On Tue, Jul 19, 2005 at 01:16:54AM +0100, Thomas Mangin wrote: > | System: Interface (\S+\s?\S+?) state (\S+) | 1 | 2 | > interface shutdown | Your PCRE is wacky and is probably wrong. \S+? is not a valid sequence
So a message would look like: > | 437080 | fesx448-1.u3.tcw.uk System: Interface ethernet 24, state down | with the bit after interface being "ethernet 24" or "GigabitEthernet24" ? Try: System: Interface ([A-Za-z0-9 ]+), state ([a-z]+) > As you can see the Trap correctly change the status of the interface to > up and down but the syslog message is causing JFF to try to update an > interface "ethernet 24" on the switch which does not exist (ethernet 24 > is the name of the interface when you are in "config t"). The problem is that the correlator will try to find an interface literally called "ethernet 24". It has to be the interfaces.interface field. > I could filter those syslog message but I would rather prefer to not > rely on the trap. > Can anyone can think of a way to make the interface up/down status > working without SNMP Trap ? Not with this version, but I would say with later versions the handling of syslog messages will be different and you can put in a transform-set to lookup ethernet 24 - Craig -- Craig Small GnuPG:1C1B D893 1418 2AF4 45EE 95CB C76C E5AC 12CA DFA5 Eye-Net Consulting http://www.enc.com.au/ MIEE Debian developer csmall at : enc.com.au ieee.org debian.org ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click _______________________________________________ jffnms-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/jffnms-users
