Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Network Automation and Compliance (NetMRI)


Stumped over CCS double pattern match

Posts: 69
691     0

I'm stumped at how to get the following CCS pattern capture to work as desired.

regex_test in NetMRI does a double capture of a match.


I need to capture the interface name, the descripion (which may be blank), the interface status and the SFP type at the end.
Sample device outputs:
Gi6/0/47     P_C320             notconnect   1            full   1000 1000BaseSX SFP
Twe1/0/17                       disabled     routed       full    10G SFP-10GBase-SR
Twe1/0/1     asROUTR1 Te2/0/5   notconnect   routed       full    10G SFP-10GBase-SR
Twe1/0/18                       disabled     routed       full    10G SFP-10GBase-SR
Te3/0/6      Testing Netbackup  notconnect   750          full    10G SFP-10GBase-SR
Eth1/32       --                disabled     routed    auto    auto    10Gbase-LR


$Interface /^[\w/\s]{11}/
$Description /[\w\s-]{18}/
$Int_status /(disabled|notconnec(t)?)/
$Transceiver /((SFP-)?\d+(G)?Base[-A-Z]+)/

[[$Interface]] [[$Description]] [[$Int_status]] \s(\d+|routed)\s+(full|auto)\s+\w+ [[$Transceiver]]


The NetMRI regex_test produces:
(Tw1/0/17 ) (...............) (disabled) (disabled)

Regex101 pattern:
(disabled|notconnec(t)?) \s(\d+|routed)\s+(full|auto)\s+\w+ ((SFP-)?\d+(G)?[Bb]ase[-A-Z]+)
Regex101 result:
Match 1 32-84 disabled routed full 10G SFP-10GBase-SR
Group 1 32-40 disabled
Group 3 45-51 routed
Group 4 58-62 full
Group 5 70-84 SFP-10GBase-SR
Group 6 70-74 SFP-


I've tried plenty of tweaks, including adding a variable called $Filler to just capture the exact number of characters to ignore.


Showing results for 
Search instead for 
Did you mean: 

Recommended for You