Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[MX/PTX] Using the 'resource-filter' command with JTI sensors

0

0

Article ID: KB37491 KB Last Updated: 28 Sep 2021Version: 1.0
Summary:

This article demonstrates how a resource-filter associated with an PFE IFD telemetry sensor can be composed, verified and used. Although this example is primarily focused on the PFE IFD counters sensor (/junos/system/linecard/interface/), a similar logic can be applied while working with different type of JTI sensors.

Solution:

By default, no resource-filters are applied to JTI sensors, therefore all interfaces suitable for exporting the data are considered. Typically, these are:

  • Ethernet interfaces (ge-, xe-, et-);
  • Tunnel interfaces (vt-, lt-, gr-, lsi-);
  • RP encaps/decaps (pe-, pd-), and some others.

Note: For LAG interfaces, stats are exported from the corresponding member links (physical).

There are two approaches for composing a regex used in the resource-filter:

  1. Explicitly specify the interfaces to retrieve stats from. The remaining interfaces won't be considered by the sensor.

    The regex engine is based on the modified regex(3) BSD-library. The following expressions are confirmed to be working:

    • A wildcard "*"

      resource-filter "^ge-.*"                /* Only the GE-interfaces            */
      resource-filter "^ge-0/0/.*"            /* Only the GE-interfaces in MIC 0/0 */
    • A character class "[ ]"

      resource-filter "^ge-0/1/[03]"          /* Only interfaces ge-0/1/0 and ge-0/1/3 */
    • A character class with a range "[ - ]"

      resource-filter "^ge-0/0/[0-3]"         /* Only the first four GE-interfaces in MIC 0/0 */
    • An inverted character class "[^ ]"

      resource-filter "^[a-z][^e]-.*"         /* The second letter in the ifname is not "e" */
    • Alternation

      resource-filter "^(ge|xe|et)-.*"        /* Only Ethernet interfaces */
  2. Exclude some interfaces from the data reports.

    Note: The operation of negation "!" is not a part of the native regex syntax. Instead, it was added as an extension to the regex parser in 16.1 and only allowed at the very first position in a regular expression.
    When the parser encounters the "!" meta-character in the beginning of a regex, it advances the pointer one symbol further and continues handling the rest of the expression. Once the regex is compiled, its result is negated during the application.

    Examples:

    resource-filter "!(^ps.*)"                  /* Exclude ps-interfaces     */
    resource-filter "!(^(pd|pe|gr|ip)-.*)"      /* Exclude PIM, GRE and IPIP interfaces */

    WARNING: If a resource-filter does not match any interface, no data are exported by the sensor. Thus, failing to create a valid regex will effectively makes the sensor unusable. The following techniques help ensure the regex is composed correctly and yields the expected results.

    A reference configuration:

    services {
        analytics {
            sensor IFD-STATS {
                server-name COLLECTOR_LAB;
                export-name EVERY_30_SEC;
                resource /junos/system/linecard/interface/;
                resource-filter "ge-0/1/[0-1]";
            }
        }
    }

    A regex can be tested before a resource-filter is applied to a sensor:

    ukern_CLI # test agent filter $ $

    VMX-0(R2 vty)# test agent filter "^ge-0/1/[0-1]" "ge-0/1/0"
    Agent Filter: regex: (^ge-0/1/[0-1]) applied to: (ge-0/1/0) == TRUE

    VMX-0(R2 vty)# test agent filter "^ge-0/1/[0-1]" "ge-0/1/1"
    Agent Filter: regex: (^ge-0/1/[0-1]) applied to: (ge-0/1/1) == TRUE

    VMX-0(R2 vty)# test agent filter "^ge-0/1/[0-1]" "ge-0/1/2"
    Agent Filter: regex: (^ge-0/1/[0-1]) applied to: (ge-0/1/2) == FALSE

    Once the resource-filter has been applied, the operational status of the sensor can be verified:

    • Get the sensor ID first

    VMX-0(R2 vty)# show agent sensors

     Jvision ID  Name
     ----------  --------------------------------
      539528113  sensor_1002           0(0)
      539528114  sensor_1001           0(0)
     1595622898  IFD-STATS             5000(750)
     2277069355  __default_fabric_sensor__  5000(82)
    [snip]
    • The interfaces considered by the sensor are:

    VMX-0(R2 vty)# show agent sensors id 1595622898 filter
    ge-0/1/0
    ge-0/1/1
    • The data associated with and exported by the sensor

    VMX-0(R2 vty)# show agent sensors id 1595622898
    ID: 1595622898 Type: 1 Name: (IFD-STATS)
    Sensor Data: 779(751) bytes
    Jvision Header: system: R2:198.18.100.2, slot: 0, time: Sep  9 09:26:36.438, sequence_number: 1, sensor_name: IFD-STATS:/junos/system/linecard/interface/:/junos/system/linecard/interface/:PFE, version: 1.1
    Interface = ge-0/1/0 (537)
    [snip]

     In Packets = 7316 (0 pkts/sec) Bytes = 3033543 (0 bytes/sec)
     UPackets = 154505  MPackets = 0 BPackets = 0
     RX Error Packets = 0
     In Pause Packets = 0
     Out Packets = 10746 (0 pkts/sec) Bytes = 8444457 (1 bytes/sec)
     UPackets = 154468  MPackets = 0 BPackets = 0
     TX Error Packets = 0
     Out Pause Packets = 0
    [snip]

    Interface = ge-0/1/1 (538)
    [snip]

     In Packets = 104922 (272 pkts/sec) Bytes = 32969149 (389198 bytes/sec)
     UPackets = 0  MPackets = 0 BPackets = 0
     RX Error Packets = 0
     In Pause Packets = 0
     Out Packets = 66956 (272 pkts/sec) Bytes = 27259260 (389207 bytes/sec)
     UPackets = 0  MPackets = 0 BPackets = 0
     TX Error Packets = 0
     Out Pause Packets = 0
    [snip]

            Export: Interval = 30000 msecs, Payload-size = 5000 bytes, Server = Src: 198.18.100.2:1000, Dst: 198.18.100.1:11017(VRF 0) , Qos = TOS:0x0, Hint:0x40000010, FC:0 PLP:0
            Filter: ge-0/1/[0-1]

            Accounting:
                  2726 total successful reaps, 0 failed/aborted reap(s).
                     1 reaps in latest reporting interval.
                     1 packets in latest reporting interval.
                     2 instances in latest reporting interval.
                  2726 total packets sent.
                  2726 wraps, 1 reap(s) on average to wrap.
    [snip]
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search