[c-nsp] logging suppress duplicates

[Emille Blanc]

Logging discriminators have been hit or miss for us for as long as I can remember (and flat-out doesn't work in some versions of IOS).
We have had more success with TCL filters which you might want to try.
Eg;

file flash:YOURFILTER.tcl

if [string match "by\ snmp$" $::orig_msg] {
  return ""
} else {
  return $::orig_msg
}

Then apply;

logging filter flash:YOURFILTER.tcl

Might be overkill, but has given us a 100% hit rate in our environment.
Also gives you the option of replacing the string with "Log suppressed by filter.tcl", and then setup your discriminator on that so other maintainers can see what's happening, but not sure about the order-of-operation for log filtering stuff.

Good luck!

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Eugene Grosbein
Sent: Monday, September 28, 2020 8:56 AM
To: Ian Henderson
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] logging suppress duplicates

28.09.2020 16:14, Ian Henderson wrote:

> On 28 Sep 2020, at 1:38 pm, Eugene Grosbein <eugen at grosbein.net> wrote:
>>
>> Is it possible to enable suppression of duplicate lines in the logging buffer?
>> Less preferably, disable this kind of messages altogether if it ends with "by snmp" or even "from X.X.X.X by snmp”.
> 
> The term you’re looking for to filter logs in the buffer is ‘logging discriminator’.

Thanks!

It works for me, hmm, partially.

Tried several ways to discriminate the line "%SYS-5-CONFIG_I: Configured from X.X.X.X by snmp"
but could not make it work:

logging discriminator BYSNMP severity drops 5 mnemonics drops SYS-5-CONFIG_I msg-body drops by\ snmp$

It works if I omit "msg-body" part, though. How do I specify lines ending with "by snmp" ?

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/