Can't provision a node with one IP address and a policy to avoid all IP address

I've set this bug to critical for moving from 1.6 to 1.8 requires this feature to work as described in this bug.

Note: I guess this could be the same issue like bug http://issues.opennms.org/browse/NMS-4225. Is it possible that the provisioned IP interface has no SNMP support? It seems policies are generally not applied if SNMP isn't available.

Is this still an issue? I followed the above instructions in the description.

1. Created a Provisioning Group called GroupTest
2. Added a node called Node1 to GroupTest
3. Added an IP interface to Node1, 74.125.113.105
4. Added one service to the IP interface, HTTP
5. Before syncing everything I created the above policy in the foreign source.
6. Synchronize the GroupTest Provisioning group.
7. Proceed to the node page.

After step 7 I see the interface with all its services on the node. I cannot reproduce this issue. Is this the same workflow that you went through to find the bug?

Please try with a router or any device with many IP interfaces.
If for example I have a Layer 3 Switch with 200 VLANS (i.e. at least 200 IP addresses), I just want to add the management IP address of the switch and ignore all others.

I think I may have fixed this in revision 1ad48021a1d62c0dcd8e5b98a39908692c8f293d

Matt and Donald, thanks for your help.

I tested locally with my two servers which have several IP addresses and it works.
I also tested with a Cisco Router using dynamips and it works.

Matt: Is the revision available for 1.8?

I just want to let you know that I tested the same requisition used for 1.10 with the latest snapshot for 1.8.14 and the problem exist. So I can confirm that it only works for 1.10.

Is it possible to get this fix included in 1.8 stable?

Roy, as you can see, we're pursuing the 1.10 release with all our effort and getting this back ported is probably not too difficult but just to far down the list of priorities for maintaining 1.8 long enough to get a new stable version out. We're really over due for 1.10 and have a lot of reasons/issues, such as this one, for getting it out sooner rather than later.

An alternate way of addressing this would be to create a new provisioning rule action value of "PERSIST_ONLY" as a complement to the existing "DO_NOT_PERSIST". A simple IP address or regular expression would then define the discovered IP addresses that would be persisted and any other (non-matching) IP addresses would implicitly be not persisted.

I use this basic approach now with "DO_NOT_PERSIST" with nodes that have dynamic IP addresses that I do not want to persist, but writing negative screen regular expressions to define all possible IP addresses to exclude is quite cumbersome.

Regards,
Tim Miller Dyck

When you say create provisioning rule action of "PERSIST_ONLY", I take it you mean as an enhancement to OpenNMS or is there a way to do this already?
I only have DO_NOT_PERSIST, MANAGE and UNMANAGE available in 1.8.16 as actions.

Regards

Roy

Hi Roy,

Yes, the PERSIST_ONLY would be an enhancement.

However, I was just doing some tests with OpenNMS 1.8.16 and found that regular expressions with negative lookahead work. This makes it possible to use the existing DO_NOT_PERSIST in basically the same way as a hypothetical PERSIST_ONLY would work.

This example will exclude all IPs detected on provisioned nodes except the IP 10.1.1.24. Tested using OpenNMS 1.8.16.

    Admin > Nodes > Manage Provisioning Groups
        (group to edit) > Foreign Source > Edit
            Policies > Add Policy
                Name: "Do not persist any IPs except 10.1.1.24"
                class: select “Match IP Interface”
            Save
            click the edit icon next to the key "action"
                value: select "DO_NOT_PERSIST" (the default)
                Save
            leave the key "matchBehavior" at the default value of "ALL_PARAMETERS"
            click "Add Parameter" next to the policy name
                key: select "ipAddress"
                value:

~^(?:(?!10\.1\.1\.24).)+$

            Save
        Done

The regular expression uses negative lookahead to exclude the specified string. I found the procedure at "Regular Expressions and negating a whole character group", http://stackoverflow.com/questions/977251/regular-expressions-and-negating-a-whole-character-group – there is more information there.

Regards,
Tim Miller Dyck

I have a quick question and and a comment, what is the use case for persisting only one IP address when you can simply put the IP in the node requisition and it will be forced on the node during the import (synchronize) phase.

I like your expression and thought I would espouse on it, briefly:

  ~^(?:(?!10\.1\.1\.24).)*$

To explain your negative look ahead "(?!)", this instructs the Pattern matcher to validate that there is no "10.1.1.24" ahead before a character is consumed by the (dot). It is wrapped in a non matching match group "(?" and told to repeat zero or more times (star) with the beginning and end anchors added to make sure the entire string is consumed. This, of course, assumes that the Java Pattern method .matches() is called vs. the .find() method in the policy code which I believe to be true.

Cool.

Hi David,

The intended use is not to add a desired IP but exclude all others that get automatically discovered later through SNMP. The particular case in my situation is a Microsoft VPN server which temporarily gains an internal IP from its pool of dynamic addresses when a VPN user is connected. If OpenNMS does a rescan during this time, it adds the IP to the node's interfaces list. When the user disconnects, the interface is then later reported as down. The setting above prevents any new IPs discovered from being added to the node's interface list.

Regards,
Tim Miller Dyck