/*
	This file contains some sample policy-statements.

	Note to VIM users: this file should have syntax highlighting; enable with (:syntax on).
*/

#include "@resolved_sysconfdir@/format-statements.conf"
#include "@resolved_sysconfdir@/map-statements.conf"

policy-options {
	policy-statement IGNORE_GENERIC_JUNIPER_SYSLOG {
		term REJECT_FIREWALL {
			from {
				protocol	syslog;
				content	"^FW";
			}
			then reject;
		}
		-- Jun  1 00:32:01 12.23.24.41 /kernel: [mlppp] t1-2/1/0:27: link/bundle address mismatch
		term REJECT_BUNDLE_MISMATCH {
			from {
				protocol	syslog;
				tag		kernel;
				content	"link/bundle address mismatch";
			}
			then reject;
		}
		-- May 31 21:31:26 12.23.24.231 /kernel: ds-2/1/1:24:4: loopback suspected; going to standby.
		term REJECT_LOOPBACK_SUSPECTED {
			from {
				protocol	syslog;
				tag		kernel;
				content	"loopback suspected; going to standby";
			}
			then reject;
		}
		apply-format SYSLOG_FORMAT;
	}

	policy-statement JUNIPER_HEALTH_SYSLOG {
		term CHASSISD_BLOWERS_WARNING {
			-- chassisd[2362]: CHASSISD_BLOWERS_SPEED_FULL: Fans and impellers being set to full speed [system warm]
			from {
				protocol	syslog;
				tag chassisd;
				content	"^CHASSISD_BLOWERS";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term CHASSISD_IPC_ERROR {
			-- chassisd[2239]: CHASSISD_IPC_CONNECTION_DROPPED: FPC 1 connection dropped
			from {
				protocol	syslog;
				tag chassisd;
				content	"^CHASSISD_IPC";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FPC_MCHIPISRBASE_ERROR {
			-- fpc1 mchip_isr_base(MMB1-MD(1)): UnCorrectable ECC RAC(2) Device(0) Bank(10) Row(0) Col(12)
			from {
				protocol	syslog;
				tag fpc;
				content	"^mchip_isr_base";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FPC_CMALARM_ERROR {
			-- fpc1 CMALARM: Error (code: 538, type:Minor) encountered, cmalarm_passive_alarm_signal
			from {
				protocol	syslog;
				tag fpc;
				content	"^CMALARM:";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FPC_CMG_ERROR {
			-- fpc1 CMG: Fatal ASIC memory error, chip RCHIP, offlining FPC
			from {
				protocol	syslog;
				tag fpc;
				content	"^CMD:";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FPC_MEMEORY_SIZE {
			-- fpc2 FPC: Memory size and MPC106 row config inconsistent (32 Mbytes, 9 row bits)
			from {
				protocol	syslog;
				tag fpc;
				content	"^FPC:";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"This is a cosmetic defect. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term XNTPD_TIME_ERROR {
			-- xntpd[20452]: time error 149179544 over 1000 seconds; set clock manually
			from {
				protocol	syslog;
				tag		xntpd;
				content	"over ([0-9]+) seconds; set clock manually";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Time not set. Set clock manually.";
						detail	"NTPD on @hostname@ is unable to syncronize with the server because the clock is off by more than @content[1]@ secs. Set the clock manually to allow NTPD to syncronize with the server.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: NTPD is unable to syncronize with the server because the clock is off by more than @content[1]@ secs. Set the clock manually to allow NTPD to syncronize with the server.";
						channel	software;
					}
				}
				accept;
			}
		}
		term ROUTING_ENGINE_HIGH_PAGEOUT_RATE {
			-- /kernel: High pageout rate!! 622 pages/sec.
			from {
				protocol	syslog;
				tag		kernel;
				content	"High pageout rate.*([0-9]+ .*$)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Routing Engine: Pageout rate is @content[1]@";
						detail	"A high pageout rate (swapping) can indicate that a process is using more RAM than it should be and causing performance degradation. Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: Pageout rate is @content[1]@."; 
						channel	software;
					}
				}
				accept;
			}
		}
		term ROUTING_ENGINE_RPD_SCHED_SLIP {
			-- rpd[2254]: RPD_SCHED_SLIP: 9 sec scheduler slip
			from {
				protocol	syslog;
				tag		rpd;
				content	"RPD_SCHED_SLIP: ([0-9]+) sec";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Routing Engine: RPD @content[1]@ sec scheduler slip";
						detail	"A RPD scheduler slip can indicate the routing engine is being overworked and that that is a problem. Somtimes these don't indicate a real problem, only that the routing engine was temporarily busy.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: RPD scheduler slipped @content[1]@ sec.";
						channel	software;
					}
				}
				accept;
			}
		}
		term ROUTING_ENGINE_RPD_SCHED_CALLBACK_LONGRUNTIME {
			-- rpd[2254]: RPD_SCHED_CALLBACK_LONGRUNTIME: task_module_config: excessive runtime 7.907 during configuration of policy
			from {
				protocol	syslog;
				tag		rpd;
				content	"RPD_SCHED_CALLBACK_LONGRUNTIME: ([a-zA-Z_0-9]+): excessive runtime ([0-9\.]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Routing Engine: RPD long run in @content[1]@";
						detail	"RPD took longer than than expected to complete work in @content[1]@. It ran for a total of @content[2]@ secs. Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: RPD took longer than than expected to complete work in @content[1]@. It ran for a total of @content[2]@ secs.";
						channel	software;
					}
				}
				accept;
			}
		}
		term SMARTD_FAILED_ATTRIBUTE {
			-- smartd[2379]:  Device: /dev/ad1a, Failed attribute: (200)Write Error Rate
			from {
				protocol	syslog;
				tag		smartd;
				content	"Device: ([a-z0-9/]+), Failed attribute: (.+*)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Routing Engine: smartd reporting @content[2]@ for device @content[1]@";
						detail	"This may indicate an issue with device @content[1]@. Full message: @content@. ";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: smartd reporting @content[2]@ for device @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term SMARTD_DEVICE_BUSY {
			-- smartd[2371]: atareadsmartvalues: ioctl: Device busy
			from {
				protocol	syslog;
				tag		smartd;
				content	"Device busy";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Routing Engine: smartd reporting device busy";
						detail	"This indicates that the routing engine was unable to access the hard drive. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: smartd reporting device busy. Full message: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term ROUTING_ENGINE_UNRESPONSIVE {
			-- chassisd[4556]: No response from the other routing engine for the last 360 seconds.
			from {
				protocol	syslog;
				tag		chassisd;
				content	"No response from the other routing engine.*last ([0-9]+) sec";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Routing Engine: Backup not responding";
						detail	"The active routing has been unable to contact the other routing enginer for the last @content[1]@ secs. Full message: @content@";
						channel	hardware;
					}
					syslog {
						brief		"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term ROUTING_ENGINE_FILESYSTEM_FULL {
			-- /kernel: pid 3973 (rpd), uid 0 on /tmp: file system full
			from {
				protocol	syslog;
				tag		kernel;
				content	"([/a-zA-Z0-9_\-]+): file system full";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Routing Engine: Filesystem full";
						detail	"The filesystem @content[1]@ is full. Full message: @content@";
						channel	hardware;
					}
					syslog {
						brief		"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term SSB_PREFIX_FAILURE {
			-- ssb RT: Failed prefix add IPv4:0 - 213.134.194/24, nh 363, ifidx 0, nhifl 0, flag 0x10, cos 0
			from {
				protocol	syslog;
				tag		ssb;
				content	"Failed prefix ([A-Za-z]+) IP";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		failure;
					information	clear;
				}
				output {
					gui {
						brief		"SSB: Failed to @content[1]@ prefix";
						detail	"The SSB failed to install prefix @content[1]@ into the forwaring table. This indicates a defective SSB or a bug. Check routers logs for errors and open a ticket with Juniper. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: SSB failed to @content[1]@ prefix. Full message: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term USER_LOGIN { /* This term captures the source and terminal. */
			-- login: login from 220.69.96.50 on ttyp2 as bingo
			from {
				protocol	syslog;
				tag		login;
				content	"from ([0-9\.]+) on \([a-z0-9]+\) as ([A-Za-z0-9_\-]+)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content[3]@ logged in from @content[1]@";
						detail	"User @content[3]@ logged in from @content[1]@ on @content[2]@.";
						channel	security;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content[3]@ logged in from @content[1]@ on @content[2]@";
						channel	security;
					}
				}
				accept;
			}
		}
		term USER_UI_LOGIN_EVENT { /* This term captures the security level. */
			-- mgd[95043]: UI_LOGIN_EVENT: User 'tool' login, class 'j-auto_2_permissions' [95043]
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_LOGIN_EVENT: User '([A-Za-z0-9_\-]+)' login, class '([A-Za-z0-9_\-]+)'";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content[1]@ logged in";
						detail	"User @content[1]@ logged as security class @content[2]@.";
						channel	security;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content[1]@ logged in as security class @content[2]@";
						channel	security;
					}
				}
				accept;
			}
		}
		term USER_UI_LOGOUT_EVENT {
			-- mgd[20531]: UI_LOGOUT_EVENT: User 'tool' logout
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_LOGOUT_EVENT: User '([A-Za-z0-9_\-]+)' logout";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content[1]@ logged out";
						detail	"User @content[1]@ logged out.";
						channel	security;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content[1]@ logged out";
						channel	security;
					}
				}
				accept;
			}
		}
		term USER_SU_SUCCESS {
			-- su: nmg_3 to root on /dev/ttyp0
			from {
				protocol	syslog;
				tag		su;
				content	"^([A-Za-z0-9_\-]+) to root on ([A-Za-z0-9_\-]+)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content[1]@ su to root";
						detail	"User @content[1]@ su to root on @content[2]@.";
						channel	security;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	security;
					}
				}
				accept;
			}
		}
		term USER_SU_FAILURE {
			-- su: BAD SU nmg_3 to root on /dev/ttyp0
			from {
				protocol	syslog;
				tag		su;
				content	"BAD SU ([A-Za-z0-9_\-]+) to root on ([A-Za-z0-9_\-]+)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content[1]@ failed to su to root";
						detail	"User @content[1]@ failed to su to root on @content[2]@.";
						channel	security;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	security;
					}
				}
				accept;
			}
		}
		term CONFIG_COMMIT_WITH_COMMENT {
			-- mgd[3651]: UI_COMMIT: User 'bingo' performed commit: no comment
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_COMMIT: User '([A-Za-z]+)' .* commit: (.*)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Configuration commited by @content[1]@. Comment: @content[2]@";
						detail	"The configuration was commited by @content[1]@. Comment: @content[2]@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: configuration commited by @content[1]@. Comment: @content[2]@";
						channel	software;
					}
				}
				accept;
			}
		}
		term CONFIG_COMMIT {
			-- mgd[18127]: UI_COMMIT: User 'stauffer' performed 'commit'
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_COMMIT: User '([A-Za-z]+)'";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Configuration commited by @content[1]@";
						detail	"The configuration was commited by @content[1]@.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: configuration was commited by @content[1]@";
						channel	software;
					}
				}
				accept;
			}
		}
		term COMMIT_NOT_CONFIRMED {
			-- mgd[2251]: UI_COMMIT_NOT_CONFIRMED: Commit was not confirmed; automatic rollback in process
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_COMMIT_NOT_CONFIRMED:";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Configuration confirmation timed out. Automatic rollback being performed.";
						detail	"The configuration was previously commited with the 'confirm' option. Since the user did not commit the configuration, it was automiatically rolled back to the previous configuration.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: configuration confirmation timed out. Automatic rollback being performed";
						channel	software;
					}
				}
				accept;
			}
		}
		term COMMIT_CONFIRMATION_REMINDER {
			-- mgd[11055]: UI_COMMIT_CONFIRMED_REMINDER: 'commit confirmed' must be confirmed within 1 minutes
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_COMMIT_CONFIRMED_REMINDER:.* within ([0-9]+ .*)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Configuration confirmation reminder. Rollback in @content[1]@.";
						detail	"The configuration was previously commited with the 'confirm' option. If the user does not commit the configuration, it will be automiatically rolled back in @content[1]@.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: configuration confirmation reminder. Rollback in @content[1]@";
						channel	software;
					}
				}
				accept;
			}
		}
		term COMMIT_AT_COMPLETED {
			-- mgd[2251]: UI_COMMIT_AT_COMPLETED: 'commit at' was successful
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_COMMIT_AT_COMPLETED:";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Configuration 'commit at' completed";
						detail	"The configuration was previously commited with the 'commit-at' option and that confirmation has now been made active.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: configuration 'commit at' completed";
						channel	software;
					}
				}
				accept;
			}
		}
		term DBASE_LOGIN_EVENT {
			-- mgd[11055]: UI_DBASE_LOGIN_EVENT: User 'bingo' entering configuration mode
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_DBASE_LOGIN_EVENT: User '([a-zA-Z_\-]+)'";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content[1]@ entered configuration mode";
						detail	"User @content[1]@ has entered configuration mode.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content[1]@ entered configuration mode";
						channel	software;
					}
				}
				accept;
			}
		}
		term DBASE_LOGOUT_EVENT {
			-- mgd[11055]: UI_DBASE_LOGOUT_EVENT: User 'bingo' exiting configuration mode
			from {
				protocol	syslog;
				tag		mgd;
				content	"UI_DBASE_LOGOUT_EVENT: User '([a-zA-Z_\-]+)'";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content[1]@ exited configuration mode";
						detail	"User @content[1]@ has entered configuration mode.";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content[1]@ exited configuration mode";
						channel	software;
					}
				}
				accept;
			}
		}
		apply-format SYSLOG_FORMAT;
	}

	policy-statement JUNIPER_BGP_SYSLOG {
		term UNEXPECTED_MD5_DIGEST {
			-- /kernel: tcp_auth_ok: Packet from 12.24.48.67:1697 unexpectedly has MD5 digest
			from {
				protocol	syslog;
				tag		/kernel;
				content	"^tcp_auth_ok: Packet from ([0-9\.]+):.*unexpectedly has MD5 digest";
			}
			then {
				apply-map 	[ SOURCE_TO_ELEMENT_DATA_MAP BGP_PEER_REMOTE_ADDR_TO_ASN_DATA_MAP ];
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Unexpected MD5 Digest from @content[1]@";
						detail	"An unexpected MD5 Digest was recieved from @content[1]@. Verify the BGP configuration on this router and neighbor @content[1]@.";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: unexpected MD5 Digest from @content[1]@";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		term BGP_PEER_EXCEEDED_PREFIX_LIMIT {
			from {
				protocol	syslog;
				tag		rpd;
				content	"^([0-9\.]+) .*AS ([0-9]+).*prefix-limit threshold.([0-9]+).*nlri: ([0-9]+)";
			}
			then {
				apply-map 	[ SOURCE_TO_ELEMENT_DATA_MAP BGP_PEER_REMOTE_ADDR_TO_ASN_DATA_MAP ];
				set {
					remote-address	"@content[1]@";
					state				information;
					information		clear;
				}
				output {
					gui {
						brief		"Max Prefix Warning: Peer @peer-name@ ASN @content[2]@ (@content[1]@) advertising @content[4]@ of @content[3]@ prefixes";
						detail	"The peer @peer-name@ ASN @content[2]@ (@content[1]@) is advertising @content[4]@ prefixes. The current warning threshold is set to @content[3]@. You may need to contact this peer and/or increase the configured max-prefix threshold.";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: peer @peer-name@ ASN @content[2]@ (@content[1]@) advertising @content[4]@ prefixes. The current warning threshold is set to @content[3]@.";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		term BGP_PEER_IDLED_PREFIX_LIMIT {
			-- rpd[81158]: bgp_pp_recv: NOTIFICATION sent to 193.34.180.19+40562 (proto): code 2 (Open Message Error) subcode 5 (authentication failure), Reason: no group for 193.34.180.19+40562 (proto) from AS 9461 found (peer idled due to prefix-limit violation), dropping him
			from {
				protocol	syslog;
				tag		rpd;
				content	"^bgp_pp_recv.* ([0-9\.]+)\+.*AS ([0-9]+).*idled due to prefix-limit";

			}
			then {
				apply-map 	[ SOURCE_TO_ELEMENT_DATA_MAP BGP_PEER_REMOTE_ADDR_TO_ASN_DATA_MAP ];
				set {
					remote-address	"@content[1]@";
					state				information;
					information		clear;
				}
				output {
					gui {
						brief		"Max Prefix Violation: Peer @peer-name@ ASN @content[2]@ (@content[1]@) is down";
						detail	"The peer @peer-name@ ASN @content[2]@ (@content[1]@) is down due to a prefix-limit violation. This neighbor needs to be reset to restore the session. You may need to contact this peer and/or increase the configured max-prefix threshold.";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: peer @peer-name@ ASN @content[2]@ (@content[1]@) is down due to a prefix-limit violation.";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		term BGP_PEER_UNCONFIGURED {
			-- rpd[676]: bgp_pp_recv: NOTIFICATION sent to 195.34.162.98+57780 (proto): code 2 (Open Message Error) subcode 5 (authentication failure), Reason: no group for 195.34.162.98+57780 (proto) from AS 43131 found (Unconfigured Peer), dropping him
			from {
				protocol	syslog;
				tag		rpd;
				content	"^bgp_pp_recv.*no group for ([0-9\.]+).*from AS ([0-9]+).*Unconfigured Peer";
			}
			then {
				apply-map 	[ SOURCE_TO_ELEMENT_DATA_MAP BGP_PEER_REMOTE_ADDR_TO_ASN_DATA_MAP ];
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Unconfigured BGP Peer @content[1]@ ASN @content[2]@";
						detail	"An unconfigured peer @content[1]@ ASN @content[2]@ is attempting to establish a BGP session. You may need to contact this peer and/or add the missing configuration to establish a session.";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: unconfigured peer @content[1]@ ASN @content[2]@ attempting to establish a BGP session";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		apply-format SYSLOG_FORMAT;
	}

	policy-statement JUNIPER_VPN_SYSLOG {
		term RPD_LAYER2_VC_DOWN {
			-- rpd[2544]: RPD_LAYER2_VC_DOWN:  Layer-2 VC (VPN : PIMP_NETWORKS, local-site : 1, remote-site : 2) state changed from UP to VC-Dn
			from {
				protocol	syslog;
				tag		rpd;
				content  "RPD_LAYER2_VC_DOWN:.*VPN : ([a-zA-Z0-9/\.\\_-]+), local-site : ([0-9]+), remote-site : ([0-9]+).* from (.*)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		failure;
					information	clear;
				}
				output {
					gui {
						brief		"L2VPN Down: @content[1]@ VPN state changed from @content[4]@";
						detail	"The Layer2 VPN @content[1]@ is down. State changed from @content[4]@. Local Site: @content[2]@. Remote Site: @content[3]@.";
						channel	vpn-layer2;
					}
					syslog {
						detail	"@snmp:sysName.0@: layer2 VPN @content[1]@ is down. State changed from @content[4]@. Local Site: @content[2]@. Remote Site: @content[3]@.";
						channel	vpn-layer2;
					}
				}
				accept;
			}
		}
		term RPD_LAYER2_VC_UP {
			-- rpd[2544]: RPD_LAYER2_VC_UP:  Layer-2 VC (VPN : PIMP_NETWORKS, local-site : 1, remote-site : 2) state changed to UP
			from {
				protocol	syslog;
				tag		rpd;
				content	"RPD_LAYER2_VC_UP:.*VPN : ([a-zA-Z0-9/\.\\_-]+), local-site : ([0-9]+), remote-site : ([0-9]+).*to (.*)$";
			}
			then {
				apply-map	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		recovery;
					information	clear;
				}
				output {
					gui {
						brief		"L2VPN Up: @content[1]@ VPN state changed to @content[4]@";
						detail	"The Layer2 VPN @content[1]@ is up. State changed to @content[4]@. Local Site: @content[2]@. Remote Site: @content[3]@.";
						channel	vpn-layer2;
					}
					syslog {
						detail	"@snmp:sysName.0@: layer2 VPN @content[1]@ is up. State changed to @content[4]@. Local Site: @content[2]@. Remote Site: @content[3]@.";
						channel	vpn-layer2;
					}
				}
				accept;
			}
		}
		term LAYER2_PREFIX_FAILURE {
			-- ssb RT: Failed prefix add CCC:0 - 0:/16, nh 448, ifidx 0, nhifl 0, flag 0x10, cos 0
			from {
				protocol	syslog;
				tag		ssb;
				content	"Failed prefix ([A-Za-z]+) CCC";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		failure;
					information	clear;
				}
				output {
					gui {
						brief		"L2VPN Failure: Failed to @content[1]@ CCC prefix.";
						detail	"The SSB failed to @content[1]@ a CCC prefix into the forwaring table. This indicates a defective SSB or a bug. Verify all Layer2 VPNs are passing bi-directional traffic and open a ticket with Juniper. Full message: @content@";
						channel	vpn-layer2;
					}
					syslog {
						detail	"@snmp:sysName.0@: layer2 VPN failure to @content[1]@ CCC prefix";
						channel	vpn-layer2;
					}
				}
				accept;
			}
		}
		apply-format SYSLOG_FORMAT;
	}

	/*
		Policy that handle chassis events.

		FIXME: This needs cleanup. May be able to give more useful information.
	*/
	policy-statement JUNIPER_CHASSIS_TRAP {
		term POWER_SUPPLY_FAILURE {
			from {
				protocol snmptrap;
				event		snmp:jnxPowerSupplyFailure;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state failure;
				}
				output {
					gui {
						brief		"Power supply failure";
						detail	"A power supply has failed. @snmp:jnxContentsDescr@ is @snmp:jnxOperatingState@.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: power supply has failed";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term POWER_SUPPLY_RECOVERY {
			from {
				protocol snmptrap;
				event		snmp:jnxPowerSupplyOK;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state recovery;
				}
				output {
					gui {
						brief		"Power supply recovered";
						detail	"A power supply has recovered. @snmp:jnxContentsDescr@ is @snmp:jnxOperatingState@.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: power supply has recovered";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FAN_FAILURE {
			from {
				protocol snmptrap;
				event		snmp:jnxFanFailure;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state failure;
				}
				output {
					gui {
						brief		"Fan failure";
						detail	"A fan has failed. @snmp:jnxContentsDescr@ is @snmp:jnxOperatingState@.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: fan failed";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FAN_RECOVERY {
			from {
				protocol snmptrap;
				event		snmp:jnxFanOK;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state recovery;
				}
				output {
					gui {
						brief		"Fan recovery";
						detail	"A fan has recovered. @snmp:jnxContentsDescr@ is @snmp:jnxOperatingState@.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: fan recovered";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term TEMPERATURE_OVER {
			from {
				protocol snmptrap;
				event		snmp:jnxOverTemperature;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"Over temperature (cur: @snmp:jnxOperatingTemp@C)";
						detail	"An over temperature condition has occurred. The current temperature is @snmp:jnxOperatingTemp@C. Contents Description: @snmp:jnxContentsDescr@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: over temperature condition has occured. The current temperature is @snmp:jnxOperatingTemp@C.";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term TEMPERATURE_UNDER {
			from {
				protocol snmptrap;
				event		snmp:jnxTemperatureOK;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"Over temperature subsided (cur: @snmp:jnxOperatingTemp@C)";
						detail	"An over temperature condition has subsided. The current temperature is @snmp:jnxOperatingTemp@C. Contents Description: @snmp:jnxContentsDescr@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: over temperature condition has subsided. The current temperature is @snmp:jnxOperatingTemp@C.";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term REDUNDANCY_SWITCHOVER {
			from {
				protocol snmptrap;
				event		snmp:jnxRedundancySwitchover;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"@snmp:jnxRedundancyDescr@ redundancy switch over";
						detail	"Redundancy switch over has occured for the @snmp:jnxRedundancyDescr@. The switch over reason is '@snmp:jnxRedundancySwitchoverReason@' and the switchover count is @snmp:jnxRedundancySwitchoverCount@.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: redundancy switch over has occured for @snmp:jnxRedundancyDescr@. The switch over reason is '@snmp:jnxRedundancySwitchoverReason@' and the switchover count is @snmp:jnxRedundancySwitchoverCount@.";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FRU_REMOVAL {
			from {
				protocol snmptrap;
				event		snmp:jnxFruRemoval;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"@snmp:jnxFruName@ removed";
					--	detail	"@snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been removed from slot @snmp:jnxFruSlot@.";
						detail	"@snmp:jnxFruName@ has been removed.";
						channel	hardware;
					}
					syslog {
					--	detail	"FRU: @snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been removed from slot @snmp:jnxFruSlot@ on @snmp:sysName.0@ (@prefix@).";
						detail	"@snmp:sysName.0@: @snmp:jnxFruName@ has been removed";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FRU_INSERTION {
			from {
				protocol snmptrap;
				event		snmp:jnxFruInsertion;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"@snmp:jnxFruName@ inserted";
					-- detail	"@snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been inserted into slot @snmp:jnxFruSlot@.";
						detail	"@snmp:jnxFruName@ has been inserted.";
						channel	hardware;
					}
					syslog {
					-- detail	"FRU: @snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been inserted into slot @snmp:jnxFruSlot@ on @snmp:sysName.0@ (@prefix@).";
						detail	"@snmp:sysName.0@: @snmp:jnxFruName@ has been inserted";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FRU_POWER_OFF {
			from {
				protocol snmptrap;
				event		snmp:jnxFruPowerOff;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"@snmp:jnxFruName@ powered off";
					--	detail	"@snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been powered off in slot @snmp:jnxFruSlot@. It was offlined due to '@snmp:jnxFruOfflineReason@'.";
						detail	"@snmp:jnxFruName@ has been powered off";
						channel	hardware;
					}
					syslog {
					--	detail	"FRU: @snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been powered off in slot @snmp:jnxFruSlot@ on @snmp:sysName.0@ (@prefix@). It was offlined due to '@snmp:jnxFruOfflineReason@'.";
						detail	"@snmp:sysName.0@: @snmp:jnxFruName@ has been powered off";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term FRU_POWER_ON {
			from {
				protocol snmptrap;
				event		snmp:jnxFruPowerOn;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"@snmp:jnxFruName@ powered on";
					--	detail	"@snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been powered on in slot @snmp:jnxFruSlot@. It was offlined (onlined?) due to '@snmp:jnxFruOfflineReason@'.";
						detail	"@snmp:jnxFruName@ has been powered on.";

						channel	hardware;
					}
					syslog {
					--	detail	"FRU: @snmp:jnxFruName@ (type: @snmp:jnxFruType@) has been powered on in slot @snmp:jnxFruSlot@ on @snmp:sysName.0@ (@prefix@). It was offlined (onlined?) due to '@snmp:jnxFruOfflineReason@'.";
						detail	"@snmp:sysName.0@: @snmp:jnxFruName@ has been powered on";
						channel	hardware;
					}
				}
				accept;
			}
		}
		apply-format SNMPTRAP_FORMAT;
	}

	policy-statement JUNIPER_MPLS_TRAP {
		term LSP_UP {
			from {
				protocol snmptrap;
				event		snmp:mplsLspUp;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"LSP path @snmp:mplsPathName@ up";
						detail	"LSP @snmp:mplsLspName@ is up on path @snmp:mplsPathName@.";
						channel	routing-mpls;
					}
					syslog {
						detail	"@snmp:sysName.0@: LSP @snmp:mplsLspName@ is up on path @snmp:mplsPathName@";
						channel	routing-mpls;
					}
				}
				accept;
			}
		}
		term LSP_DOWN {
			from {
				protocol snmptrap;
				event		snmp:mplsLspDown;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"LSP path @snmp:mplsPathName@ down";
						detail	"LSP @snmp:mplsLspName@ is down on path @snmp:mplsPathName@.";
						channel	routing-mpls;
					}
					syslog {
						detail	"@snmp:sysName.0@: LSP @snmp:mplsLspName@ is down on path @snmp:mplsPathName@";
						channel	routing-mpls;
					}
				}
				accept;
			}
		}
		term LSP_CHANGE {
			from {
				protocol snmptrap;
				event		snmp:mplsLspChange;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"LSP @snmp:mplsLspName@ path change";
						detail	"LSP @snmp:mplsLspName@ has changed to path @snmp:mplsPathName@.";
						channel	routing-mpls;
					}
					syslog {
						detail	"@snmp:sysName.0@: LSP @snmp:mplsLspName@ has changed to path @snmp:mplsPathName@";
						channel	routing-mpls;
					}
				}
				accept;
			}
		}
		term LDP_LSP_UP {
			from {
				protocol snmptrap;
				event		snmp:jnxLdpLspUp;
				
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"LDP LSP up";
						detail	"LDP LSP is up.";
						channel	routing-mpls;
					}
					syslog {
						detail	"@snmp:sysName.0@: LDP LSP is up";
						channel	routing-mpls;
					}
				}
				accept;
			}
		}
		term LDP_LSP_DOWN {
			-- LDP LSP is down due to receivedWithdrawl. jnxLdpLspFec: 12.24.48.17 jnxLdpRtrid: 12.24.48.136 jnxLdpLspDownReason: receivedWithdrawl
			from {
				protocol snmptrap;
				event		snmp:jnxLdpLspDown;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"LDP LSP down";
						detail	"LDP LSP is down due to @snmp:jnxLdpLspDownReason@.";
						channel	routing-mpls;
					}
					syslog {
						detail	"@snmp:sysName.0@: LDP LSP is down due to @snmp:jnxLdpLspDownReason@";
						channel	routing-mpls;
					}
				}
				accept;
			}
		}
		term LDP_SESSION_UP {
			from {
				protocol snmptrap;
				event		snmp:jnxLdpSesUp;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"LDP session up";
						detail	"LDP session is up.";
						channel	routing-mpls;
					}
					syslog {
						detail	"@snmp:sysName.0@: LDP session is up";
						channel	routing-mpls;
					}
				}
				accept;
			}
		}
		term LDP_SESSION_DOWN {
			from {
				protocol snmptrap;
				event		snmp:jnxLdpSesDown;
			}
			then {
				apply-map SOURCE_TO_ELEMENT_DATA_MAP;
				set state information;
				output {
					gui {
						brief		"LDP session is down due to @snmp:jnxLdpSesDownReason@.";
						detail	"LDP session on interface @snmp:jnxLdpSesDownIf@ is down due to @snmp:jnxLdpSesDownReason@.";
						channel	routing-mpls;
					}
					syslog {
						detail	"@snmp:sysName.0@: LDP session on interface @snmp:jnxLdpSesDownIf@ is down due to @snmp:jnxLdpSesDownReason@";
						channel	routing-mpls;
					}
				}
				accept;
			}
		}
		apply-format SNMPTRAP_FORMAT;
	}
}

/*
** Local Variables:
** c-basic-offset: 3
** tab-width: 3
** End:
** vim600: fdm=marker
** vim: noet ts=3 sw=3
** vim: syntax=sella_nms
*/
