使用TCL脚本过滤思科路由器日志

当登录到一台路由器查看日志时,突然发现:

May 17 10:21:55: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended
May 17 10:22:25: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended
May 17 10:22:25: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended
May 17 10:22:55: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended
May 17 10:22:55: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended
May 17 10:23:25: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended
May 17 10:23:25: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended

所有其它日志都被挤没了, 在确认散热不是问题后，接下来就是如何不让这些日志出现,或一小时警告一次就行了,没必要一秒钟出几百条啊...

登录路由器特权模式, 输入命令tclsh,进入tcl语言编译器

cisco3845#tclsh
cisco3845(tcl)#
输入命令 puts [open "flash:test.tcl" w+] { 然后把tcl脚本内容复制进去, 加上一个'}'然后回车.
cisco3845(tcl)#puts [open "flash:test.tcl" w+] {
+>proc forceInteger { x } {
+> set count [scan $x %d%s n rest]
+> if { $count <= 0 || ( $count == 2 && ![string is space $rest] ) } {
+> # This is an error
+> return "-1"
+> }
+> return $n
+>}
+>set time_start 235900
+>set time_end 235959
+>set timestamp [forceInteger [clock format [clock seconds] -format %H%M%S]]
+>if { [regexp {FAN_LOW_RPM} $::orig_msg] } {
+> if {($time_start <= $timestamp) && ($timestamp <= $time_end)} {
+> return "$::orig_msg - This message was rate-limited by ESM"
+> } else {
+> return ""
+> }
+>} else {
+> return $::orig_msg
+>}} #最后这个}是自己加上的
cisco3845(tcl)#

然后就在flash根目录生成了一个文件 test.tcl 这个文件中的脚本大体意思是:
在23点59分1秒到23点59分59秒这个时间段内,如果有FAN_LOW_RPM的日志,则显示出来并加上后缀

This message was rate-limited by ESM

而在除23点59分这个时间段,其它时间出现的FAN_LOW_RPM的日志,全部不显示.

当然实现这个功能还要一些设置

cisco3845(config)#logging buffered filtered 50000
cisco3845(config)#logging filter flash:test.tcl

再过一段时间, 再show logg看下

May 13 23:57:58.401: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 1 packet
May 13 23:58:57.935: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 1 packet
May 13 23:59:19.691: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended - This message was rate-limited by ESM
May 13 23:59:39.692: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended - This message was rate-limited by ESM
May 13 23:59:59.852: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended - This message was rate-limited by ESM
May 14 00:03:18.033: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 1 packet
May 14 00:03:25.189: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 3 packets
May 14 00:05:48.052: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 1 packet
May 14 00:08:20.952: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 1 packet
May 14 00:14:31.241: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 1 packet
May 14 00:14:34.069: %SEC-6-IPACCESSLOGNP: list xxx denied 0 x.x.x.x -> 0.0.0.0, 1 packet

就可以看到其它日志了.

转载于:https://blog.51cto.com/juispan/2117350