[rancid] FW: routers router config diffs

Discussion:

Chris Gauthier

2011-04-27 22:17:07 UTC

Anyone seen this issue with rancid and Cisco IOS 15.0? I tried to find out which version of rancid I have, but I cannot seem to find it. Anyway, here is the behavior and it is really annoying since the only change is that file. This seems a lot like the earlier ASA "crashdump" issue that they had. I don't want to see these all the time.

Thanks,

Chris

Index: configs/10.0.1.9
============================================================= ======
retrieving revision 1.15
diff -U 4 -r1.15 10.0.1.9
@@ -26,11 +26,11 @@
!Flash: 9 0 Nov 05 2010 00:07:16 syslog
!Flash: 11 6523 Nov 05 2010 00:11:44 startup-config-20101104_1711
!Flash: 12 261987 Apr 20 2011 06:12:00 syslog/log_20110416-121956
!Flash: 13 258273 Apr 25 2011 00:01:08 syslog/log_20110420-001701
- !Flash: 14 120840 Apr 27 2011 17:41:12 syslog/log_20110424-202035
+ !Flash: 14 124993 Apr 27 2011 19:01:12 syslog/log_20110424-202035
!Flash: 16 258002 Apr 16 2011 17:40:18 syslog/log_20110413-001319
- !Flash: 221515776 bytes available (36225024 bytes used)
+ !Flash: 221511680 bytes available (36229120 bytes used)
!

!Flash: nvram: Directory of nvram:/
!Flash: nvram: 244 -rw- 6605 <no date> startup-config
!Flash: nvram: 245 ---- 3573 <no date> private-config

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
CONFIDENTIALITY NOTICE
Attention: The information contained in this email and/or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy any copies.

Chris Moody

2011-04-28 01:08:55 UTC

Permalink

<NOTICE - anyone on the list that does not approve of customizations,
PLEASE pardon what I'm about to say. I'm simply trying to offer a hand>

Chris,

Yes - I have run into behaviors like this for our Nexus deployments. I
was even seeing some log file for the CPM module (with 0 bytesize)
getting "touch"ed by the OS periodically...making it show up as
something new/different. Annoying is putting it kindly. Particularly
when you cannot control the behavior....but I digress.

What we (I) did to rectify the problem was to add some "exclusions" into
the nxrancid routine. (not sure if you're using cisco or cisco-nx device
types). It involves some -very- simple programming to modify the code
to suit your needs. I'm writing this assuming little programming skills
on your part for the sake of assumption. If you're more 1337, then
pardon my simplification.

Copy the original executable to something like nxrancid-ORIG so that you
have a working backup BEFORE making any changes. Fire up 'vi' and you
scroll down through the code to the stanza that's running the command(s)
that are triggering the output. For the sake of this discussion, let's
say it's the 'DirSlotN' subroutine that's running the command 'dir
logflash' which is causing this output. Find the subroutine 'DirSlotN'
and then you'll need to insert a command before the 'ProcessHistory'
line that will cause the routine to skip over the output line(s) that
are causing you a problem.

ex>
----------------------------------------------------
scroll down to here...
# This routine parses "dir /all ((disk|slot)N|bootflash|nvram):"
sub DirSlotN {
print STDERR " In DirSlotN: $_" if ($debug);

my($dev) = (/\s([^\s]+):/);

while (<INPUT>) {
===<output truncated>===
after these lines... but before this line...

ProcessHistory("FLASH","","","!Flash: $dev: $_");

----------------------------------------------------
You should find some space just before the ProcessHistory line.

So, for your particular issue, you'd insert a perl code statement like so:

/syslog\/log_20/ && next;

What this accomplishes is, via regex, any line that pattern matches
'syslog/log_20' will get jumped over and ignored.

I know this is a hack, but it's what solved our issues. Just be SURE to
save a copy of the modifications & note someplace that this has been
modified or you will run into trouble if/when you upgrade and it gets
overwritten.

If you need help with any specifics, please feel free to shoot me an
email off-list (so as not to spam people with customizations)

Cheers,
-Chris

Post by Chris Gauthier
Anyone seen this issue with rancid and Cisco IOS 15.0? I tried to find out which version of rancid I have, but I cannot seem to find it. Anyway, here is the behavior and it is really annoying since the only change is that file. This seems a lot like the earlier ASA "crashdump" issue that they had. I don't want to see these all the time.
Thanks,
Chris
Index: configs/10.0.1.9
============================================================= ======
retrieving revision 1.15
diff -U 4 -r1.15 10.0.1.9
@@ -26,11 +26,11 @@
!Flash: 9 0 Nov 05 2010 00:07:16 syslog
!Flash: 11 6523 Nov 05 2010 00:11:44 startup-config-20101104_1711
!Flash: 12 261987 Apr 20 2011 06:12:00 syslog/log_20110416-121956
!Flash: 13 258273 Apr 25 2011 00:01:08 syslog/log_20110420-001701
- !Flash: 14 120840 Apr 27 2011 17:41:12 syslog/log_20110424-202035
+ !Flash: 14 124993 Apr 27 2011 19:01:12 syslog/log_20110424-202035
!Flash: 16 258002 Apr 16 2011 17:40:18 syslog/log_20110413-001319
- !Flash: 221515776 bytes available (36225024 bytes used)
+ !Flash: 221511680 bytes available (36229120 bytes used)
!

!Flash: nvram: Directory of nvram:/
!Flash: nvram: 244 -rw- 6605<no date> startup-config
!Flash: nvram: 245 ---- 3573<no date> private-config

john heasley

2011-04-29 16:23:30 UTC

Permalink

I dont have any r15 boxes. Is this something you have configured (or auto-
configured by the upgrade) or just a new "feature" of 15? is there other
stuff in the syslog dir, besides these log files?

Post by Chris Gauthier
Chris
Index: configs/10.0.1.9
============================================================= ======
retrieving revision 1.15
diff -U 4 -r1.15 10.0.1.9
@@ -26,11 +26,11 @@
!Flash: 9 0 Nov 05 2010 00:07:16 syslog
!Flash: 11 6523 Nov 05 2010 00:11:44 startup-config-20101104_1711
!Flash: 12 261987 Apr 20 2011 06:12:00 syslog/log_20110416-121956
!Flash: 13 258273 Apr 25 2011 00:01:08 syslog/log_20110420-001701
- !Flash: 14 120840 Apr 27 2011 17:41:12 syslog/log_20110424-202035
+ !Flash: 14 124993 Apr 27 2011 19:01:12 syslog/log_20110424-202035
!Flash: 16 258002 Apr 16 2011 17:40:18 syslog/log_20110413-001319
- !Flash: 221515776 bytes available (36225024 bytes used)
+ !Flash: 221511680 bytes available (36229120 bytes used)
!

!Flash: nvram: Directory of nvram:/
!Flash: nvram: 244 -rw- 6605 <no date> startup-config
!Flash: nvram: 245 ---- 3573 <no date> private-config

Chris Gauthier

2011-04-29 16:25:13 UTC

Permalink

Hi John,

This, I think, is a "feature" of 15.x. What is odd is that it is a Cisco 891 running 15.0, but my fleet of 2811's are also running 15.x and they're not exhibiting this behavior. I'll report back to the list with more soon.

Side question: how do I determine which version of rancid is installed? I *think* it might be 2.3.2, but I seem to remember upgrading, too. It was installed by hand.

Chris Gauthier, CCNA Security
Network Administrator
Maps Credit Union
v: 503.588.0181 x3401
f: 503.779.1083
https://www.mapscu.com

-----Original Message-----
Sent: Friday, April 29, 2011 9:24 AM
To: Chris Gauthier
Subject: Re: [rancid] FW: routers router config diffs

Post by Chris Gauthier
Anyone seen this issue with rancid and Cisco IOS 15.0? I tried to find out

which version of rancid I have, but I cannot seem to find it. Anyway, here is the
behavior and it is really annoying since the only change is that file. This seems a
lot like the earlier ASA "crashdump" issue that they had. I don't want to see
these all the time.
I dont have any r15 boxes. Is this something you have configured (or auto-
configured by the upgrade) or just a new "feature" of 15? is there other stuff in
the syslog dir, besides these log files?

Post by Chris Gauthier
Chris
Index: configs/10.0.1.9

=============================================================
======

Post by Chris Gauthier
!Flash: 9 0 Nov 05 2010 00:07:16 syslog
!Flash: 11 6523 Nov 05 2010 00:11:44 startup-config-20101104_1711
!Flash: 12 261987 Apr 20 2011 06:12:00 syslog/log_20110416-121956
!Flash: 13 258273 Apr 25 2011 00:01:08 syslog/log_20110420-001701
- !Flash: 14 120840 Apr 27 2011 17:41:12 syslog/log_20110424-202035
+ !Flash: 14 124993 Apr 27 2011 19:01:12 syslog/log_20110424-202035
!Flash: 16 258002 Apr 16 2011 17:40:18 syslog/log_20110413-001319
- !Flash: 221515776 bytes available (36225024 bytes used)
+ !Flash: 221511680 bytes available (36229120 bytes used)
!

!Flash: nvram: Directory of nvram:/
!Flash: nvram: 244 -rw- 6605 <no date> startup-config
!Flash: nvram: 245 ---- 3573 <no date> private-config

intended only for the person or entity to which it is addressed and may contain
confidential and/or privileged material. Any review, retransmission,
dissemination or other use of, or taking of any action in reliance upon, this
information by persons or entities other than the intended recipient is
prohibited. If you received this in error, please contact the sender and delete the
material from any system and destroy any copies.

Post by Chris Gauthier
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

john heasley

2011-04-29 17:03:06 UTC

Permalink

Post by Chris Gauthier
Hi John,
This, I think, is a "feature" of 15.x. What is odd is that it is a Cisco 891 running 15.0, but my fleet of 2811's are also running 15.x and they're not exhibiting this behavior. I'll report back to the list with more soon.

a few recent IOS/XRs have had debug collecting files mistakingly left in
shipped code or configured by default. this may be another case of that
problem. you might tell cisco about the issue if you find it is plaform
specific.

Post by Chris Gauthier
Side question: how do I determine which version of rancid is installed? I *think* it might be 2.3.2, but I seem to remember upgrading, too. It was installed by hand.

rancid -V or -V option to any of the login or clogin scripts post 2.3.1 or so.