<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Signature Manager Exchange Edition on 03:07:08 Thursday, 13 July 2017 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<br>
<div class="WordSection1">
<p class="MsoNormal">Hello, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve previously had a very simple regex list configured for Cisco ASA devices to deliver email alerts on routing changes in our network, which was configured thus:-
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">filter f_sev1 { match("%ASA-3-622001"); };<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">…which works just fine. Wanting to expand this list a bit, and aware that scaling regex matching up is going to incur performance issues, I’ve thought that an “in-list” expression file might have been a better approach, and as such have
configured the following:- <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">filter f_sev1 { in-list("/etc/syslog-ng/email-match-list.list", value("PROGRAM")); };<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">…where “PROGRAM” is (I believe) the applicable part of the code that matches to the Cisco "%ASA-3-622001" part of the message. The whitelist has the following entries (as an example):-
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">%DUAL-5-NBRCHANGE<o:p></o:p></p>
<p class="MsoNormal">%ASA-3-622001<o:p></o:p></p>
<p class="MsoNormal">%SPANTREE-5-TOPOTRAP<o:p></o:p></p>
<p class="MsoNormal">%SPANTREE-5-ROOTCHANGE<o:p></o:p></p>
<p class="MsoNormal">%ASA-5-111010<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am not getting any matches here, however. What am I missing?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks very much in advance, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Damian <o:p></o:p></p>
</div>
<br>
<br>
<table class="ImprintUniqueIDTable" style="BORDER-COLLAPSE: collapse; WIDTH: 100%" cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<td><font style="font-family:Calibri;font-size:10pt;color:#1C3048;font-weight:bold;">Damian</font> <font style="font-family:Calibri;font-size:10pt;color:#1C3048;font-weight:bold;">Bell</font><br>
<font style="font-family:Calibri;font-size:10pt;color:#595959;">Infrastructure Engineer</font><font style="font-family:Calibri;font-size:10pt;color:#595959;"> |
</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">Support</font><font style="font-family:Calibri;font-size:10pt;color:#595959;"> |
</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">H Clarkson & Co Ltd</font></td>
</tr>
<tr>
<td><font style="font-family:Calibri;font-size:10pt;color:#595959;">T: </font><font style="font-family:Calibri;font-size:10pt;color:#595959;">+44 20 7334 5483</font><br>
<font style="font-family:Calibri;font-size:10pt;color:#404040;">Email: </font><span style="font-family:Calibri;font-size:10pt;color:#0070C0;"><a href="mailto:Damian.Bell@clarksons.com" title="Click to send email to Damian Bell" target="" style="font-family:Calibri;font-size:10pt;color:#0070C0;"><span style="font-family:Calibri; font-size:10pt; color:#0070C0;">Damian.Bell@clarksons.com</span></a></span><br>
<font style="font-family:Calibri;font-size:10pt;color:#595959;"><font style="font-family:Calibri;font-size:10pt;color:#595959;">Group Email:
</font></font><font style="font-family:calibri;font-size:10pt;color:#0070C0;">infrastructure@clarksons.com</font><br>
</td>
</tr>
<tr>
<td style="HEIGHT: 57px; PADDING-TOP: 15px"><font style="font-family:Calibri;font-size:16pt;color:#1C3048;"><font style="font-family:Calibri;font-size:16pt;color:#1C3048;">Clarksons Platou</font></font><font style="font-family:Calibri;font-size:10pt;color:#1C3048;"><font style="font-family:Calibri;font-size:10pt;color:#1C3048;">
TM</font></font><br>
<font style="font-family:Calibri;font-size:10pt;color:#595959;">Commodity Quay, St. Katharine Docks</font><font style="font-family:Calibri;font-size:10pt;color:#595959;"> |
</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">London</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">
</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">E1W 1BF</font><font style="font-family:Calibri;font-size:10pt;color:#595959;"> |
</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">United Kingdom</font><br>
<span style="font-family:Calibri;font-size:10pt;color:#0070C0;"><a href="http://www.clarksons.com" title="" target="" style="font-family:Calibri;font-size:10pt;color:#0070C0;"><span style="font-family:Calibri; font-size:10pt; color:#0070C0;">www.clarksons.com</span></a></span></td>
</tr>
<tr>
<td style="HEIGHT: 31px"><font style="font-family:Calibri;font-size:8pt;color:#00863D;"><font style="font-family:Calibri;font-size:8pt;color:#00863D;">Please consider the environment before printing this e-mail</font></font></td>
</tr>
<tr>
<td style="HEIGHT: 25px; PADDING-TOP: 10px"></td>
</tr>
</tbody>
</table>
<br>
<br>
<p class="ImprintUniqueID"><font size="1"></p>
<hr>
</font><font face="Microsoft Sans Serif" size="1">This message is private and confidential. If you have received it in error, you are on notice of its status. Please notify us immediately by reply email and then delete this message from your system. Please
do not copy it or use it for any purposes, or disclose its contents to any other person: to do so could be a breach of confidence.<br>
<br>
</font><font face="Microsoft Sans Serif" size="1">Emails may be monitored.<br>
<br>
Details of Clarkson group companies and their regulators (where applicable) can be found at this url:
</font><a title="Disclosure" href="http://www.clarksons.com/disclosure/"><font face="Microsoft Sans Serif" size="1">Disclosure</font></a>
<hr>
<p></p>
</body>
</html>