So, I am just starting down the path of configuring compliance checks in SolarWinds. For the first check I thought I would keep it easy and just write a rule that verifies our standard MOTD banner that people see when they try to ssh to our network gear.
The banner on our Cisco switches looks something like this:
banner motd ^C
######################### COMPANY #########################
Unauthorized users will be prosecuted to the fullest
extent of the law.
Contact network@company.com or call (555) 555-1212 to
report trouble associated with this equipment.
######################### COMPANY #########################
^C
So I went into NCM under the compliance tab, clicked on Manage Policy Reports, Manage Rules, and then selected Add New Rule. In the rule section we can put a string of text for the rule to match, and it gives you the option to match via 'Regular Expression (Regex)', or 'Find String'.. Under the buttons that let me select whether I want to use RegEx or a simple string, there is a little bit of help text.. It reads:
Strings can be a Regular Expression, or a simple find expression using '*' and '?'. A policy rule may test for the line to be found, such as an access list, or not to be found,
such as 'public' for a community string.
For Regular Expression there is actually an embedded link with some decent help. Not to mention there are a million documents on-line for how regular expressions work. However for the string match all we are told is that they can be "a simple find expression using '*' and '?'". I can't seem to fine any additional information in thwack about how the string matching in SolarWinds work, and there is almost nothing mentioned about it in the NCM documentation. I assume that the * is a wildcard, and maybe the question mark is a single character wildcard??? But it isn't clear at all.. (If it is a "simple find expression", then should some documentation on it be pretty "simple" to write???)
I've tried putting my MOTD banner in as a simple string, and then I test it by cutting and pasting the same MOTD in the test window, and it doesn't match. I've tried using the wild cards. At the ends of each line in case there are carriage returns or newlines that it is having troubles matching. (This was mentioned in a Thwack discussion) And I've also tried adding in \r's and \n's for the newlines and carriage returns (Also mentioned in Thwack), but nothing works. I don't even know if the simple string match works with multiple lines because there is no documentation.
Does anyone have any good info as to how SolarWinds implements its string match? As I said, I know I could use regular expressions, but for straight up text matches it would be nice to just do a copy and paste of what I want without having to build a whole RegEx. I'd like to save the RegEx's for something like pattern matching every odd Gigabit interface on a box, or something like that..
Thanks!!