mirror/nttgin-BGPalerter
1
0
Fork 0
mirror of https://github.com/nttgin/BGPalerter.git synced 2024-05-19 06:50:08 +00:00
Code Issues Releases Wiki Activity

better documentation for path matching, explain regex (#318)

Browse Source
This commit is contained in:
Massimo Candela
2020-09-14 21:32:58 +02:00
parent 427c17333b
commit b57b0824df
3 changed files with 74 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/configuration.md
View File

@@ -174,7 +174,7 @@ Parameters for this monitor module:
|maxDataSamples| Maximum number of collected BGP messages for each alert which doesn't reach yet the `thresholdMinPeers`. Default to 1000. As soon as the `thresholdMinPeers` is reached, the collected BGP messages are flushed, independently from the value of `maxDataSamples`.|
#### monitorPath
``
This monitor detects BGP updates containing AS_PATH which match particular regular expressions.
> Example:
@@ -185,14 +185,20 @@ This monitor detects BGP updates containing AS_PATH which match particular regul
> description: an example on path matching
> ignoreMorespecifics: false
> path:
> match: ".*2194,1234$"
> notMatch: ".*5054.*"
> matchDescription: detected scrubbing center
> - match: ".*2194,1234$"
> notMatch: ".*5054.*"
> matchDescription: detected scrubbing center
> - match: ".*123$"
> notMatch: ".*5056.*"
> matchDescription: other match
> ```
> An alert will be generated when a BGP announcements for 165.254.255.0/24 or a more specific contains an AS_PATH
> terminating in 2194,1234 but not containing 5054. The generated alert will report the matchDescription field.
More path matching options are available, see the entire list [here](prefixes.md#prefixes-fields)
Path is a list of matching rules, in this way multiple matching rules can be defined for the same prefix (rules are in OR).
More about path matching [here](path-matching.md).
> An alert will be generated for example when a BGP announcements for 165.254.255.0/24 or a more specific contains an AS_PATH
> terminating in 2194,1234 but not containing 5054. The generated alert will report the matchDescription field.
Example of alert:
> Matched "an example on path matching" on prefix 98.5.4.3/22 (including length violation) 1 times