WHITE PAPERS
from the files of
Networking
Unlimited, Inc.
WebQuery@NetworkingUnlimited.com
14
Dogwood Lane, Tenafly, NJ 07670
Phone: +1 201 568-7810
FAX: +1
201 568-7269
Automated Analysis of Cisco Log Files
perl code for "Tracking Status of a Single Link Example"
#!/usr/bin/perl
.
.
Startup code and parameter parsing deleted...
.
LOGLINE: while
( (@logline=cookedlogread()) && $logline[0] )
{
# parse
the line for content!
$line=$logline[4];
unless (
$linkprotoat )
{
#
First line in log, initialize variables
#
Assume Critical Service working normally (up on leased, down on
ISDN)
$linkstateat = $logline[1]
;
$linkprotoat = $logline[1]
;
$linkphysat = $logline[1]
;
$isdnprotoat = $logline[1]
;
$isdnphysat = $logline[1]
;
$linkproto = 1 ;
$linkphys
= 1 ;
$isdnproto = 0 ;
$isdnphys
= 0 ;
$oldstate = " UP "
;
$priorstate = " UP "
;
$reportpending = 0 ;
$timestamp
= gmtime($logline[1]);
printf "->
UP <- %12s %s. Assuming leased line up and ISDN down\n", "Log
starts", $timestamp;
}
if (
$reportpending && ($logline[1] > ($linkstateat +
$transientwait)))
{
print
"$reporttext";
$reportpending =
0 ;
}
unless ( $line =~
/\%(\S+):\s+(.*)$/ )
{
#All
Critical Service related lines are clearly recognizable,
#
so this can not be an Critical Service line!
next
LOGLINE
}
unless ( ($logline[0]
eq "RouterOne" ) || ( $logline[0] eq
"RouterTwo"))
{
#Critical
Service only connects to routers 1 and 2, so ignore all
others
next
LOGLINE
}
unless ( $line =~
/\%(\S+):.*\s*Interface Serial1\/3/ )
{
#All
Critical Service related lines are clearly recognizable,
#
so this can not be an Critical Service line!
next
LOGLINE
}
$action = $1 ;
#
Interesting line... figure out what is happening to Critical
Service!
unless ( ($action eq "LINEPROTO-5-UPDOWN")
or ($action eq "LINK-3-UPDOWN") )
{
#
Not line or link protocol changing state to up or down!
#
so print it out and let the user figure out what's
happening!
$timestamp =
gmtime($logline[1]);
printf
"*** %12s %s %8d
%s\n",$logline[0],$timestamp,$logline[2],$logline[4];
next
LOGLINE
}
$line =~
/\%(\S+):.*\s*Interface Serial1\/3, changed state to (up|down)/
;
$motion = $2 ;
$timestamp =
gmtime($logline[1]);
if ( $logline[0] eq "RouterOne"
)
{
if ($action
eq "LINEPROTO-5-UPDOWN")
{
if
($motion eq "up")
{
if
($linkproto == 1)
{
printf
" --> Line protocol state changed from up to up on leased
line\n";
}
else
{
$linkproto
= 1 ;
$linkprotodown
+= $logline[1] - $linkprotoat ;
$linkprotoat
=
$logline[1];
}
}
else
{
#
motion is "down"
if
($linkproto == 1)
{
$linkproto
= 0 ;
$linkprotoup
+= $logline[1] - $linkprotoat ;
$linkprotoat
=
$logline[1];
}
else
{
printf
" --> Line protocol state changed from down to down on leased
line\n";
}
}
}
else
{
#
Process LINK-3-UPDOWN
if
($motion eq "up")
{
if
($linkphys == 1)
{
printf
" --> Line physical state changed from up to up on leased
line\n";
}
else
{
$linkphys
= 1 ;
$linkphysdown
+= $logline[1] - $linkphysat ;
$linkphysat
=
$logline[1];
}
}
else
{
if
($linkphys == 1)
{
$linkphys
= 0 ;
$linkphysup
+= $logline[1] - $linkphysat ;
$linkphysat
=
$logline[1];
}
else
{
printf
" --> Line physical state changed from down to down on leased
line\n";
}
}
}
}
else
{
#
Router 2 actions are the ISDN backup
if
($action eq "LINEPROTO-5-UPDOWN")
{
if
($motion eq "up")
{
if
($isdnproto == 1)
{
printf
" --> ISDN protocol state changed from up to up on leased
line\n";
}
else
{
$isdnproto
= 1 ;
$isdnprotodown
+= $logline[1] - $isdnprotoat ;
$isdnprotoat
=
$logline[1];
}
}
else
{
#
motion is "down"
if
($isdnproto == 1)
{
$isdnproto
= 0 ;
$isdnprotoup
+= $logline[1] - $isdnprotoat ;
$isdnprotoat
=
$logline[1];
}
else
{
printf
" --> ISDN protocol state changed from down to down on leased
line\n";
}
}
}
else
{
#
Process LINK-3-UPDOWN
if
($motion eq "up")
{
if
($isdnphys == 1)
{
printf
" --> ISDN physical state changed from up to up on leased
line\n";
}
else
{
$isdnphys
= 1 ;
$isdnphysdown
+= $logline[1] - $isdnphysat ;
$isdnphysat
=
$logline[1];
}
}
else
{
if
($isdnphys == 1)
{
$isdnphys
= 0 ;
$isdnphysup
+= $logline[1] - $isdnphysat ;
$isdnphysat
=
$logline[1];
}
else
{
printf
" --> ISDN physical state changed from down to down on leased
line\n";
}
}
}
}
$state
= ( 8 * $linkproto ) + ( 4 * $linkphys ) + ( 2 * $isdnproto ) +
$isdnphys ;
if ($state >= 12) { $state = " UP "
}
elsif ( ($state % 4) == 3) {$state = "ISDN"
}
else { $state = "DOWN"
}
if ($oldstate ne $state)
{
if
($reportpending)
{
if
($priorstate eq $state)
{
#
State change was a glitch rather than a state change
if
($oldstate eq " UP ")
{
$reporttext
=~ /(Router...)\s+(\S\S\S\s+\S\S\S\s.\d\s+\d\d:\d\d:\d\d\s+\d\d\d\d)/
;
printf
"- try - %12s from %s to %s\n", $logline[0], $2, $timestamp
;
}
elsif
($oldstate eq "ISDN")
{
if
($state eq "DOWN") { $action = "itry"
}
if
($state eq " UP ")
{
$action
= "isdn" ;
$statetime{$oldstate}
+= $logline[1] - $linkstateat ;
$linkstateat
= $logline[1] ;
}
$reporttext
=~ /(Router...)\s+(\S\S\S\s+\S\S\S\s.\d\s+\d\d:\d\d:\d\d\s+\d\d\d\d)/
;
printf
"- %4s - %12s from %s to %s\n",$action, $logline[0], $2,
$timestamp
;
}
else
{
$reporttext
=~ /(Router...)\s+(\S\S\S\s+\S\S\S\s.\d\s+\d\d:\d\d:\d\d\s+\d\d\d\d)/
;
printf
"- drop - %12s from %s to %s\n", $logline[0], $2,
$timestamp ;
$statetime{$oldstate}
+= $logline[1] - $linkstateat ;
$linkstateat
= $logline[1] ;
}
$reportpending
= 0 ;
}
else
{
#
State change was a transient, report and set up on newest
#
Except don't bother reporting down time while switching to and from
ISDN
#
(But do count that down time as down time :-)
unless
($oldstate eq "DOWN") { print "$reporttext"
}
$reporttext=sprintf
"-> %4s <- %12s %s %15s %s\n", $state, $logline[0],
$timestamp, $action, $motion ;
$statetime{$oldstate}
+= $logline[1] - $linkstateat ;
$linkstateat
= $logline[1]
;
}
}
else
{
$reporttext=sprintf
"-> %4s <- %12s %s %15s %s\n", $state, $logline[0],
$timestamp, $action, $motion ;
$statetime{$oldstate}
+= $logline[1] - $linkstateat ;
$linkstateat
= $logline[1] ;
$reportpending
= 1 ;
}
$priorstate
= $oldstate ;
$oldstate = $state
;
}
}
########################################################
#
End of log file processing loop
# Summary Processing and
support subroutines deleted
exit 0
Home
Page | Company
Profile | Capabilities
| Coming
Events | Case
Studies
| White Papers
| Book
Copyright 1999-2000 ©
Networking Unlimited Inc.
All rights reserved.