Filter
Top Products
751 | ExternalServicesInterface DellPowerConnectW-SeriesArubaOS6.2 | User Guide
The ESI syslog parser begins with a list of configured IP interfaces which listen for ESI messages. When a syslog
message is received, it is checked against the list of defined ESI servers. If a server match is found, the message is
then tested against the list of predefined rules.
Within the rule-checking process, the incoming message is checked against the list of rules to search first for a
condition match (see "Syslog Parser Rules" on page 751). If a condition match is made, and the user name can be
extracted from the syslog message, the resulting user action is processed by first attempting to look up the user in
the local user table. If the user is found, the appropriate action is taken on the user. The default behavior is to look
for users only on the local controller. If the user is not found, the event is meaningless and is ignored. This is the
typical situation when a single controller is connected to a dedicated ESI server.
Peer Controllers
As an alternative, consider a topology where multiple Dell controllers share one or more ESI servers.
Figure 346: ESI Peer Controllers
In this scenario, several Dell controllers (master and local) are defined in the same syslog parser domain to act as
peers
. From the standpoint of the ESI servers, because there is no accurate way of determining from which controller
a given user came. Thus, the event is flooded out to all Dell controllers defined as peers within this ESI parser
domain. The corresponding controller holding the user entry acts on the event, while other Dell controllers ignore the
event.
Syslog Parser Rules
The user creates an ESI rule by using characters and special operators to specify a pattern (regular expression) that
uniquely identifies a certain amount of text within a syslog message. (Regular expression syntax is described in
"Understanding Basic Regular Expression (BRE) Syntax" on page 771.) This “condition” defines the type of message
and the ESI domain to which this message pertains. The rule contains three major fields:
l Condition: The pattern that uniquely identifies the syslog message type.
l User: The username identifier. It can be in the form of a name, MAC address, or IP address.
l Action: The action to take when a rule match occurs.
Once a condition match has been made, no further rule-matching will be made. For the rule that matched, only one
action can be defined.
After a condition match has been made, the message is parsed for the user information. This is done by specifying
the target region with the regular expression (REGEX) regex() block syntax. This syntax generates two blocks: The