Juniper / open-nti

Open Network Telemetry Collector build with open source tools
Apache License 2.0
231 stars 93 forks source link

Parser for different output, based on software version. #220

Closed dccarpenter closed 6 years ago

dccarpenter commented 6 years ago

Fairly new to opennti, so I hope this isn't too simple of a question. I understand the command parser is picked, based on a regex of the command line. What happens if the command line is the same, but output is different, depending on the software version. I'm currently running into an issue with my test network, consisting of EX9208s and QFX5100s. The 'show system processes extensive' parser is working for the QFX (14.1X53), but is not working for the EX9208 (16.1R7). The EX process table has a different set of columns:

QFX:

dcarpenter@qfx5100> show system processes extensive May 31 09:48:23 last pid: 90187; load averages: 0.55, 0.31, 0.21 up 21+22:24:13 09:48:23 133 processes: 4 running, 111 sleeping, 18 waiting `Mem: 529M Active, 172M Inact, 365M Wired, 769M Cache, 69M Buf, 51M Free` `Swap:` PID USERNAME THR PRI NICE SIZE RES STATE TIME WCPU COMMAND 1790 root 2 44 -52 1062M 416M select 87.3H 73.34% fxpc 10 root 1 171 52 0K 12K RUN 427.0H 19.14% idle 1952 root 1 96 0 90860K 78752K select 199:42 2.93% l2ald

EX:

dcarpenter@ex9208> show system processes extensive May 31 09:49:53 last pid: 59073; load averages: 0.54, 0.38, 0.36 up 0+17:30:59 09:49:53 214 processes: 5 running, 178 sleeping, 1 zombie, 30 waiting `Mem: 198M Active, 2368M Inact, 885M Wired, 1652M Buf, 12G Free` `Swap: 8192M Total, 8192M Free` PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 10 root 155 ki31 0K 64K RUN 3 961:22 100.00% idle{idle: cpu3} 10 root 155 ki31 0K 64K CPU1 1 961:46 97.07% idle{idle: cpu1}

Is there a method to choose the parser by something other than just the command line executed?

3fr61n commented 6 years ago

Hi

So far with the actual implementation, there is no ‘clean’ way to select the parser, however there are some tricks or workaround….. for instance.

Add multiple ‘match’ entries on the same parser file, one that matches the QFX format and not the EX, and the viceversa with the second match entry,

Example…

parser:
    regex-command: show\s+system\s+processes\s+extensive
    matches:
    -
        type: single-value
        method: regex
        regex: <<< a regex that match the QFX format
        variables:
    -
        type: single-value
        method: regex
        regex: : <<< a regex that match the EX format
        variables:
dccarpenter commented 6 years ago

Sorry I didn't get back sooner. I ended up writing up a generic regex that (I believe) will catch all the cases. So far it has been working correctly. For anyone else that may need it:

For the rpd case:

regex: \s[0-9]+.\s+(\d+[K|M|G])\s+(\d+[K|M|G]).\s(\S{4,6})%\s+rpd.$