Rule Conditions Not Working as Expected

Question

I am trying to create a rule for a specific trap. The trap message must contain cgxPublicWanDown but should not contain Wireless, Cellular, Metered, or  LTE (these are the backup circuits, we only care about the primary circuits). My rule currently looks like this:

However, traps that contain wireless, cellular, LTE, and metered in their message are still getting through this rule.

Any help would be much appreciated.

abakus · Answer

I created a rule with your conditions (with AND operators), added a single action which adds tag "WAN!" and sent several traps from a generator. LA 2.1 with HF1.

I put LTE to a separate varbind, same varbind, changed casing and it always did what I'd expected. See:

(ignore varbind names, I just modified existing trap, so the varbind names are a bit strange)

So we're probably missing some important peice of information, such as what action did you configure and what do you expect to happen.

mesverrum · Answer

When you say coming through, do you mean they are triggering the rule after you have put this in place? Regardless of the rule's existence all incoming traps will be visible in the log viewer.  Or are you saying that even with this updated logic the events are showing as triggering the rule and taking whatever action you had associated?

The logic looks correct now, so going beyond that I'd guess at something relating to the application.

I also don't know off hand if there is any case sensitivity at play with the new LM rules.  For almost every part of Orion it is not, except two random tables in the DB are case sensitive so I wouldn't rule out something crazy like that here without testing for it.

I'm also curious if LM has any kind of lag time between making a change to an existing rule and then having it take effect, I've seen weirder things before when troubleshooting stuff in Orion.  Maybe might be able to test that by creating a whole new rule with the same logic but a slightly different action and see if they catch the same stuff or not.

When in doubt, sometimes I like to just bounce the server and see if the unexplainable behavior gets fixed.

rmullal · Answer

Thanks for the response!

This is what i've got:

I'm still getting messages coming through that contain "Wireless". any ideas mesverrum​?