finding the interfaces name very nice.

My one problem though is those pesky blanks on $uptime, it seems to grab interfaces that meet the ID line pattern but they don’t meet the Variable Line Pattern

Here is some sample of the sample data im using, as you will see it will parse an interface with less than 6 months. I will keep working on the expressions and let you know, but if you have any idea it is more than welcomed.

Thank you again for replying, your expression is very nice

V/R

6ix9ine

GigabitEthernet2/0/4 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1S026
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/5 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1H220_03S-D2/ AUDITORIUM
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 11w4d, output 11w4d, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 398764
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
7423 packets input, 5270579 bytes, 0 no buffer
Received 331 broadcasts (179 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 179 multicast, 0 pause input
0 input packets with dribble condition detected
12350 packets output, 8289669 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/6 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1S027
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/7 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1H220_04S-D2/ AUDITORIUM
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 11w3d, output 11w3d, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 4711247
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
1044750 packets input, 538385424 bytes, 0 no buffer
Received 5423 broadcasts (4790 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 4790 multicast, 0 pause input
0 input packets with dribble condition detected
8554850 packets output, 5280784385 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/8 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1H250_03S-D2/ LOBBY
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/9 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1H220_05S-D2/ AUDITORIUM
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/10 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1H250_03S-D2/ M1 SOUTH LOBBY
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 10w1d, output 10w1d, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 26852299
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
2387254 packets input, 637541337 bytes, 0 no buffer
Received 31468 broadcasts (31252 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 31252 multicast, 0 pause input
0 input packets with dribble condition detected
8240728 packets output, 6683141305 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/11 is down, line protocol is down (notconnect)
Hardware is Gigabit Ethernet, address is
Description: 1H220_06S-D2/ AUDITORIUM
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

prallu
Frequent Participant
2 years ago
July 28, 2022

Hello Again 6ix9ine,

In this case, you might need a dummy first paragraph, for example, there will be a device name before the sh int command on the first line to be parsed. Ex: “abc-xyz-1#sh int”

You can create a dummy variable for device name in Paragraph 1 and call it as a parent in Paragraph 2 and give both the above parser in ID Line Pattern

On Paragraph 1: ID Line Pattern

$_dummy#

Paragraph 2: ID Line Patterns

Line A:

regex[$interface]:^(GigabitEthernet\S+)\s+is\s+down,\s+line\s+protocol\s+is\s+down\s+\(notconnect\)

Line B:

regex[$uptime]:Last input ((?:\d+y)?(?:2[5-9]|[3-9][0-9])w(?:\d+d)?|\d+y(?:\d+w)?(?:\d+d)?|never)

Screenshots below.

Let me know if that helps.

pallu

6ix9ine
New Participant
2 years ago
July 29, 2022

hi Pramod,

That solved it, I guess I should have skipped the dummy variable explanation in the documentation haha.

Anyways thank you so much, this has really helped me fix this problem.

Sincerely

6ix

Reply

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

Cookie settings

We use 3 different kinds of cookies. You can choose which cookies you want to accept. We need basic cookies to make this site work, therefore these are the minimum you can select. Learn more about our cookies.

Basic
Functional

Normal
Functional + analytics

Complete
Functional + analytics + social media + embedded videos + marketing

Reply

Related topics

Data Resiliency Status critical - what happens when another node goes down?icon

Will HA Disable if one node get Failed in Cluster(RF2)icon

Quick Start Guide to Nutanix Upgrades

When cluster has no free space, does data rebuilding occuricon

Most helpful members this week

Sign up

Sign in with SSO

Login to the community

Sign in with SSO

Scanning file for viruses.

This file cannot be downloaded

Cookie policy

Cookie settings