Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
There are 13 alert policies w/ nested filterGroups in production
2009: 6923 6927
5705: 7080 (disabled)
6161: 6439 6440 6441 6442 6443 6444
9701: 7333
24065: 6437
35657: 6492 (disabled)
35813: 6409
$ ch_www -c 'select company_id, id, filters from mn_alert_policy' > allpol
$ python lol.py allpol
2009/6923 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "protocol",
"filterValue": "17"
},
{
"operator": "=",
"filterField": "l4_dst_port",
"filterValue": "20013"
},
{
"operator": "ILIKE",
"filterField": "inet_dst_addr",
"filterValue": "208.76.14.0/24"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "<>",
"filterField": "i_device_type",
"filterValue": "router"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
2009/6927 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "l4_src_port",
"filterValue": "443"
},
{
"operator": "ILIKE",
"filterField": "inet_src_addr",
"filterValue": "209.50.158.28/32"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "ILIKE",
"filterField": "i_device_name",
"filterValue": "edge"
}
],
"not": true,
"filterGroups": []
}
]
}
]
}
24065/6437 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "Any",
"filters": [],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "protocol",
"filterValue": "17"
},
{
"operator": "=",
"filterField": "l4_dst_port",
"filterValue": "11211"
}
],
"not": false,
"filterGroups": []
},
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "protocol",
"filterValue": "6"
},
{
"operator": "=",
"filterField": "l4_dst_port",
"filterValue": "11211"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
35657/6492 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "ILIKE",
"filterField": "i_output_snmp_alias",
"filterValue": "~PR"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "Any",
"filters": [
{
"operator": "ILIKE",
"filterField": "i_output_snmp_alias",
"filterValue": "~ChinaTelecom(AS"
},
{
"operator": "ILIKE",
"filterField": "i_output_snmp_alias",
"filterValue": "~ChinaUnicom(AS"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
35813/6409 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "protocol",
"filterValue": "6"
},
{
"operator": "&",
"filterField": "tcp_flags",
"filterValue": "2"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "ILIKE",
"filterField": "c_cf_components",
"filterValue": "yp"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
5705/7080 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "ILIKE",
"filterField": "i_output_snmp_alias",
"filterValue": "SAN_DATA"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "Any",
"filters": [
{
"operator": "ILIKE",
"filterField": "i_output_snmp_alias",
"filterValue": "aggs01-san0052 | vlan1521 | SAN_DATA"
},
{
"operator": "ILIKE",
"filterField": "i_output_snmp_alias",
"filterValue": "aggs01-san0053 | vlan1531 | SAN_DATA"
}
],
"not": true,
"filterGroups": []
}
]
}
]
}
6161/6439 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_protocol_name",
"filterValue": "UDP"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_src_network_bndry_name",
"filterValue": "external"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
6161/6440 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_protocol_name",
"filterValue": "UDP"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_src_network_bndry_name",
"filterValue": "external"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
6161/6441 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_protocol_name",
"filterValue": "TCP"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_src_network_bndry_name",
"filterValue": "external"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
6161/6442 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_protocol_name",
"filterValue": "TCP"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_src_network_bndry_name",
"filterValue": "external"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
6161/6443 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_protocol_name",
"filterValue": "ICMP"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_src_network_bndry_name",
"filterValue": "external"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
6161/6444 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_protocol_name",
"filterValue": "ICMP"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "=",
"filterField": "i_src_network_bndry_name",
"filterValue": "external"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
9701/7333 {
"connector": "All",
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "All",
"filters": [
{
"operator": "NOT ILIKE",
"filterField": "src_flow_tags",
"filterValue": "MYNETWORK"
}
],
"not": false,
"filterGroups": [
{
"named": false,
"name": "",
"metric": "",
"connector": "Any",
"filters": [
{
"operator": "<>",
"filterField": "src_as",
"filterValue": "7224"
},
{
"operator": "<>",
"filterField": "src_as",
"filterValue": "14618"
},
{
"operator": "<>",
"filterField": "src_as",
"filterValue": "16509"
}
],
"not": false,
"filterGroups": []
}
]
}
]
}
import sys
import re
import json
lines = ( (x[0].strip() + '/' + x[1].strip(), '|'.join(x[2:]).strip()) for x in ( x.strip().split('|') for x in open(sys.argv[1], 'r').readlines()[2:-2] ))
d = dict(lines)
result = {}
for k, v in d.iteritems():
f = v.replace('"filterGroups":[]', '')
occ = [m.start() for m in re.finditer('filterGroups', f)]
if len(occ) > 1:
result[k] = json.dumps(json.loads(v), indent=2)
for k in sorted(result.keys()):
print k, result[k]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment