Code Extract for White Paper 007

WHITE PAPERS
from the files of
Networking Unlimited, Inc.

WebQuery@NetworkingUnlimited.com
14 Dogwood Lane, Tenafly, NJ 07670
Phone: +1 201 568-7810
FAX: +1 201 568-7269

Automated Analysis of Cisco Log Files

perl code for "Tracking Status of a Single Link Example"

#!/usr/bin/perl
.
. Startup code and parameter parsing deleted...
.
LOGLINE: while ( (@logline=cookedlogread()) && $logline[0] )
{
# parse the line for content!
$line=$logline[4];
unless ( $linkprotoat )
    {
    # First line in log, initialize variables
    # Assume Critical Service working normally (up on leased, down on ISDN)
    $linkstateat = $logline[1] ;
    $linkprotoat = $logline[1] ;
    $linkphysat = $logline[1] ;
    $isdnprotoat = $logline[1] ;
    $isdnphysat = $logline[1] ;
    $linkproto = 1 ;
    $linkphys = 1 ;
    $isdnproto = 0 ;
    $isdnphys = 0 ;
    $oldstate = " UP " ;
    $priorstate = " UP " ;
    $reportpending = 0 ;
    $timestamp = gmtime($logline[1]);
    printf "-> UP <- %12s %s. Assuming leased line up and ISDN down\n", "Log starts", $timestamp;
    }
if ( $reportpending && ($logline[1] > ($linkstateat + $transientwait)))
    {
    print "$reporttext";
    $reportpending = 0 ;
    }
unless ( $line =~ /\%(\S+):\s+(.*)$/ )
    {
       #All Critical Service related lines are clearly recognizable,
       # so this can not be an Critical Service line!
       next LOGLINE
    }
unless ( ($logline[0] eq "RouterOne" ) || ( $logline[0] eq "RouterTwo"))
    {
       #Critical Service only connects to routers 1 and 2, so ignore all others
       next LOGLINE
    }
unless ( $line =~ /\%(\S+):.*\s*Interface Serial1\/3/ )
    {
       #All Critical Service related lines are clearly recognizable,
       # so this can not be an Critical Service line!
       next LOGLINE
    }
$action = $1 ;
# Interesting line... figure out what is happening to Critical Service!
unless ( ($action eq "LINEPROTO-5-UPDOWN") or ($action eq "LINK-3-UPDOWN") )
    {
       # Not line or link protocol changing state to up or down!
       # so print it out and let the user figure out what's happening!
       $timestamp = gmtime($logline[1]);
       printf "*** %12s %s %8d %s\n",$logline[0],$timestamp,$logline[2],$logline[4];
       next LOGLINE
    }
$line =~ /\%(\S+):.*\s*Interface Serial1\/3, changed state to (up|down)/ ;
$motion = $2 ;
$timestamp = gmtime($logline[1]);
if ( $logline[0] eq "RouterOne" )
    {
    if ($action eq "LINEPROTO-5-UPDOWN")
       {
       if ($motion eq "up")
          {
          if ($linkproto == 1)
             {
             printf " --> Line protocol state changed from up to up on leased line\n";
             }
            else
             {
             $linkproto = 1 ;
             $linkprotodown += $logline[1] - $linkprotoat ;
             $linkprotoat = $logline[1];
             }
          }
         else
          {
          # motion is "down"
          if ($linkproto == 1)
             {
             $linkproto = 0 ;
             $linkprotoup += $logline[1] - $linkprotoat ;
             $linkprotoat = $logline[1];
             }
            else
             {
             printf " --> Line protocol state changed from down to down on leased line\n";
             }
          }
       }
      else
       {
       # Process LINK-3-UPDOWN
       if ($motion eq "up")
          {
          if ($linkphys == 1)
             {
             printf " --> Line physical state changed from up to up on leased line\n";
             }
            else
             {
             $linkphys = 1 ;
             $linkphysdown += $logline[1] - $linkphysat ;
             $linkphysat = $logline[1];
             }
          }
         else
          {
          if ($linkphys == 1)
             {
             $linkphys = 0 ;
             $linkphysup += $logline[1] - $linkphysat ;
             $linkphysat = $logline[1];
             }
            else
             {
             printf " --> Line physical state changed from down to down on leased line\n";
             }
          }
       }
    }
   else
    {
    # Router 2 actions are the ISDN backup
    if ($action eq "LINEPROTO-5-UPDOWN")
       {
       if ($motion eq "up")
          {
          if ($isdnproto == 1)
             {
             printf " --> ISDN protocol state changed from up to up on leased line\n";
             }
            else
             {
             $isdnproto = 1 ;
             $isdnprotodown += $logline[1] - $isdnprotoat ;
             $isdnprotoat = $logline[1];
             }
          }
         else
          {
          # motion is "down"
          if ($isdnproto == 1)
             {
             $isdnproto = 0 ;
             $isdnprotoup += $logline[1] - $isdnprotoat ;
             $isdnprotoat = $logline[1];
             }
            else
             {
             printf " --> ISDN protocol state changed from down to down on leased line\n";
             }
          }
       }
      else
       {
       # Process LINK-3-UPDOWN
       if ($motion eq "up")
          {
          if ($isdnphys == 1)
             {
             printf " --> ISDN physical state changed from up to up on leased line\n";
             }
            else
             {
             $isdnphys = 1 ;
             $isdnphysdown += $logline[1] - $isdnphysat ;
             $isdnphysat = $logline[1];
             }
          }
         else
          {
          if ($isdnphys == 1)
             {
             $isdnphys = 0 ;
             $isdnphysup += $logline[1] - $isdnphysat ;
             $isdnphysat = $logline[1];
             }
            else
             {
             printf " --> ISDN physical state changed from down to down on leased line\n";
             }
          }
       }
    }
$state = ( 8 * $linkproto ) + ( 4 * $linkphys ) + ( 2 * $isdnproto ) + $isdnphys ;
if ($state >= 12) { $state = " UP " }
   elsif ( ($state % 4) == 3) {$state = "ISDN" }
     else { $state = "DOWN" }
if ($oldstate ne $state)
    {
    if ($reportpending)
       {
       if ($priorstate eq $state)
          {
          # State change was a glitch rather than a state change
          if ($oldstate eq " UP ")
             {
             $reporttext =~ /(Router...)\s+(\S\S\S\s+\S\S\S\s.\d\s+\d\d:\d\d:\d\d\s+\d\d\d\d)/ ;
             printf "- try - %12s from %s to %s\n", $logline[0], $2, $timestamp ;
             }
           elsif ($oldstate eq "ISDN")
             {
             if ($state eq "DOWN") { $action = "itry" }
             if ($state eq " UP ")
                {
                $action = "isdn" ;
                $statetime{$oldstate} += $logline[1] - $linkstateat ;
                $linkstateat = $logline[1] ;
                }
             $reporttext =~ /(Router...)\s+(\S\S\S\s+\S\S\S\s.\d\s+\d\d:\d\d:\d\d\s+\d\d\d\d)/ ;
             printf "- %4s - %12s from %s to %s\n",$action, $logline[0], $2, $timestamp ;
             }
           else
             {
             $reporttext =~ /(Router...)\s+(\S\S\S\s+\S\S\S\s.\d\s+\d\d:\d\d:\d\d\s+\d\d\d\d)/ ;
             printf "- drop - %12s from %s to %s\n", $logline[0], $2, $timestamp ;
             $statetime{$oldstate} += $logline[1] - $linkstateat ;
             $linkstateat = $logline[1] ;
             }
          $reportpending = 0 ;
          }
        else
          {
          # State change was a transient, report and set up on newest
          # Except don't bother reporting down time while switching to and from ISDN
          # (But do count that down time as down time :-)
          unless ($oldstate eq "DOWN") { print "$reporttext" }
          $reporttext=sprintf "-> %4s <- %12s %s %15s %s\n", $state, $logline[0], $timestamp, $action, $motion ;
          $statetime{$oldstate} += $logline[1] - $linkstateat ;
          $linkstateat = $logline[1] ;
          }
       }
      else
       {
       $reporttext=sprintf "-> %4s <- %12s %s %15s %s\n", $state, $logline[0], $timestamp, $action, $motion ;
       $statetime{$oldstate} += $logline[1] - $linkstateat ;
       $linkstateat = $logline[1] ;
       $reportpending = 1 ;
       }
    $priorstate = $oldstate ;
    $oldstate = $state ;
    }
}
########################################################
# End of log file processing loop

# Summary Processing and support subroutines deleted

exit 0