[rancid] CVS changes with ASA

Post by Ryan DeBerry
I am able to backup ASA config but the config changes on every rancid-run.
The only change is the timestamp when the config was written on the
rancid-run. Is there a way to prevent this behavior?

Interesting. I am backing up several ASAs and don't see this. What release are
you running? Most of mine are on 8.x.

alexd

Ryan DeBerry

2009-01-29 19:33:08 UTC

7.2(4)

Post by Ryan DeBerry

Post by Ryan DeBerry
I am able to backup ASA config but the config changes on every

rancid-run.

Post by Ryan DeBerry
The only change is the timestamp when the config was written on the
rancid-run. Is there a way to prevent this behavior?

Interesting. I am backing up several ASAs and don't see this. What release are
you running? Most of mine are on 8.x.
alexd
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Peter Serwe

2009-01-29 19:54:51 UTC

I'm running 7.2(4) and I don't see this behavior either.

Peter

--
$B%T!<%?!<(B

Peter Serwe

2009-01-29 19:56:28 UTC

Correction. Occasionally I see this behavior.

I have an email from Rancid as of 53 minutes ago with this change.

I'm currently running 2.3.2a8 against 7.2(4).

Peter

Post by Peter Serwe
I'm running 7.2(4) and I don't see this behavior either.
Peter

--
$B%T!<%?!<(B

Ryan DeBerry

2009-01-30 14:52:22 UTC

Can this be avoided by setting something in the rancid.conf? I just added 2
more ASA's and they exhibit the same behavior.

Post by Peter Serwe
Correction. Occasionally I see this behavior.
I have an email from Rancid as of 53 minutes ago with this change.
I'm currently running 2.3.2a8 against 7.2(4).
Peter

Post by Peter Serwe
I'm running 7.2(4) and I don't see this behavior either.
Peter

Post by Ryan DeBerry
I am able to backup ASA config but the config changes on every

rancid-run.

Post by Ryan DeBerry
The only change is the timestamp when the config was written on the
rancid-run. Is there a way to prevent this behavior?

Interesting. I am backing up several ASAs and don't see this. What

release are

Post by alex
you running? Most of mine are on 8.x.
alexd
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

--
$B%T!<%?!<(B

--
$B%T!<%?!<(B
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

john heasley

2009-02-02 19:19:35 UTC

What is changing?

Post by Peter Serwe
Correction. Occasionally I see this behavior.
I have an email from Rancid as of 53 minutes ago with this change.
I'm currently running 2.3.2a8 against 7.2(4).
Peter

Post by Peter Serwe
I'm running 7.2(4) and I don't see this behavior either.
Peter

--
????

--
????
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Ryan DeBerry

2009-02-02 19:29:12 UTC

every rancid-run I would get an email for a diff

the diff was 1 line with the

Written by admin at 07:57:36.960 UTC Wed Jan 28 2009

the only thing that was different was the time

So rancid-run was logging in performing a write mem and then exiting.

So everytime you ran it, the config was different because it was always
saving the config.

This behavior does show up on a8.

Post by john heasley
What is changing?

Post by Peter Serwe
Correction. Occasionally I see this behavior.
I have an email from Rancid as of 53 minutes ago with this change.
I'm currently running 2.3.2a8 against 7.2(4).
Peter

Post by Peter Serwe
I'm running 7.2(4) and I don't see this behavior either.
Peter

Post by Ryan DeBerry
I am able to backup ASA config but the config changes on every

rancid-run.

Post by Ryan DeBerry
The only change is the timestamp when the config was written on the
rancid-run. Is there a way to prevent this behavior?

Interesting. I am backing up several ASAs and don't see this. What

release are

Post by alex
you running? Most of mine are on 8.x.
alexd
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

--
????

--
????
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

john heasley

2009-02-02 20:20:34 UTC

Post by Ryan DeBerry
every rancid-run I would get an email for a diff
the diff was 1 line with the
Written by admin at 07:57:36.960 UTC Wed Jan 28 2009
the only thing that was different was the time
So rancid-run was logging in performing a write mem and then exiting.

it uses write term, not write mem, so it should not be writing the config
unless Cisco does something unusual on this device. But, we should just
filter this line like we do for IOS devices. Where does the line appear?

Post by Ryan DeBerry
So everytime you ran it, the config was different because it was always
saving the config.
This behavior does show up on a8.

Post by john heasley
What is changing?

Post by Peter Serwe
Correction. Occasionally I see this behavior.
I have an email from Rancid as of 53 minutes ago with this change.
I'm currently running 2.3.2a8 against 7.2(4).
Peter

Post by Peter Serwe
I'm running 7.2(4) and I don't see this behavior either.
Peter

Post by Ryan DeBerry
I am able to backup ASA config but the config changes on every

rancid-run.

Post by Ryan DeBerry
The only change is the timestamp when the config was written on the
rancid-run. Is there a way to prevent this behavior?

Interesting. I am backing up several ASAs and don't see this. What

release are

Post by alex
you running? Most of mine are on 8.x.
alexd
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

--
????

--
????
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Jethro R Binks

2009-02-02 20:37:05 UTC

Post by Ryan DeBerry
So rancid-run was logging in performing a write mem and then exiting.

it uses write term, not write mem, so it should not be writing the
config unless Cisco does something unusual on this device. But, we
should just filter this line like we do for IOS devices. Where does the
line appear?

I'm investigating several PIX/ASA related difficulties with rancid at the
moment, and having moved to 2.3.2a8 rancid and clogin I also see this. I
started to reply to this thread but got bogged down in looking into other
problems, but here's what I'd written on this particular issue:

Is this the "Written by rancid at ..." line you are seeing? Having moved
to using clogin and rancid from 2.3.2a8, I see this too: it seems to be as
a result of using the output of "more system:running-config" specifically,
which is relatively new. A simple patch fixes it (applying by hand should
be trivial, look for line 1551):

--- rancid.1.252 Fri Jan 23 09:07:50 2009
+++ rancid.1.252.mod Sun Feb 1 17:28:10 2009
@@ -1551,6 +1551,7 @@
# some versions have other crap mixed in with the bits in the
# block above
/^! (Last configuration|NVRAM config last)/ && next;
/^: (Written by rancid at|Saved)/ && next;

# skip consecutive comment lines to avoid oscillating extra comment
# line on some access servers. grrr.

Here's some sample .raw output:

asa1# more system:running-config
Cryptochecksum: 92e99914 e1bd90fa d62353b8 1881f920
: Saved
: Written by rancid at 22:47:44.539 UTC Sun Feb 1 2009
!
ASA Version 7.2(4)
!
hostname asa1
domain-name net.strath.ac.uk
...

Jethro.

Post by Ryan DeBerry
So everytime you ran it, the config was different because it was always
saving the config.
This behavior does show up on a8.

Post by john heasley
What is changing?

Post by Peter Serwe
Correction. Occasionally I see this behavior.
I have an email from Rancid as of 53 minutes ago with this change.
I'm currently running 2.3.2a8 against 7.2(4).
Peter

Post by Peter Serwe
I'm running 7.2(4) and I don't see this behavior either.
Peter

Post by Ryan DeBerry
I am able to backup ASA config but the config changes on every

rancid-run.

Post by Ryan DeBerry
The only change is the timestamp when the config was written on the
rancid-run. Is there a way to prevent this behavior?

Interesting. I am backing up several ASAs and don't see this. What

release are

Post by alex
you running? Most of mine are on 8.x.
alexd
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

--
????

--
????
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

--
. . . . . . . . . . . . . . . . . . . . . . . . .
Jethro R Binks
Computing Officer, IT Services, University Of Strathclyde, Glasgow, UK

Jethro R Binks

2009-02-02 20:48:18 UTC

Post by Jethro R Binks
I'm investigating several PIX/ASA related difficulties with rancid at the
moment ...

Since we're looking at these in detail at the moment, here's two more
things:

As another note, it would be useful to send "term pager 0" as well, to
prevent output paging:

--- clogin.1.118 Fri Jan 30 19:40:20 2009
+++ clogin.1.118.mod Fri Jan 30 21:01:26 2009
@@ -603,6 +603,8 @@
set command "set logging session disable;$command"
} else {
send "term length 0\r"
+ # ASA 7.x takes this instead:
+ send "term pager 0\r"
}
# escape any parens in the prompt, such as "(enable)"
regsub -all {[)(]} $prompt {\\&} reprompt

The other thing is that parsing of the serial numbers/hardware revisions
isn't correct. I haven't looked at this in detail yet, but what you get
is garbled, for example:

!Slot 0/: type ASA 5550 Adaptive
!Slot 0/: part Security, serial Appliance
!Slot 0/: hvers ASA5550
!Slot 0: hvers 2.0, firmware 1.0(11)2, sw 7.2(4)
!
!Slot 1: hvers 1.0, firmware 1.0(0)8, sw 1.0(0)10
!
!Slot 1/0: type SSM-4GE Included with ASA
!Slot 1/0: part 5550, serial System
!Slot 1/0: hvers SSM-4GE-INC

I suppose the output generated by PIX/ASA doesn't match the usual IOS
output. If no-one else gets to it, I will take a closer look in a few
days hopefully.

One other things I would note: I find getting configs out of my PIX/ASAs
is much more reliable (but not perfect) if I only let rancid run one of
"more system:running-config", "write terminal", or "show running-config".
If two or three run, the output gets a bit garbled, and rancid fails to
find the end. I speculate this is something to do with the box producing
the output, but asynchronously returning the prompt, or some such.

At this point, can I also suggest this small patch, which helped me to
narrow down the cause of failure in a couple of cases (sorry no line
numbers for this one, but it is right at the end of 'rancid'):

- print STDERR "$host: End of run not found\n" if ($debug);
+ print STDERR "$host: End of run not found ",
+ "(clean_run=$clean_run, found_end=$found_end)\n" if ($debug);

Jethro.

--
. . . . . . . . . . . . . . . . . . . . . . . . .
Jethro R Binks
Computing Officer, IT Services, University Of Strathclyde, Glasgow, UK

john heasley

2009-02-02 21:44:22 UTC

Post by Jethro R Binks

Post by Jethro R Binks
I'm investigating several PIX/ASA related difficulties with rancid at the
moment ...

Since we're looking at these in detail at the moment, here's two more
As another note, it would be useful to send "term pager 0" as well, to
--- clogin.1.118 Fri Jan 30 19:40:20 2009
+++ clogin.1.118.mod Fri Jan 30 21:01:26 2009
@@ -603,6 +603,8 @@
set command "set logging session disable;$command"
} else {
send "term length 0\r"
+ send "term pager 0\r"
}
# escape any parens in the prompt, such as "(enable)"
regsub -all {[)(]} $prompt {\\&} reprompt
The other thing is that parsing of the serial numbers/hardware revisions
isn't correct. I haven't looked at this in detail yet, but what you get
!Slot 0/: type ASA 5550 Adaptive
!Slot 0/: part Security, serial Appliance
!Slot 0/: hvers ASA5550
!Slot 0: hvers 2.0, firmware 1.0(11)2, sw 7.2(4)
!
!Slot 1: hvers 1.0, firmware 1.0(0)8, sw 1.0(0)10
!
!Slot 1/0: type SSM-4GE Included with ASA
!Slot 1/0: part 5550, serial System
!Slot 1/0: hvers SSM-4GE-INC
I suppose the output generated by PIX/ASA doesn't match the usual IOS
output. If no-one else gets to it, I will take a closer look in a few
days hopefully.
One other things I would note: I find getting configs out of my PIX/ASAs
is much more reliable (but not perfect) if I only let rancid run one of
"more system:running-config", "write terminal", or "show running-config".
If two or three run, the output gets a bit garbled, and rancid fails to
find the end. I speculate this is something to do with the box producing
the output, but asynchronously returning the prompt, or some such.

I think it is time that ASA/PIX became a separate script. Trying to wedge
it in with IOS and IOX is becoming painful.

Post by Jethro R Binks
At this point, can I also suggest this small patch, which helped me to
narrow down the cause of failure in a couple of cases (sorry no line
- print STDERR "$host: End of run not found\n" if ($debug);
+ print STDERR "$host: End of run not found ",
+ "(clean_run=$clean_run, found_end=$found_end)\n" if ($debug);
Jethro.
--
. . . . . . . . . . . . . . . . . . . . . . . . .
Jethro R Binks
Computing Officer, IT Services, University Of Strathclyde, Glasgow, UK
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

john heasley

2009-02-02 21:35:30 UTC

Post by Jethro R Binks

Post by Ryan DeBerry
So rancid-run was logging in performing a write mem and then exiting.

it uses write term, not write mem, so it should not be writing the
config unless Cisco does something unusual on this device. But, we
should just filter this line like we do for IOS devices. Where does the
line appear?

I'm investigating several PIX/ASA related difficulties with rancid at the
moment, and having moved to 2.3.2a8 rancid and clogin I also see this. I
started to reply to this thread but got bogged down in looking into other
Is this the "Written by rancid at ..." line you are seeing? Having moved
to using clogin and rancid from 2.3.2a8, I see this too: it seems to be as
a result of using the output of "more system:running-config" specifically,
which is relatively new. A simple patch fixes it (applying by hand should
--- rancid.1.252 Fri Jan 23 09:07:50 2009
+++ rancid.1.252.mod Sun Feb 1 17:28:10 2009
@@ -1551,6 +1551,7 @@
# some versions have other crap mixed in with the bits in the
# block above
/^! (Last configuration|NVRAM config last)/ && next;
/^: (Written by rancid at|Saved)/ && next;
# skip consecutive comment lines to avoid oscillating extra comment
# line on some access servers. grrr.
asa1# more system:running-config
Cryptochecksum: 92e99914 e1bd90fa d62353b8 1881f920
: Saved
: Written by rancid at 22:47:44.539 UTC Sun Feb 1 2009
!
ASA Version 7.2(4)
!
hostname asa1
domain-name net.strath.ac.uk
...

I think the following patch will take care of these and the checksum
line that peter mentioned in private.

Post by Jethro R Binks
Jethro.

Post by Ryan DeBerry
So everytime you ran it, the config was different because it was

always

Post by Ryan DeBerry
saving the config.
This behavior does show up on a8.

Post by john heasley
What is changing?

Post by Peter Serwe
Correction. Occasionally I see this behavior.
I have an email from Rancid as of 53 minutes ago with this change.
I'm currently running 2.3.2a8 against 7.2(4).
Peter

Post by Peter Serwe
I'm running 7.2(4) and I don't see this behavior either.
Peter

Post by Ryan DeBerry
I am able to backup ASA config but the config changes on every

rancid-run.

Post by Ryan DeBerry
The only change is the timestamp when the config was written on the
rancid-run. Is there a way to prevent this behavior?

Interesting. I am backing up several ASAs and don't see this. What

release are