How to permit only one syslog IP through policy compliance and auto-remediate?

[Haseeb_Ahmad]

I have been trying to permit only one syslog IP through policy compliance rule but unble to succeed. 

Following is part of the router configuration script which shows syslog logging:

ip access-list standard WR

logging 192.168.2.2

logging 192.168.122.1

logging 10.173.0.38

I want that my syslog IP should be only 10.173.0.38 but my configuration script for cisco router has more than one syslog IPs. I want to do this through policy compliance rule for this  I have made the policy rule:

It must contain only:

logging 10.173.0.38

but must not contain any additional lines containing:

logging\s\d+.\d+.\d+.\d+

I have written the regex form for not containing any additional lines having logging bcz I want only 10.173.0.38 to be logging for syslog.

This policy should show compliance issues when tested for my router but it is showing that the device is compliant.

Furthermore, what should be the auto-remediating script so that it should delete extra lines having logging except for 10.173.0.38? 

[Pedro_B_NA]

Hi @Haseeb_Ahmad ,

you can use the regex101.com to test the piece of config you need against some of the expression you want to test, also it would be more advisable to review the config against more lines, like it must not contain more than X number of logging lines.

[Pedro_B_NA]

also in 10.40.x, you have the option to add an exception to a rule:

as you can see the result is that it only checked for the other instances with logging where picked up

[Haseeb_Ahmad]

Hi @Pedro_B_NA

Thanks now the extra logging IPs are being detected. I'm also stuck in how to delete these extra logging IPs through auto-remediation plan. I've written the following script but this  doesn 't make any changes, I've mentioned the logging IP in the script at top which should only be permitted.

The change plan tag is General purpose

Device Family: Cisco IOS

Mode: Cisco IOS configuration

logging 10.173.0.38
@foreach $matching_line$ in $condition_A_line_1$
no logging $matching_line.logging_group_0$
@end 

I've tried multiple possibilities in the script but I'm stuck. The regex form for logging IP could be logging\s\d+.\d+.\d+.\d+ which I've checked from Regex101.com