Skip to content

Commit

Permalink
fix: fix Dell EMC Powerswitch n parser (#2235)
Browse files Browse the repository at this point in the history
* fix: fix Dell EMC Powerswitch n parser
  • Loading branch information
mstopa-splunk committed Oct 12, 2023
1 parent 4831969 commit 74f1296
Show file tree
Hide file tree
Showing 5 changed files with 71 additions and 50 deletions.
30 changes: 27 additions & 3 deletions docs/sources/vendor/Dell/emc_powerswitchn.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,26 +2,50 @@

## Key facts

* MSG Format based filter
* Requires vendor product by source configuration
* Legacy BSD Format default port 514

## Links

| Ref | Link |
|----------------|---------------------------------------------------------------------------------------------------------|
| Splunk Add-on | None |
| Product Manual | unknown |
| Product Manual | <https://dl.dell.com/manuals/common/networking_nxxug_en-us.pdf> |

## Sourcetypes

| sourcetype | notes |
|----------------|---------------------------------------------------------------------------------------------------------|
| dell:emc:powerswitch:n | None |
| nix:syslog | Non conforming messages |

## Sourcetype and Index Configuration

| key | sourcetype | index | notes |
|----------------|----------------|----------------|----------------|
| dellemc_powerswitch_n | all | netops | none |


## Parser Configuration
1. Through sc4s-vps
```c
#/opt/sc4s/local/config/app-parsers/app-vps-dell_switch_n.conf
#File name provided is a suggestion it must be globally unique

application app-vps-dell_switch_n[sc4s-vps] {
filter {
host("test-dell-switch-n-" type(string) flags(prefix))
};
parser {
p_set_netsource_fields(
vendor('dellemc')
product('powerswitch_n')
);
};
};
```

2. or through unique port
```
# /opt/sc4s/env_file
SC4S_LISTEN_DELLEMC_POWERSWITCH_N_UDP_PORT=5005
```
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
block parser app-netsource-dell_switch_n() {
channel {
rewrite {
r_set_splunk_dest_default(
index('netops')
sourcetype('dell:emc:powerswitch:n')
vendor('dellemc')
product('powerswitch')
class('n')
);
};
};
};
application app-netsource-dell_switch_n[sc4s-network-source] {
filter {
("${.netsource.sc4s_vendor_product}" eq "dellemc_powerswitch_n"
or "${SOURCE}" eq "s_DELLEMC_POWERSWITCH_N")
and "${fields.sc4s_vendor_product}" eq ""
};
parser { app-netsource-dell_switch_n(); };
};
33 changes: 0 additions & 33 deletions package/etc/conf.d/conflib/syslog/app-syslog-dell_switch_n.conf

This file was deleted.

11 changes: 11 additions & 0 deletions package/etc/test_parsers/app-vps-dell_switch_n.conf
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
application app-vps-dell_switch_n[sc4s-vps] {
filter {
host("test-dell-switch-n-" type(string) flags(prefix))
};
parser {
p_set_netsource_fields(
vendor('dellemc')
product('powerswitch_n')
);
};
};
26 changes: 12 additions & 14 deletions tests/test_dell_emc_networking.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,32 +15,30 @@

env = Environment(autoescape=select_autoescape(default_for_string=False))

#
# <189> Oct 21 09:10:54 10.201.1.110-1 CMDLOGGER[emWeb]: cmd_logger_api.c(83) 29333 %% NOTE CLI:10.1.3.211:administrator:User logged in
# <189> Oct 21 09:10:20 10.201.1.110-1 TRAPMGR[trapTask]: traputil.c(721) 29331 %% NOTE 'startup-config' has changed.
# <190> Oct 21 09:10:20 10.201.1.110-1 UNITMGR[emWeb]: unitmgr.c(6905) 29330 %% INFO Configuration propagation successful for config type 0


testdata_admin = [
"{{ mark }} {{ bsd }} {{ host }}-1 CMDLOGGER[emWeb]: cmd_logger_api.c(83) 29333 %% NOTE CLI:10.1.3.211:administrator:User logged in",
"{{ mark }} {{ bsd }} {{ host }}-1 TRAPMGR[trapTask]: traputil.c(721) 29331 %% NOTE 'startup-config' has changed.",
"{{ mark }} {{ bsd }} {{ host }}-1 UNITMGR[emWeb]: unitmgr.c(6905) 29330 %% INFO Configuration propagation successful for config type 0",
# <189> Oct 21 09:10:54 test-dell-switch-n-1 CMDLOGGER[emWeb]: cmd_logger_api.c(83) 29333 %% NOTE CLI:10.1.3.211:administrator:User logged in
# <189> Oct 21 09:10:20 test-dell-switch-n-2 TRAPMGR[trapTask]: traputil.c(721) 29331 %% NOTE 'startup-config' has changed.
# <190> Oct 21 09:10:20 test-dell-switch-n-3 UNITMGR[emWeb]: unitmgr.c(6905) 29330 %% INFO Configuration propagation successful for config type 0

test_cases = [
"{{ mark }} {{ bsd }} {{ host }} CMDLOGGER[emWeb]: cmd_logger_api.c(83) 29333 %% NOTE CLI:10.1.3.211:administrator:User logged in",
"{{ mark }} {{ bsd }} {{ host }} TRAPMGR[trapTask]: traputil.c(721) 29331 %% NOTE 'startup-config' has changed.",
"{{ mark }} {{ bsd }} {{ host }} UNITMGR[emWeb]: unitmgr.c(6905) 29330 %% INFO Configuration propagation successful for config type 0",
]


@pytest.mark.parametrize("event", testdata_admin)
@pytest.mark.parametrize("case", test_cases)
def test_dell_emc_powerswitch_nseries(
record_property, get_host_key, setup_splunk, setup_sc4s, event
record_property, setup_splunk, setup_sc4s, case
):
host = "" + get_host_key
host = f'test-dell-switch-n-{test_cases.index(case)}'

dt = datetime.datetime.now()
_, bsd, _, date, _, _, epoch = time_operations(dt)

# Tune time functions
epoch = epoch[:-7]

mt = env.from_string(event + "\n")
mt = env.from_string(case + "\n")
message = mt.render(mark="<166>", bsd=bsd, host=host, date=date)

sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
Expand Down

0 comments on commit 74f1296

Please sign in to comment.