Sign in to follow this  
David Lee

Configsources ignore all but one line check

Recommended Posts

Configuration backups in LogicMonitor is a great feature to help you be aware of changes being made ,store version history and restore your device configurations.

Newer devices are can have subscriptions that pull the latest data from the manufacturer, such as malicious IP address lists.  Encrypted information may be re-hashed for added security and these are expected behaviours - NOT a config change.  So you need to ignore these changes, as they are not operational changes and you do not need to be woken at 3 in the morning to see that there are some newly added malicious Ip addresses.

 

Is there a way to ignore these updates (often multiple in a day) and simply key on the first few lines where the config version is referenced ?

#config-version=whateverversioninfo

#conf_file_ver=177424565748364543

#buildno=somebuildno

 

We need to alert on line 2 and ignore every other change.

As you are no doubt aware you can edit your configsource to ignore certain lines with regex.So you can add an ignore change for lines that contain builldno for example. But stipulating every line except one would be a nightmare and you never know what the lines contain all the time. So flip it on its head. 

Make an ignore check, select ignore lines with this regular expression and use the expression !("#conf_file_ver=").Basically this means ignore every line that does not contain #conf_file_ver=

image.thumb.png.b3ea7a49dadbd8aaf03aa5ed59a89078.png

You can see in my example above I have changed the file version and it is shows and is alerted on, but I have also changed the buildno and that is ignored, also added a newline which is ignored.

image.thumb.png.702becedab5f21a0c62867dcd2a7606c.png

 

 

David

Share this post


Link to post
Share on other sites
Guest
You are commenting as a guest. If you have an account, please sign in.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this