Dell 6.2 Peer Con trollers, Syslog Parser R ules

751| External Ser vicesInterface DellPowerConnect W- Series ArubaOS 6.2 | User Guide
The ESI syslog parserbegins wit ha list of configuredI P interfaces which listen forE SI messages.When a syslog
message is received,it is checked against the list of definedE SI servers.If a server match is found, themessage is
then tested against the list of predefined rules.
Within the rule-checkingprocess, the incoming message is checked against the list of rulest o searchfi rst fora
condition match (see "Syslog Parser Rules" on page 751). If a conditio n match is made, and the user name can be
extracted fromthe syslog message, the resulting user action is processed by first attempting to look up the user in
the localuser table. If the user is found, the appropriate action is taken on the user. Thedefault behavior is to look
for usersonly on the local controller.I ft heuser is not found, the event is meaninglessand is ignored. This is the
typical situation when a single controlleris connected to a dedicated E SI server.
Peer Con trollers
As an alternative,c onsidera t opology wheremultiple Dell controllers shareo neor more ESI servers.
Figure 346: ESI Peer Controllers
In this scenario, several Dell controllers(mast erand local) are defined in the same syslog parser domain to act as
peers . From the standpoint of the ESI servers, because there is no accurate way of determining from which controller
a given usercame. Thus, the event is flooded out to all Dell controllers defined as peers within this ESI parser
domain. Theco rrespondingcontroller holding the userentry acts on the event, while other Dell controllers ignoret he
event.
Syslog Parser R ules
The usercreates an ESI rule by using characters and special operators to specify a patt ern(regular expression) that
uniquelyidentifies a certain amount of text wit hina sy slogmessage. (Regular expression syntax is described in
"UnderstandingBasic R egularExpression (BRE) Syntax"o n page 771.) This “condition” defines the type o f message
and the ESI domain to which this message pertains. The rulecontains three major fields:
lCondition: The pattern that uniquely identifies the syslog message type.
lUser:T heusername identifier. It can be in the form of a name, MAC address, or IP address.
lAction: The action to take when a rule match occurs.
Oncea condition match has been made, no furtherrule-matching will be made. For the rulet hat matched,o nlyone
action can be defined.
After a condition match has been made,the message is parsed for the user information. This is done by specifying
the target regionwi th the regularexpression (REGEX) regex() block syntax. This syntax generatestw o blocks:The