shepardce
Jun 20, 2024Nimbostratus
Regular expression format in user_alert.conf
I'm trying to use iCall and an event from user_alert.conf to fail over a BIG-IP VE cluster if an arbitrary BGP neighbor goes down. I have the handler and script working just fine if the event only looks in my logs for a static phrase, but when I have it look for a regex instead, it no longer works. However, if I test in a tool like regex101 with my expression and a log entry, it matches just fine.
Here's my user_alert.conf (sanitized of course)
alert bgp_neighbor_down "neighbor 100.200.[0-9]{1,3}.[0-9]{1,3} Down" {
exec command="tmsh generate sys icall event neighbordown context { { name protocol value bgp } }"
}
And one of the logs I'm trying to match on:
2024/06/20 15:04:32 informational: BGP : %BGP-5-ADJCHANGE: neighbor 100.200.30.4 Down BGP Notification CEASE
If I then run imish and shut down a neighbor that should match that regex, the device I'm on stays active.
Any thoughts on what else I can try?