Extracting Cisco Interfaces for duplex mismatch

[pnelson]

I have been trying now for the past couple weeks to get the IFX to work like I want it to and hoping someone can help from here.

Issue is sometimes we have duplex mismatches on the network and we would like to see that before instead of after.

When doing the IFX I get the following rex command.

rex "(?i) .*? (?P<FIELDNAME>\\w+/\\d+)(?=,)"

Sample event:

May 25 17:21:59 XXX.XXX.XXX 709399: May 25 17:21:58.912 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet0/1 (not full duplex), with _acc_sw01 GigabitEthernet1/0/8 (full duplex).

It works fine until I ask it to just look for the following %CDP-4-DUPLEX_MISMATCH which is specific to Cisco saying that the interface after it is in a state that does not match the state on the other side for duplex.

Would anyone have any suggestions on how to correct this problem?

[dwaddle]

I would probably write my own regex for this, probably something like:

| rex "CDP-4-DUPLEX-MISMATCH.*on (<?interface>[^\s]+) \((?<state>[^)]+)\), with (?<host2>[^\s]+) (<?interface2>[^\s]+) \((?<state2>[^)]+)\)"