/*
	This file contains some sample policy-statements.

	Note to VIM users: this file should have syntax highlighting; enable with (:syntax on).
*/

#include "@resolved_sysconfdir@/format-statements.conf"
#include "@resolved_sysconfdir@/map-statements.conf"

policy-options {
	policy-statement IGNORE_GENERIC_CISCO_SYSLOG {
		apply-format SYSLOG_FORMAT;
	}

	policy-statement CISCO_GENERIC_SYSLOG {
		term CONFIGURED {
			-- %SYS-5-CONFIG_I: Configured from console by bingo on vty0 (209.69.69.41)
			from {
				protocol	syslog;
				tag		"SYS-5-CONFIG";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	software;
					}
				}
				accept;
			}
		}
		term RELOAD {
			-- %SYS-5-RELOAD: Reload requested by wtf on console.
			from {
				protocol	syslog;
				tag		"SYS-5-RELOAD";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"@content@";
						detail	"Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	software;
					}
				}
				accept;
			}
		}
		term TEMPATURE {
			-- %ENVM-4-ENVWARN: chassis outlet 3 measured at 50C/122F 
			from {
				protocol	syslog;
				tag		"ENVM-4-ENVWARN";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Environmental: @content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term MEMORY_ALLOCATION_FAILURE {
			-- %SYS-2-MALLOCFAIL: Memory allocation of 1084 bytes failed from 0x604777B0, pool Processor, alignment 0 
			from {
				protocol	syslog;
				tag		"SYS-2-MALLOCFAIL";
				content	".*of ([0-9]+) bytes";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Memory allocation of @content[1]@ bytes failed";
						detail	"Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	software;
					}
				}
				accept;
			}
		}
		term TRACEBACK {
			-- -Traceback= 40302384 400AEC00 401CBBE0 401CBCD0 403A8630 403ABAA4 403B02B8 4035EC20 
			from {
				protocol	syslog;
				content	"-Traceback= (.+)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Traceback generated";
						detail	"Traceback: @content[1]@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: Traceback @content[1]@";
						channel	software;
					}
				}
				accept;
			}
		}
		apply-format SYSLOG_FORMAT;
	}

	policy-statement CISCO_7500_NOTIFICATION_SYSLOG {
		term FILESYSTEM {
			-- %FILESYS-5-DEV: PCMCIA flash card inserted into slot1
			from {
				protocol	syslog;
				tag		"FILESYS-5-DEV";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Filesystem Event: @content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}

		apply-format SYSLOG_FORMAT;
	}

	policy-statement CISCO_BGP_SYSLOG {
		term UNEXPECTED_MD5_DIGEST {
			-- %TCP-6-BADAUTH: No MD5 digest from 12.24.48.179(1363) to 138.217.12.69(179) 
			from {
				protocol	syslog;
				tag		"TCP-6-BADAUTH";
				content	"from ([0-9\.]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Unexpected MD5 Digtest from @content[1]@";
						detail	"An unexpected MD5 Digest was recieved from @content[1]@. Verify the BGP configuration on this router and @content[1]@.";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		term INSUFFICENT_CHUNK_COMMUNITY {
			-- %BGP-3-INSUFCHUNKS: Insufficient chunk pools for community, requested size 112
			from {
				protocol	syslog;
				tag		"BGP-3-INSUFCHUNKS";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Insufficient community chunk pool";
						detail	"Insufficient chunk pool to allocate BGP community. Full message: @content@";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		term MAX_PREFIX_WARNNIG {
			from {
				protocol	syslog;
				tag		"BGP-4-MAXPFX";
				content	"from ([0-9\.]+).*reaches ([0-9]+).*max ([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Max Prefix Warning: Peer @content[1]@ advertising @content[2]@ of @content[3]@ prefixes";
						detail	"The peer @content[1]@ is advertising @content[2]@ prefixes. The current threshold is set to @content[3]@. You may need to contact this peer and/or increase the configured max-prefix threshold.";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: peer @content[1]@ advertising @content[2]@ prefixes. The current threshold is set to @content[3]@.";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		term MAX_PREFIX_EXCEEDED {
			from {
				protocol	syslog;
				tag		"BGP-3-MAXPFXEXCEED";
				content	"from ([0-9\.]+).*: ([0-9]+).*limit ([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Max Prefix Violation: Peer @content[1]@ advertising @content[2]@ exceeding limit of @content[3]@";
						detail	"The peer @content[1]@ is now down due to a prefix-limit violation. This neighbor needs to be reset to restore the session. You may need to contact this peer and/or increase the configured max-prefix threshold.";
						channel	routing-bgp;
					}
					syslog {
						detail	"@snmp:sysName.0@: peer @content[1]@ is down due to a prefix-limit violation.";
						channel	routing-bgp;
					}
				}
				accept;
			}
		}
		apply-format SYSLOG_FORMAT;
	}

	policy-statement CISCO_7500_NOTIFICATION_SYSLOG {
		term FILESYSTEM {
			-- May  1 00:12:03 12-24-48-53.domain.com 1308: May  1 00:12:02.109: %FILESYS-5-DEV: PCMCIA flash card inserted into slot1
			from {
				protocol	syslog;
				tag		"FILESYS-5-DEV"; 
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Filesystem Event: @content@";
						detail	"Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}

		apply-format SYSLOG_FORMAT;
	}

	policy-statement CISCO_7500_HEALTH_SYSLOG {
		term VIP_CRASH_DBUSINTERRSWSET {
			-- Dec 17 15:51:20 agg-01-lo3.dytn.domain.com 531: Dec 17 21:51:19.157: %DBUS-3-DBUSINTERRSWSET: Slot 1, Internal Error due to VIP crash
			from {
				protocol	syslog;
				tag		"DBUS-3-DBUSINTERRSWSET";
				content	"Slot ([0-9]+).*VIP crash";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"VIP Failure: Slot @content[1]@ crashed";
						detail	"The VIP in slot @content[1]@ crashed. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: VIP in slot @content[1]@ crashed";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term VIP_CRASH_CYBUS_ERROR {
			-- Dec 18 11:23:08 agg-01-lo3.dytn.domain.com 607: Dec 18 17:23:07.550: %VIP6-80 RM7000B-3-MSG: slot1 VIP-3-MVIP_CYBUSERROR_INTERRUPT: A Cybus Error %occurred.
			from {
				protocol	syslog;
				tag		"VIP([0-9\-]+)";
				content	"slot([0-9]+).*VIP-3-MVIP_CYBUSERROR_INTERRUPT";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"VIP Failure: Cybus error on VIP@ag[1]@ in slot @content[1]@";
						detail	"The VIP@tag[1]@ in slot @content[1]@ crashed with a cybus error. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: Cybus error on VIP@ag[1]@ in slot @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term VIP_SYSTEM_EXCEPTION {
			-- %VIP6-80 RM7000B-3-MSG: slot1 VIP-3-SYSTEM_EXCEPTION: VIP System Exception %occurred sig=22, code=0x0, context=0x609B0A48
			from {
				protocol	syslog;
				tag		"VIP([0-9\-]+)";
				content	"slot([0-9]+).*VIP-3-SYSTEM_EXCEPTION";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"VIP Failure: System exception on VIP@tag[1]@ in slot @content[1]@";
						detail	"The VIP@tag[1]@ in slot @content[1]@ experienced a system exception. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: System exception on VIP@tag[1]@ in slot @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term VIP_PMA_ERROR {
			-- Sep 18 12:47:29 12-24-48-118.domain.com 6227: Sep 18 10:47:28 PST: %VIP2 R5K-3-MSG: slot11 VIP-3-SVIP_PMAERROR_INTERRUPT: PMA Error occurred.
			from {
				protocol	syslog;
				tag		"VIP([0-9\-]+)";
				content	"slot([0-9]+).*VIP-3-SVIP_PMAERROR_INTERRUPT";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"VIP Failure: PMA error on VIP@tag[1]@ in slot @content[1]@";
						detail	"The VIP@tag[1]@ in slot @content[1]@ experienced a PMA error. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: PMA error on VIP@tag[1]@ in slot @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term VIP_PARITY_ERROR {
			-- Sep 18 12:47:29 12-24-48-118.domain.com 6228: Sep 18 10:47:28 PST: %VIP2 R5K-3-MSG: slot11 VIP-3-READ23_PARITYERROR: Reno ASIC read parity error %- bytes 2 & 3.
			from {
				protocol	syslog;
				tag		"VIP([0-9-]+)";
				content	"slot([0-9]+).*VIP-3-READ23_PARITYERROR";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"VIP Failure: Parity error on VIP@tag[1]@ in slot @content[1]@";
						detail	"The VIP@tag[1]@ in slot @content[1]@ experienced a parity error. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: Parity error on VIP@tag[1]@ in slot @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term SLOT_DISABLED_OOSEQ {
			-- Sep 18 12:49:35 12-24-48-118.domain.com 6474: Sep 18 10:49:33 PST: %FIB-3-FIBLC_OOSEQ: Slot 1 disabled - Out of Sequence. Expected 0, received %49162
			from {
				protocol	syslog;
				tag		"FIB-3-FIBLC_OOSEQ";
				content	"Slot ([0-9]+) disabled - Out of Sequence";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Slot Failure: Slot @content[1]@ disabled due to out of sequence error";
						detail	"Slot @content[1]@  has been disabled due to an out of sequence error. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: Slot @content[1]@ disabled due to out of sequence error";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term VIP_RELOAD {
			-- Dec 18 11:23:24 agg-01-lo3.dytn.domain.com 608: Dec 18 17:23:23.558: %VIP6-80 RM7000B-3-MSG: slot1 VIP-3-SVIP_RELOAD: SVIP Reload is called.  
			from {
				protocol	syslog;
				tag		"VIP([0-9-]+)";
				content	"slot([0-9]+): Slot ([0-9]+).*VIP-3-SVIP_RELOAD";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"VIP Failure: VIP@tag[1]@ in slot @content[1]@ reloaded";
						detail	"The VIP@tag[1]@ in slot @content[1]@ reloaded. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: VIP@tag[1]@ in slot @content[1]@ reloaded";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term VIP_FOREVER {
			-- May 15 03:14:57 12-24-48-108.domain.com 632: *May 15 08:14:54: %RSP-3-FOREVER: cmd 2 to VIP2 R5K (slot 1) took 164 usecs, done 1
			from {
				protocol	syslog;
				tag		"RSP-3-FOREVER";
				content	"VIP([0-9-]+).*slot([0-9]+).*took ([0-9]+) usecs";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"VIP Failure: VIP@content[1]@ in slot @content[2]@ taking forever (@content[3]@ usecs)";
						detail	"The VIP@content[1]@ in slot @content[2]@ taking forever (@content[3]@ usecs). Full message: @content@";
						channel	hardware;
					}
					syslog {
						brief		"@snmp:sysName.0@: VIP@content[1]@ in slot @content[2]@ taking forever (@content[3]@ usecs)";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term LONG_BUS_STALL {
			-- ul 27 16:08:48 12-24-48-24.domain.com 1375: Jul 27 16:08:47.273: %OIR-3-LONGSTALL: Long bus stall (5000 ms), check for improperly seated cards 
			from {
				protocol	syslog;
				tag		"OIR-3-LONGSTALL"; 
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: @content@";
						detail	"A bus stall has been detected. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term CBUS_RESETNXI {
			-- May 24 02:16:29.476: %CBUS-3-RESETNXI: Reset of removed interface 42B7F6C0 (Serial4/1/1/28:0) -Process= "OIR Handler", ipl= 0, pid= 9
			from {
				protocol	syslog;
				tag		"CBUS-3-RESETNXI"; 
				content	"interface .*\(([a-zA-Z\/:\-]+)\)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Reset of removed interface @content[1]@";
						detail	"Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term CXBUS_ERROR {
			-- Jun 13 00:04:01 12-24-48-86.domain.com 412: Jun 13 00:04:00.261: %DBUS-3-CXBUSERR: Slot 1, CBus Error
			from {
				protocol	syslog;
				tag		"DBUS-3-CXBUSERR";
				content	"Slot ([0-9]+)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Slot @content[1]@ CxBus error";
						detail	"A CxBus error has been detected. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: Slot @content[1]@ CxBus error";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term ALIGNMENT_CORRECTION {
			-- Jun 23 06:14:20 12-24-48-124.domain.com 479: Jun 23 11:14:20 UTC: %ALIGN-3-CORRECT: Alignment correction made at 0x4021EDE0 reading 0xE0100069
			from {
				protocol	syslog;
				tag		"ALIGN-3-CORRECT";
				content	"at ([0-9A-Fx]+) reading ([0-9A-Fx]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: An alignment correction was made. at @content[1]@ while reading @content[2]@";
						detail	"An alignment correction made at @content[1]@ while reading @content[2]@. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: alignment correction made at @content[1]@ while reading @content[2]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term CPUHOG {
			-- Jan  6 16:47:43 agg-00-vlan4 34463: .Jan  6 16:47:42.051 CST: %SYS-3-CPUHOG: Task ran for 2028 msec (39/35), process = ARP Input, PC = 60272CC0.
			from {
				protocol	syslog;
				tag		"SYS-3-CPUHOG";
				content	"([0-9]+) msec.*process = (.+),";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"CPU Hog: Process @content[2]@ ran for @content[1]@ msecs";
						detail	"Process @content[2]@ had run for @content[1]@ msecs. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: process @content[2]@ ran for @content[1]@ msecs.";
						channel	software;
					}
				}
				accept;
			}
		}
		term LOVENOTE {
			-- Sep 30 13:52:35 agg-01-lo0.ontr.domain.com 11315: Sep 30 11:52:34 PST: %RSP-3-LOVENOTE: FCE0 corrupt: 00000000 08080178 3FEFEFEF 00019C80 
			from {
				protocol	syslog;
				tag		"LOVENOTE";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"LOVENOTE: @content@";
						detail	"Your Cisco loves you, reguardless of your feels for it. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: Your Cisco loves you, reguardless of your feels for it. Full message: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term RSP_IPC_NOBUFFER {
			-- Jul  3 01:13:56 12-24-48-21.domain.com 853: Jul  3 01:13:55.735: %IPC_RSP_CBUS-3-NOBUF: No more IPC memd buffers to transmit IPC message
			from {
				protocol	syslog;
				tag		"IPC_RSP_CBUS-3-NOBUF";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Insufficient IPC memd buffer space to transmit IPC message";
						detail	"The IPC memd buffer has been exhausted. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: Insufficient IPC memd buffer space to transmit IPC message";
						channel	software;
					}
				}
				accept;
			}
		}
		term RSP_DBUS_READ_FAILURE {
			-- Oct 14 00:27:45 agg-01-lo3.mtld.domain.com 1040: *Oct 14 01:27:43.961: %RSP-3-ERROR: dbus read at 3E841144
			from {
				protocol	syslog;
				tag		"RSP-3-ERROR";
				content	"at ([0-9A-Z]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: RSP failed to read from dbus at 0x@content[1]@";
						detail	"The RSP has experienced a dbus error. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: RSP failed to read from dbus at 0x@content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term RSP_NOSTART {
			-- Apr  8 14:03:47 12-24-48-106.domain.com 120: *Apr  8 12:03:40 PST: %RSP-3-NOSTART: No microcode for RSP4 card, slot 3 
			from {
				protocol	syslog;
				tag		"RSP-3-NOSTART";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: RSP failed to start. Reason: @content@";
						detail	"An RSP failed to start. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: RSP failed to start. Reason: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term RSP_SLAVE_UP {
			-- Aug 12 23:08:43 12-24-48-86.domain.com 546: Aug 12 23:08:43.001: %RSP-5-SLAVEUP: Slave changed to state Running
			from {
				protocol	syslog;
				tag		"RSP-5-SLAVEUP";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Slave RSP is now running";
						detail	"The slave RSP has started. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term RSP_SLAVE_CHANGE {
			-- Aug 12 23:08:00 12-24-48-86.domain.com 538: Aug 12 23:07:59.514: %RSP-3-SLAVECHANGE: Slave changed state from Unplugged to Non-participant
			from {
				protocol	syslog;
				tag		"RSP-3-SLAVECHANGE";
				content	"([A-Za-z-]+) to ([A-Za-z-]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Slave RSP changed from state @content[1]@ to @content[2]@";
						detail	"The slave RSP has changed state. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term RSP_RESTART {
			-- Sep  6 15:28:09 lo0-bbr01.sndg.domain.com 4963: Sep  6 13:26:38.590: %RSP-3-RESTART: cbus complex 
			from {
				protocol	syslog;
				content	"RSP-3-RESTART: (.+)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: RSP was restarted. Reason: @content[1]@";
						detail	"An RSP has restarted, reason '@content[1]@'. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term PSU_FAIL {
			-- Dec 16 23:10:47 agg-01-lo3.dytn.domain.com 81500: Dec 17 05:10:46.402: %CI-3-PSFAIL: Power supply 1 failure
			from {
				protocol	syslog;
				tag		"CI-3-PSFAIL";
				content	"supply ([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: PSU@content[1]@ has failed";
						detail	"PSU@content[1]@ has failed. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: PSU@content[1]@ failed";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term PSU_FAN_FAIL {
			-- Aug 14 04:36:07 12-24-48-108.domain.com 9441: Aug 14 09:36:06: %CI-3-BLOWER: ps1 fan failure 
			from {
				protocol	syslog;
				tag		"CI-3-BLOWER";
				content	"ps([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Fan in PSU@content[1]@ has failed";
						detail	"The fan in PSU@content[1]@ has failed. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: fan in PSU@content[1]@ failed";
						channel	hardware;
					}
				}
				accept;
			}
		}
		apply-format SYSLOG_FORMAT;
	}

	policy-statement CISCO_7200_HEALTH_SYSLOG {
		term CARD_REMOVE {
			-- Dec 16 21:05:41 agg-01-lo3.ausu.domain.com 375244: Dec 16 21:05:41.742: %OIR-6-REMCARD: Card removed from slot 6, interfaces disabled
			from {
				protocol	syslog;
				tag		"OIR-6-REMCARD";
				content	"slot ([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Card removed from slot @content[1]@";
						detail	"A card was removed from slot @content[1]@. The router has disabled the interfaces that were bound to that card.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: card removed from slot @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term CARD_INSERT {
			-- Sep 11 02:04:39 209-234-146-2.domain.com 1339: Sep 10 23:04:25.341: %OIR-6-INSCARD: Card inserted in slot 6, interfaces administratively shut down 
			from {
				protocol	syslog;
				tag		"OIR-6-INSCARD"; 
				content	"slot ([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Card inserted into slot @content[1]@";
						detail	"A card has been inserted into slot @content[1]@. Interfaces have been administratively shutdown.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: card inserted into slot @content[1]@"; 
						channel	hardware;
					}
				}
				accept;
			}
		}
		term CARD_SEATED {
			-- Aug  7 11:26:28 12-24-48-66.domain.com 474: Aug  7 09:26:27.178 PST: %OIR-3-SEATED: Insert/removal failed for slot 2, check card seating 
			from {
				protocol	syslog;
				tag		"OIR-3-SEATED";
				content	"slot ([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: Card insert/removal failed for slot @content[1]@.";
						detail	"The card insert/removal has failed in slot @content[1]@. Try to reseat the card to clear this error.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: card insert/removal failed in slot @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term PCI_ACTIVATION_FAILED {
			-- Aug  7 11:26:22 12-24-48-66.domain.com 472: Aug  7 09:26:22.422 PST: %C7200-4-PCIVALID: PCI activation failed, bay 2, 0x12223202
			from {
				protocol	syslog;
				tag		"C7200-4-PCIVALID"; 
				content	"bay ([0-9]+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: PCI activation failed for bay @content[1]@";
						detail	"PCI activation failed for bay @content[1]@. Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: PCI activation failed for bay @content[1]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term MALLOC_FAILURE {
			-- Aug 22 11:24:49 12-24-48-130.domain.com 13317: Aug 22 16:24:48.398 UTC: %FIB-3-NOMEM: Malloc Failure, disabling DCEF 
			from {
				protocol	syslog;
				tag		"FIB-3-NOMEM";
				content	"Malloc Failure, (.+)$";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"IOS: Out of memory, @content[1]@";
						detail	"The system was unable to allocate additional memory (out of memory). Check the health of @hostname@ and open a ticket with Cisco. Full message: @content@";
						channel	software;
					}
					syslog {
						detail	"@snmp:sysName.0@: @content@";
						channel	software;
					}
				}
				accept;
			}
		}
		term PA_CONFIG {
			--Aug 15 00:18:14 a2-frs 560: Aug 15 05:18:10 UTC: %C7200-3-PACONFIG: Exceeds 3 high speed port adaptors 
			from {
				protocol	syslog;
				tag		"C7200-3-PACONFIG"; 
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: PA configuration @content@";
						detail	"Your port adapter (card) configuration exceeds the Cisco recommended configuration for this chassis. Full message: @content@";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: PA configuration @content@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		term PSU_EVENT {
			-- pr  6 01:08:48 a3-boi 342: Apr  6 07:08:47.802 UTC: %ENVM-6-PSLEV: Power Supply 2 state changed from normal to shutdown
			from {
				protocol	syslog;
				tag		"ENVM-6-PSLEV";
				content	".*upply ([0-9]+) .* from (.+) to (.+)";
			}
			then {
				apply-map 	SOURCE_TO_ELEMENT_DATA_MAP;
				set {
					state		information;
					information	clear;
				}
				output {
					gui {
						brief		"Chassis: PSU@content[1]@ changed from @content[2]@ to @content[3]@";
						detail	"The state for PSU@content[1]@ changed from @content[2]@ to @content[3]@.";
						channel	hardware;
					}
					syslog {
						detail	"@snmp:sysName.0@: PSU@content[1]@ changed from @content[2]@ to @content[3]@";
						channel	hardware;
					}
				}
				accept;
			}
		}
		apply-format SYSLOG_FORMAT;
	}
}

/*
** Local Variables:
** c-basic-offset: 3
** tab-width: 3
** End:
** vim600: fdm=marker
** vim: noet ts=3 sw=3
** vim: syntax=sella_nms
*/
