This article explains how to use regular expressions in Junos event policies to filter events based on specific event attributes.

Overview:

Regular expressions can be used with the attributes-match statement to provide more precise filtering of events. By matching specific attribute values, an event policy can trigger actions only when the defined criteria are met.

Syntax

Configure the attributes-match statement under the event policy as shown below:

[edit event-options policy <policy-name> attributes-match]
event.<attribute-name> matches <regular-expression>;

Where:

• attribute-name – The name of the event attribute to match (for example, interface-name, bgp-peer, or event-message).
• regular-expression – The regular expression used to match the attribute value.

Example 1: Match BGP Peers in a Specific Subnet

The following configuration matches BGP peers in the 192.168.1.0/24 subnet and raises an SNMP trap when a bgp_connect_failed event occurs.

set event-options policy bgp events bgp_connect_failed
set event-options policy bgp attributes-match bgp_connect_failed.peer-name matches "^192\.168\.1\.[0-9]{1,3}$"
set event-options policy bgp then raise-trap

The regular expression:

^192\.168\.1\.[0-9]{1,3}$

matches any IP address in the 192.168.1.0/24 subnet.

Example 2: Match Specific Interfaces

The following configuration matches interfaces ranging from ge-0/0/0 through ge-0/0/9 and raises an SNMP trap when a snmp_trap_link_down event is generated.

set event-options policy interface-flap events snmp_trap_link_down
set event-options policy interface-flap attributes-match snmp_trap_link_down.interface-name matches "^ge-0/0/[0-9]+$"
set event-options policy interface-flap then raise-trap

The regular expression:

^ge-0/0/[0-9]+$

matches interface names beginning with ge-0/0/ followed by one or more digits, such as:

• ge-0/0/0
• ge-0/0/1
• ge-0/0/9

Conclusion

Using regular expressions with the attributes-match statement enables more granular event filtering in Junos event policies. This allows administrators to trigger actions, such as raising SNMP traps, only for events that match specific interface names, IP addresses, or other event attributes.

v1