After upgrade to 20.3 (running nas 9.31) all my alarms are automatically matched by an auto-operator rule in the NAS.
Why is this occurring?
In the NAS I'm seeing the following errors:
Feb 8 12:06:07:690 [427596] 0 nas: Regex Issue : regex compilation error
Feb 8 12:06:07:690 [427596] 0 nas: _corrTriggerMatchAlarmPDS:: Regex Issue - regex compilation error
As per the KB UIM 20.3 - nas 9.31 changes in regular expression matching criteria starting nas 9.31, regex is used instead of pattern matching to match alarms. This represents a change with respect to the previous pattern matching.
Additionally to this change, there currently is a defect in the probe where if a regex complication mistake is done, all alarms will be matched.
If the regex string defined in the NAS contains an invalid REGEX format the nas will log the following:
Feb 8 12:06:07:690 [427596] 0 nas: Regex Issue : regex compilation error
Feb 8 12:06:07:690 [427596] 0 nas: _corrTriggerMatchAlarmPDS:: Regex Issue - regex compilation error
And it will match ALL alarms for that rule
• NAS 9.30 or earlier uses pattern matching
• NAS 9.31 and later uses REGEX + nas 9.31 has a DEFECT(DE482613) described in this KB
Release : 20.3
Component : UIM NAS
To Resolve the issue, the regex defined in the nas for any AO rule or Pre-processing rule must be validated and must NOT include any regex complication error.
You can validate if there is any error in your expression in any online Regex validator:
Exampl using:
https://regex101.com/
Below an example of a correct REGEX
Regular Expression: /3.1.2.1.*/
Correctly matches the string: 3.1.2.1.3
Example of compilation error:
Regular Expression: /3.1.2.1(*/
Pattern Error on matching string: 3.1.2.1.3
* If a pattern error string is used, the NAS will improperly match all alarms.
This issue is currently being worked on (DE482613). A future release of NAS a fix will prevent the wrong allarm matching that occurs when an invalid regex is entered.
Related KB:
UIM 20.3 - nas 9.31 changes in regular expression matching criteria
https://knowledge.broadcom.com/external/article?articleId=202285