UIM 20.3 - all alarms are matched by Nas auto-operator (AO) with regex

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

After upgrade to 20.3 (running nas 9.31) all my alarms are automatically matched by an auto-operator rule in the NAS.

Why is this occurring?

 

In the NAS I'm seeing the following errors:

 

                Feb  8 12:06:07:690 [427596] 0 nas: Regex Issue : regex compilation error 
                Feb  8 12:06:07:690 [427596] 0 nas: _corrTriggerMatchAlarmPDS:: Regex Issue - regex compilation error 

 

 

 

Cause

As per the KB UIM 20.3 - nas 9.31 changes in regular expression matching criteria starting nas 9.31, regex is used instead of pattern matching to match alarms. This represents a change with respect to the previous pattern matching.

 

Additionally to this change, there currently is a defect in the probe where if a regex complication mistake is done, all alarms will be matched. 

If the regex string defined in the NAS contains an invalid REGEX format the nas will log the following: 

 

              Feb  8 12:06:07:690 [427596] 0 nas: Regex Issue : regex compilation error 
                Feb  8 12:06:07:690 [427596] 0 nas: _corrTriggerMatchAlarmPDS:: Regex Issue - regex compilation error 

 

And it will match ALL alarms for that rule

 

•    NAS 9.30 or earlier uses pattern matching

•  NAS 9.31 and later uses REGEX + nas 9.31 has a DEFECT(DE482613)  described in this KB

 

 

 

Environment

Release : 20.3

Component : UIM NAS

Resolution

To Resolve the issue, the regex defined in the nas for any AO rule or Pre-processing rule must be validated and must NOT include any regex complication error. 

You can validate if there is any error in your expression in any online Regex validator:

Exampl using:

https://regex101.com/ 

 

Below an example of a correct REGEX 

Regular Expression: /3.1.2.1.*/

Correctly matches the string: 3.1.2.1.3

 

 

Example of compilation error:

Regular Expression: /3.1.2.1(*/

Pattern Error on matching string: 3.1.2.1.3

 

* If a pattern error string is used, the NAS will improperly match all alarms. 

 

This behaviour is being resolved in NAS 9.32HF1:

CAUIM HOTFIX Repository

nas 9.32 HF1

Solution Document: LU00962

• Component: UNIFIED INFRASTRUCTURE MGMT
• Release: 20.3.3
• Hiper: NO
• Operating System: MULTI-PLATFORM

• Status: CONFIRMED
• Distribution Code: AVAILABLE
• Opened Date: 04/16/2021
• Closed Date: 04/16/2021

 

 PROBLEM DESCRIPTION

 

Applicable for: UIM 20.3 (nas 9.31) and UIM 20.3.3 (nas 9.32)

Issues Fixed:
=============

1. UIM 20.3 - nas 9.31 changes in pattern/regular expression matching behavior

Reason: Prior to nas 9.31 (i.e. nas 9.30 or below), nas supported pattern/regex matching. With nas 9.31 we started supporting regular expressions only.

Resolution: With this hotfix, we provide a configuration parameter which will allow to select either both pattern/regex matching or only regular expressions matching. The below configuration parameter is provided:
Key used:
Configuration - Raw config under setup
UseRegexOnly = no (default, both pattern/regex matching)
             = yes (regex matching only)

Additional details:
- UseRegexOnly = no (default, both pattern/regex matching) 
Behavior similar to nas 9.30 and below

REGEX MATCHING:
If the pattern is starting and ending with a DELIMITER / (slash), it is treated as a true regular expression. Otherwise, it is treated as a pattern matching as described below.

PATTERN MATCHING:
The pattern matching mimics the below wildcard matching behavior. 
An asterisk (*)  matches one or more occurrences of any character, including no character.
Question mark (?)  represents or matches a single occurrence of any character.
Bracketed characters ([ ])  matches any occurrence of character enclosed in the square brackets.

Additionally, the tokens '/' '(' ')' and '.' in the pattern are treated as same character literally (not as pattern tokens) if they are not within [].

- UseRegexOnly = yes (regex matching only)
The expression is treated as a regular expression that is compliant with PCRE. It would be similar to expressions that can be checked with https://regex101.com/. The expectation is that the user provides only the regular expression without DELIMITER or FLAGS. Internally no flags are set.
For e.g. If you need to provide a regular expression you should not start and end with a delimiter like '/'.

If the regular expression is "file.*txt", you need to directly provide "file.*txt" but NOT "/file.*txt/" where / is a DELIMITER. This regular expression would match strings like "fil.txt", "fileeee.txt", "filxtxt", etc.

Regular expression validator in NAS UI will take only single regular expression as input for validation. Space and comma are NOT considered as seperators for providing multiple expressions.

Steps to apply the patch:
1. Import the zip into the local archive.
2. Deploy the imported package to the robot/hub.

Additional Information

Related KB:

UIM 20.3 - nas 9.31 changes in regular expression matching criteria 

https://knowledge.broadcom.com/external/article?articleId=202285