Fix: fix arista eos miscategorized as cisco ios #2146
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In #2139 it has been reported that some Arista EOS logs are miscategorized as Cisco IOS.
In fact those two vendors use a very similar log format.
The difference is Arista will always contain program name before the first colon:
Aug 18 03:36:42 AleL3Agent-primary: %AGENT-6-INITIALIZED: Agent 'AleL3Agent-primary' initialized; pid=XXXX
In Cisco there is usually just a timestamp:
Feb 14 09:40:10.326: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Sometimes timestamp with timezone:
{{ mark }}: {{ year }} {{ bsd }} PDT: %DAEMON-3-SYSTEM_MSG: ftp disabled, removing - xinetd[4930] {{ host }}
And sometimes also program name, but with all letters uppercase:
'{{ mark }}{{ bsd }} SYSMGR[919]: %Viptela-{{ host }}-sysmgrd-6-INFO-1400002: Notification: 3/17/2022 18:35:12 system-login-change severity-level:minor host-name:"{{ host }}" system-ip:1.1.1.3 user-name:"mn2c" user-id:2227\n'
This PR adds new test cases based on the customer issue, as well as updates Cisco and Arista parsers to properly catch the differences