I want to filter out the Interface Down alarms that are coming in from the async ports on our 3662 and 2610 routers. I wrote a filter but its only filtering out part of the alarms (45%) . This is my first post so if I should be somewhere else please let me know.
IF-SLLKWAXA-3662M01/12 [As197] [Console Port access to SLLKWAXA06W-2950U02]
IF-SMRWORXA-3662M01/33 [As202] [Console Port access for Firewall #2]
IF-TGRDORXC-3662M01/32 [As201] [Console Port access for Firewall #2]
IF-RGCYMIXG-3662M01/8 [As193] [Learn port ]
IF-SMRWORXA-2610M01/13 [As43] [console access for Juniper E320]
IF-SLLKWAXA-3662M01/22 [As207] [SLLKWAXA-2924M03 Console Port]
IF-RDMDWAXA-3662M01/23 [As208] [RDMDWAXA-2924M02 Console Port]
Alarms not being filtered out:
IF-SMRWORXA-3662M01/31 [As200] [Console Port access for Cisco 2610 TS]
IF-SNPRWIXA-3662M01/35 [As208] [Console Port Access To AIVORTEX-140TD]
IF-WAUSWIXA-3662M01/23 [As196] [Console access for E911 CISC 2811 #2 S6/3]
IF-RNTLILXC-3662M01/8 [As193] [Console Access to S6/0 DN7100 ATM SWITCH]
IF-TGRDORXA-3662M01/14 [As195] [Console Port access to TGRDORXA-2950U01]
I cant seem to find the difference between the entries.
Solved! Go to Solution.
first, you should not that in Smarts' wildcard patterns, the char * doesn't mean the same thing as usual (POSIX) regex.
* means _any_ character, not a repetition
in your pattern matching there is a risk of false positive (although it is low because of the complete wildcard)
now, the issue in your case seems to be the missing * at the end of your wilcard. Because without this, it will not try to "match" the rest of the string.
== APG5 ReportPack4Event for Smarts can report on millions of notifications in seconds ==
Solutions Watch4Net Inc
APG & Smarts InCharge integration
Thank you very much for the information. I added the * to the end of my expression and it worked perfect.