Administrator Guide

32 Monitoring and Alerting Policy Suite Administrator’s Guide
53-1002933-02
Working with MAPS rules and actions
4
switch:admin> mapsrule --show check_crc
Rule Data:
----------
RuleName: check_crc
Condition: critical_ports(crc/hour>15)
Actions: raslog
Policies Associated: daily_policy
switch:admin> mapspolicy --enable daily_policy
Cloning a rule
You can clone both default and user-defined rules.
To clone a rule, complete the following steps.
1. Enter mapsRule --show to display the rule you want to clone.
mapsrule --show rule_name
2. Enter mapsRule --clone oldRuleName -rulename newRuleName to duplicate the rule.
mapsrule --clone existing ruleName -rulename new ruleName
[-group group name | flow name] [-monitor ms name] [-timebase day:hour:min]
[-op l:le:g:ge:eq] [-value value] [-action action]
Optionally, you can specify the parameters you want to be different from the old rule in the new
rule. If no parameters other than -rulename are specified, an exact copy of the original rule is
created. You can later modify the rule by using --config.
For example, the following command clones “myOldRule” as “myNewRule”, but changes the
flow that is being monitored to “flow2” and assigns it the monitor “monitor2”.
switch:admin> mapsrule --clone myOldRule -rulename myNewRule -group flow2
-monitor monitor2
Cloned rule examples
The following example creates a cloned rule that is exactly the same as the source rule.
admin> mapsrule --clone Rule1 -rulename NewRule1
admin> mapsrule --show NewRule1
RuleName: NewRule1
Action: Raslog, Fence, SNMP
Condition: Switch(SEC_IDB/Min>0)
Policies Associated: none
The following example creates a cloned rule with a changed time base.
admin> mapsrule --clone Rule1 -rulename NewRule2 -timebase hour
admin> mapsrule --show NewRule2
RuleName: NewRule2
Action: Raslog, Fence, SNMP
Condition: Switch(SEC_IDB/Hour>0)
Policies Associated: none
The following example modifies the time base of an existing rule.
admin> mapsrule --config Rule2 -timebase hour
admin> mapsrule --show Rule2
RuleName: Rule2
Action: Raslog, Fence, SNMP
Condition: Switch(SEC_IDB/Hour>0)