[jffnms-users] Foundry and syslog

[Thomas Mangin]

Hello, I am trying to add Foundry (FESX) support to my JFF. I am testing interface up/down detection. I have both snmptrap and syslog configured. "Out of the Box", JFF correctly detect the ethernet interfaces and virtual interfaces. I have added the following rule in "Syslog Message Rule" : +---------------------------------------------+-----------+-------+---------------------+ | Text Match                                  | interface | state | event type          | +---------------------------------------------+-----------+-------+---------------------+ |  System: Interface (\S+\s?\S+?) state (\S+) |         1 |     2 | interface shutdown  | +---------------------------------------------+-----------+-------+---------------------+ Events +--------+---------------------+------+------+-------------------+-------+---------+-----+----------+ | id     | date                | type | host | interface         | state | referer | ack | analized | +--------+---------------------+------+------+-------------------+-------+---------+-----+----------+ | 574203 | 2005-07-19 00:47:09 |    3 |   48 | GigabitEthernet24 | down  |       0 |   0 |        1 | | 574202 | 2005-07-19 00:47:06 |    7 |   48 | ethernet 24       | down  |  437080 |   0 |        0 | | 574201 | 2005-07-19 00:43:45 |    3 |   48 | GigabitEthernet24 | up    |       0 |   1 |        1 | | 574200 | 2005-07-19 00:43:44 |    7 |   48 | ethernet 24       | up    |  437079 |   0 |        0 | | 574199 | 2005-07-19 00:43:40 |    7 |   48 | ethernet 24       | down  |  437078 |   0 |        0 | | 574196 | 2005-07-19 00:39:05 |    3 |   48 | GigabitEthernet24 | down  |       0 |   1 |        1 | +--------+---------------------+------+------+-------------------+-------+---------+-----+----------+ Message +--------+----------------------------------------------------------------+ | id     | message                                                        | +--------+----------------------------------------------------------------+ | 437080 | fesx448-1.u3.tcw.uk System: Interface ethernet 24, state down  | | 437079 | fesx448-1.u3.tcw.uk System: Interface ethernet 24, state up    | | 437078 | fesx448-1.u3.tcw.uk System: Interface ethernet 24, state down  | | 437077 | fesx448-1.u3.tcw.uk System: Interface ethernet 24, state up    | | 437076 | fesx448-1.u3.tcw.uk System: Interface ethernet 24, state down  | +--------+----------------------------------------------------------------+ As you can see the Trap correctly change the status of the interface to up and down but the syslog message is causing JFF to try to update an interface "ethernet 24" on the switch which does not exist (ethernet 24 is the name of the interface when you are in "config t"). I could filter those syslog message but I would rather prefer to not rely on the trap. Can anyone can think of a way to make the interface up/down status working without SNMP Trap ? Thomas