UIM 20.3 - all alarms are matched by Nas auto-operator (AO) with regex

Products

• DX Infrastructure Management

Issue/Introduction

After upgrade to 20.3 (running nas 9.31) all my alarms are automatically matched by an auto-operator rule in the NAS.

Why is this occurring?

 

In the NAS I'm seeing the following errors:

 

                Feb  8 12:06:07:690 [427596] 0 nas: Regex Issue : regex compilation error 
                Feb  8 12:06:07:690 [427596] 0 nas: _corrTriggerMatchAlarmPDS:: Regex Issue - regex compilation error 

 

 

 

Cause

As per the KB UIM 20.3 - nas 9.31 changes in regular expression matching criteria starting nas 9.31, regex is used instead of pattern matching to match alarms. This represents a change with respect to the previous pattern matching.

 

Additionally to this change, there currently is a defect in the probe where if a regex complication mistake is done, all alarms will be matched. 

If the regex string defined in the NAS contains an invalid REGEX format the nas will log the following: 

 

              Feb  8 12:06:07:690 [427596] 0 nas: Regex Issue : regex compilation error 
                Feb  8 12:06:07:690 [427596] 0 nas: _corrTriggerMatchAlarmPDS:: Regex Issue - regex compilation error 

 

And it will match ALL alarms for that rule

 

•    NAS 9.30 or earlier uses pattern matching

•  NAS 9.31 and later uses REGEX + nas 9.31 has a DEFECT(DE482613)  described in this KB

 

 

 

Environment

Release : 20.3

Component : UIM NAS

Resolution

To Resolve the issue, the regex defined in the nas for any AO rule or Pre-processing rule must be validated and must NOT include any regex complication error. 

You can validate if there is any error in your expression in any online Regex validator:

Exampl using:

https://regex101.com/ 

 

Below an example of a correct REGEX 

Regular Expression: /3.1.2.1.*/

Correctly matches the string: 3.1.2.1.3

 

 

Example of compilation error:

Regular Expression: /3.1.2.1(*/

Pattern Error on matching string: 3.1.2.1.3

 

* If a pattern error string is used, the NAS will improperly match all alarms. 

 

This issue is currently being worked on (DE482613). A future release of NAS a fix will prevent the wrong allarm matching that occurs when an invalid regex is entered. 

Additional Information

Related KB:

UIM 20.3 - nas 9.31 changes in regular expression matching criteria 

https://knowledge.broadcom.com/external/article?articleId=202285