Solved

Parser with multiple variables

6
Userlevel 1

Hello

 

I’m trying to create a parser for repeated use in my company. My goal is to identify intrefaces that haven’t been used in over 6 months by using the “sh int” command and parsing the “Last input” portion of the output.


GigabitEthernet1/0/19 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 1111.1111.111 (bia 1111.1111.111)
  Description: Example
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 6w4d, output 6w4d, output hang never

 

In theory this should be easy but because of how Cisco shows the dates it is fairly hard to put into a string and parse it.

 

I have this so far as to identify interfaces:

$int is $int_status, line protocol is

And this for the last input portion:

Last input $string:last_time_in_traffic, output $string:last_time_out_traffic, output hang never

 

My whole goal is to identify just GigabitEthernet X/0/X (I dont need modules) that havent been use in over 6 months but if someone could perhaps give me an idea or just point me in the right direction I’d greatly appreciate it

icon

Best answer by 6ix9ine 29 July 2022, 03:00

View original

6 replies

6
Userlevel 1

Ive worked on my parser some more and here is a better version, but I still need some help ironning out some details

Im using the paragraph parser:

 

ID Line Pattern

$interface is down, line protocol is down (notconnect)

 

Variable Line Pattern

regex[$uptime]:Last input ((?:\d+y)?(?:2[5-9]|[3-9][0-9])w(?:\d+d)?|\d+y(?:\d+w)?(?:\d+d)?|never)

 

My problem now lies that this picks up all the “never”s incluing the one on interfaces and vlans that do not match the variable id pattern.

 

Any ideas would be welcomed, sorry the first post looks like garbage

prallu

Hi. 

I hope you are able to fix the problem. Else please see below if it’s useful. 

Since you have mentioned your goal is to identify just GigabitEthernet X/0/X that haven’t been used in over 6 months. 

My suggestion for you is to use ID Line pattern as below. 

GigabitEthernet$mstring:gigeth is down, line protocol is down (notconnect)

For above, output table will have interfaces named as “0/0/0”. Like below.

 

Your variable line pattern looks good to parse what you intend to parse.

 

This way - you will not see all the other unnecessary interfaces here. 

Hope this helps. 

 

Thanks,

Pramod

pallu
prallu

Hi. 

I hope you are able to fix the problem. Else please see below if it’s useful. 

Since you have mentioned your goal is to identify just GigabitEthernet X/0/X that haven’t been used in over 6 months. 

My suggestion for you is to use ID Line pattern as below. 

GigabitEthernet$mstring:gigeth is down, line protocol is down (notconnect)

For above, output table will have interfaces named as “0/0/0”. Like below.

For full interface names, you can use ID line pattern as below, using regex.

regex[$interface]:^(Ethernet\S+)\s+is\s+down,\s+line\s+protocol\s+is\s+down\s+\(notconnect\)

Output will look as below. (you could use GigabitEthernet instead of Ethernet, at the regex)

Your variable line pattern looks good to parse what you intend to parse.

 

This way - you will not see all the other unnecessary interfaces here. 

Hope this helps. 

 

Thanks,

Pramod

 

pallu
6
Userlevel 1

Hi Pramod,

Your regex expression is very nice it does make finding the interfaces name very nice. 

My one problem though is those pesky blanks on $uptime, it seems to grab interfaces that meet the ID line pattern but they don’t meet the Variable Line Pattern

 

Here is some sample of the sample data im using, as you will see it will parse an interface with less than 6 months. I will keep working on the expressions and let you know, but if you have any idea it is more than welcomed.

 

Thank you again for replying, your expression is very nice

V/R

 

6ix9ine

 

GigabitEthernet2/0/4 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 
  Description: 1S026  
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/5 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 
  Description: 1H220_03S-D2/ AUDITORIUM  
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 11w4d, output 11w4d, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 398764
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     7423 packets input, 5270579 bytes, 0 no buffer
     Received 331 broadcasts (179 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 179 multicast, 0 pause input
     0 input packets with dribble condition detected
     12350 packets output, 8289669 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/6 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 
  Description: 1S027
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/7 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is
  Description: 1H220_04S-D2/ AUDITORIUM  
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 11w3d, output 11w3d, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 4711247
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     1044750 packets input, 538385424 bytes, 0 no buffer
     Received 5423 broadcasts (4790 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 4790 multicast, 0 pause input
     0 input packets with dribble condition detected
     8554850 packets output, 5280784385 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/8 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 
  Description: 1H250_03S-D2/ LOBBY
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/9 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 
  Description: 1H220_05S-D2/ AUDITORIUM  
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/10 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 
  Description: 1H250_03S-D2/ M1 SOUTH LOBBY
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 10w1d, output 10w1d, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 26852299
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     2387254 packets input, 637541337 bytes, 0 no buffer
     Received 31468 broadcasts (31252 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 31252 multicast, 0 pause input
     0 input packets with dribble condition detected
     8240728 packets output, 6683141305 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out
GigabitEthernet2/0/11 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 
  Description: 1H220_06S-D2/ AUDITORIUM  
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is on, output flow-control is unsupported 
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

prallu

Hello Again 6ix9ine,

In this case, you might need a dummy first paragraph, for example, there will be a device name before the sh int command on the first line to be parsed. Ex: “abc-xyz-1#sh int”

You can create a dummy variable for device name in Paragraph 1 and call it as a parent in Paragraph 2 and give both the above parser in ID Line Pattern

On Paragraph 1: ID Line Pattern

$_dummy#

Paragraph 2: ID Line Patterns

Line A: 

regex[$interface]:^(GigabitEthernet\S+)\s+is\s+down,\s+line\s+protocol\s+is\s+down\s+\(notconnect\)

Line B: 

regex[$uptime]:Last input ((?:\d+y)?(?:2[5-9]|[3-9][0-9])w(?:\d+d)?|\d+y(?:\d+w)?(?:\d+d)?|never)

Screenshots below. 

 

Paragraph 1
Paragraph 2 with Paragraph 1 as Parent

 

Final Result

 

Let me know if that helps. 

pallu
6
Userlevel 1

hi Pramod,

 

That solved it, I guess I should have skipped the dummy variable explanation in the documentation haha.

Anyways  thank you so much, this has really helped me fix this problem.

 

Sincerely

 

6ix

Reply


Terms & ConditionsCookie settings
Community |  Ideas

Facebook |  Instagram |  Youtube |  Twitter |  LinkedIn
Privacy & Security Statement  |  Terms & Conditions |  Impressum  |  UK Modern Slavery Statement
Copyright © 2021 by NetBrain Technologies Inc. - All rights reserved.