How to configure a Spectrum Event Condition rule when there are special characters

Products

• Spectrum
• Network Observability

Issue/Introduction

I have an event where one of the event variables has a string of text that has special characters. I need to configure an Event Condition rule that includes these special characters. How do I configure the Event Condition rule for special characters?

The following is an example of the text in the event variable:

Lost network connectivity on virtual switch "VSwitchUSB0". Physical NIC vusb0 is down. Affected portgroups:"IMM_Network0".

I need to write an Event Condition rule looking for Affected portgroups:"IMM_Network0". My attempts have failed because of the special characters in the text. Specifically the double quote " in the middle.

Environment

Release: All Supported Releases
Component: SPCAEM - Events and Alarms

Resolution

The problem is with the double quote character " in the text you are trying to parse out. The double quote needs to be escaped with a \ so it treats it as a regular character and not a meta-character. I tested the following in the lab and it seems to work:

 

0xfff00000 E 0 R CA.EventCondition, "(regexp({v 1}, {S \"Affected portgroups:\\\"IMM_Network0\"}))" , "0xfff00001  -:-"

 

Reference the following from the docs:

\ Used as a general escape character letting you to  use the literal meaning of a metacharacter. When you use the escape character within the regular expression, you must be sure to also consider the necessary escape characters to be used within the context of the string and the condition.

This example searches for the string “172.55” within event variable 1: “regexp({ VARDATA 1 }, { S\“172\\\\.55\” })” Because the . character is usually treated as a meta-character within a regular expression, it is necessary to use the escape character (a backslash) to indicate that you would like the . to be treated literally. At the regular expression level, this yields the following syntax: 172\.55. However, since you are using this regular expression within a string, you must precede the backslash with an additional backslash. Reading the expression from left to right, the first backslash represents the escape character needed to escape the second backslash within the string. This yields the following syntax: 172\\.55. Additionally, you are using the string within the context of the condition, therefore each existing \ must have a corresponding backslash to be used as an escape. This yields the following syntax: 172\\\\.55.

Additional Information

Reference the "Working with Event Rules" section of the documentation for more information.