Configsources ignore all but one line check | Archive

David_Lee · 2017-12-05T10:01:13Z

Configuration backups in LogicMonitor is a great feature to help you be aware of changes being made ,store version history and restore your device configurations. Newer devices are can have subscriptions that pull the latest data from the manufacturer, such as malicious IP address lists. Encrypted information may be re-hashed for added security and these are expected behaviours - NOT a config change. So you need to ignore these changes, as they are not operational changes and you do not need to be woken at 3 in the morning to see that there are some newly added malicious Ip addresses. Is there a way to ignore these updates (often multiple in a day) and simply key on the first few lines where the config version is referenced ? #config-version=whateverversioninfo #conf_file_ver=177424565748364543 #buildno=somebuildno We need to alert on line 2 and ignore every other change. As you are no doubt aware you can edit your configsource to ignore certain lines with regex.So you can add an ignore change for lines that contain builldno for example. But stipulating every line except one would be a nightmare and you never know what the lines contain all the time. So flip it on its head. Make an ignore check, select ignore lines with this regular expression and use the expression !("#conf_file_ver=").Basically this means ignore every line that does not contain #conf_file_ver= You can see in my example above I have changed the file version and it is shows and is alerted on, but I have also changed the buildno and that is ignored, also added a newline which is ignored. David

MoreDiscussions

Configsources ignore all but one line check | Archive | LogicMonitor Community