Here's the transcript for the 10/6/09 chat:
Transcript for Chat: 'JUNOS Live Chat', Tue Oct 06 10:56:15 PDT 2009
jmattan: Welcome everyone. This is Jeff
Mattan, JUNOSJeff on Facebook and Twitter. Thanks for joining
us and go ahead and submit questions as you�d like.
jmattan: this question came in prior to the event. Q: Are there
different types of script? And what they are best suited for? A: There are 3
types of automation script: commit, op, and event. They have the same
programming syntax and construct, but are used for different purposes and executed
differently. Commit script is executed at commit time - meaning every time the
config is changed, op script is executed interactively at CLI level, event
script is triggered based on a set of events and execute without any human
interaction. Simply put, commit script is for configuration automation, op
script is for operations automation, and event script is for event automation.
jmattan: We are live so feel free to submit questions. You didn't just
come for hte prizes, did you? 
jmattan: This question came in prior to the event as well: Q: What is
the security model of scripts? Who and how are scripts executed? A: User
operations performed by op scripts are limited and controlled by JUNOS
permissions. Actions from commit scripts are limited (only 5 available
actions). You are not allowed to perform a task via scripting which you cannot
do it through other means, e.g. CLI, XML APIs.
ericwchan: Hi
mpreath: Have you seen this scripting done with Perl or Ruby? I
personally use some external scripting to get inventories, config backups, etc.
Are there programming API's available?
PhilShafer: To mpreath JUNOS includes a full set of XML APIs, which
allow an application to send XML content and receive an XML reply. Off-box
applications can use this in perl, ruby, or any language. On-box, we support XSLT and SLAX.
PhilShafer: To mpreath Details of the API are on www.juniper.net/support/junoscript
jtb: first of all thanks for "Day One: Applying JUNOS
Automation", it's great for starting with JUNOscript ! Question: any plans
to follow with Day Two ? :-) Something about commit and event scripts ?
ccall: To jtb Hello jtb. I'm glad you enjoyed the first booklet of the
JUNOS Software Automation Series. There are additional booklets planned, the
next will cover event policies and event scripts and the third will cover
commit scripts. I believe the second booklet is tentatively planned for (late)
Q4 of this year.
mpreath: thanks
PhilShafer: To mpreath No problem. Op scripts and event scripts are both
pieces that can functionally be done off the box. Commit scripts are coupled
more tightly to the box, since they are fired off the detect errors whenever a
commit is performed.
ericwchan: do you have a quick example of how script works?
roy_lee: To ericwchan A quick example will be to define a maintenance
window when no changes to the configuration is allowed. You can specific the
the start/stop time and the action, i.e. fail the commit, or issue a warning.
Better yet. you can specific who or what user group can make the changes.
Sounds good?
jmattan: To JTB: as an FYI, Curtis is the author of that Day One booklet
so please feel free to ask some more questions on it. Curtis didn't mention
that as he is just being modest.
ericwchan: to roy_lee: .. haha.. sounds good to my manager 
.. I
understand..
seemer: What is the best source of information on writing scripts? A
book, web page?
ccall: To seemer There are a copy of good sources. First, we have a free
eLearning course available: http://www.juniper.net/us/en/training/elearning/ju
shadow: Are you planning on creating a Junos Script Cookbook, similiar
to your other OReilly offerings
roy_lee: To shadow We are working on publishing books and easy-to-use
content for busy professional like you to get a head start on JUNOS automation.
A cookbook on scripting is definitely on our radar screen. Stay tune and we
will keep you posted.
jtb: Are there any built-in mechanisms to protect the RE from
misbehaving scripts ? Like, too deep level of recursion, too big memory/cpu
usage ?
PhilShafer: To jtb The script driver limits both memory and recursion,
and the normal unix scheduler limits cpu. Also each script is limited in
permissions to exactly what the user can do in the CLI. If you can't execute a
command in the CLI, you can run it in the API or in an on-box script.
jmattan: To add to ccall's enswer to Seemer: Plus we have a public
script library with a collection of various types of scripts posted in our
website www.juniper.net/scriptlibrary
mpreath: What devices is scripting supported
on and what devices is it not?
roy_lee: To mpreath JUNOS scripting is supported
on all devices which run JUNOS. Simple isn't it? No if, no but We have one
JUNOS, and one consistent implementation of JUNOS scripting toolset.
jmattan: This question came in prior to the event: Q: What can (or
can�t) a script do? A: A script can be written to automate many tasks which
you would otherwise have to do it manually. The simplest example of an
op-script is to reformat the output of a JUNOS CLI command to match your
specific needs. For commit script, define a set of rules and best practices to
avert human errors and costly downtime is very popular among our customers.
mpreath: very simple
jmattan: Reminder: We�re doing this event on our J-Net Community
Forum. This is a great place to ask questions like this and you don�t need to
wait for an event to ask them. So after we�re done, if you have a Juniper/
JUNOS question, come on back to J-Net and ask it.
PhilShafer: So let's talk about some examples of what scripts can do. We
have scripts that can inspect a box's hardware inventory and report any FRUs or
software that has been EOL'd.
seemer: What can trigger an event script? For example, can it be
triggered by a certain percent of packet loss on a specific link/interface?
ccall: To seemer Event scripts are triggered by syslog messages, SNMP
traps, chassis alarms, as well as time based events. You could probably trigger
a script based on packet loss by configuring RMON to write a syslog message or
trap, which could then trigger an event script.
jtb: [script mem/cpu limits] Yes, what I mean we all make errors, so
it's possible to have an old script starting looping one day. You know there is
always one more bug left in a program ... :-) I would just like to have an
option for maximum allowed script execution time (for example)
JNPRSavy: how can we automate the backup of the running config using an
script?
PhilShafer: To JNPRSavy Three ways to do this: (a) "set system
archival configuration transfer-on-commit ...." will transfer the config
on each commit. (b) an event policy can run the "show configuration"
command and transfer the results. (c) an event script can use the
<get-configuration> RPC to get the config and then archive it. (a) is
simplest, (c) gives the most flexibility.
mpreath: Is there a way through scripting to "walk" lets say a
core ring of routers and gather information from each. Or would have to script
individually to each router?
roy_lee: To mpreath You question is right on! scripting is not limited
and localized in one device. A script can traverse a path to to other devices,
e.g. peers, to collect info and return the result to the originating device.
Neat? This multi-box scripting capability is really powerful.
jmattan: This question came in prior to the event. Q: Will Juniper support the scripts written by me? A: Juniper fully supports the scripting infrastructure and the APIs
as a platform for user to develop scripts in JUNOS to automate their tasks. If
customers require technical assistance or encounter problem with the scripts
written by themselves, we would be glad to help. Please submit your request and
go through the normal support
channel.
ericwchan: to PhilShafer: what about keep track of the status of VC
member? .. I don't have a good way to detect if someone pulled the power cord
off one of the VC member..
PhilShafer: To ericwchan Yes, the loss of a VC member can be detected
and announced via syslog or SNMP trap.
Nutzmann: Does Juniper provide script templates for common tasks ?
roy_lee: To Nutzmann In our script library
www.juniper.net/scriptlibrary, we have over 50 of these examples which are
solutions to common problems. These example scripts also serve a good starting
point for you to edit and customize for your needs.
ericwchan: to PhilShafer: what about to trigger a request support info if a VC member is lost?
PhilShafer: To ericwchan When the loss is detected, the script can
perform any sort of action, including "request support
information" or trying to understand why the VC was lost (routing,
interface, reachable, etc) and give the user more information to help them
debug the situation.
PhilShafer: This sort of "get additional debug information"
was the genesis of op scripts. An op script can incorporate all the steps you
use to diagnose a problem, so that your new third shift NOCster can have all
your debugging expertise, without waking you up in the middle of the night.
mpreath: do you have a link to some multi-box scripting examples?
ccall: To mpreath Here are two multi-device op script examples:
http://junoscriptorium.googlecode.com/svn/trunk/li
jtb: I was about to ask simillar question about the 'multi-box scripting
capability' ... Thanks for the links, let's look at it.
jmattan: here comes my standard description of the promotional give away
for our JUNOS Live Chat events.
jmattan: Details on Promotional Give Away: After this event we�re
giving away three JUNOS book packs consisting of one JUNOS Enterprise Routing
and one JUNOS Enterprise Switching book. In addition, for those attending all
three events, we'll include you in a drawing for one Asus EEE PC Netbook
computer and one 16GB iPod Touch. Here's what you need to do to enter the drawing
for all of the prizes described above: 1. If you haven't joined J-Net, register
for a free account. 2. To be eligible for the JUNOS book packs, by 5pm Pacific
time the day of the live chat, email the following information to
j-net@juniper.net � Your J-Net username � Your full name and mailing
address. � The answer to the question we ask during the live chat. 3. To be
eligible for the Asus Netbook and iPod Touch prizes, please email the following
information to j-net@juniper.net by 5pm Pacific time on October 6, 2009: �
Your J-Net username � Your full name and mailing address. � The answer to
all three live chat questions in this series * Prizes include one Asus EEE PC,
one 16GB iPod Touch media players, nine JUNOS book packs consisting of one JUNOS
Enterprise Routing and one JUNOS Enterprise Switching book. No purchase
necessary. Must be 18 years or older to be eligible to win the prize(s). Void
where prohibited by law. Winner(s) will be selected via random drawing.
Promotion ends at midnight PST on October 6, 2009. Limit one entry per person.
To be entered into the prize drawing, you must have a valid J-Net account.
Winners will be notified by October 15, 2009. Netbook/iPod models are subject
to availability and may differ from photos shown in advertising materials.
PhilShafer: Another example: JUNOS supports
a feature called "configuration groups" that allow a block of config
to be "inherited" in multiple places in the configuration hierarchy.
This allows common config to be written only once. We have an op script that
allows the contents of a config group to be shared over a number of devices.
When I update a config group, I just say "op share-data" and the
contents of the config group are copied to the appropriate boxes. This simplifies
that task of, say, updating your list of name servers or ntp servers.
seemer: Is scripting part of any Juniper exams?
jmattan: To seemer We're fairly sure scripting is no included in our
technical certification exams. However, we're not the certification experts so
I suggest you post that question on J-Net. That way, our training people can
answer it more completely.
jmattan: This ithiss our 3rd of 3 live chats on JUNOS and we'd like to
do some more. What should future JUNOS Live Chat topics be? Please send ideas to
j-net@juniper.net
jmattan: This question came in prior to the event. Q: How do I best
integrate JUNOS automation into my existing network operations? You can think
of automation scripts as configuration and CLI commands, Anything you can
config or run JUNOS via the XML API, you can automate the task and run it
on-box. These scripts need to be copied to specific directory in JUNOS, then
enable them as part of the configuration. You can easily update, add, disable
or remove scripts a similar way as you would do in configuring JUNOS.
jmattan: ccall, PhilShafer and roy_lee are scripting experts so this is
a great time to ask them anything and everything about scripting. Fire away!
PhilShafer: We also have a "Wizard Framework", which allows a
script to define a set of questions to be asked of the user. The WF returns the
data to the script, where it can be used to build config data. One WF-based
script creates GRE and IPIP tunnels, performing RPCs to the remote destination
to create a list of the available devices. The user can pick the interfaces,
provide the address information, and the script generates config for both
endpoints. The config is then committed and tested.
mpreath: thats pretty slick. I'd imagine you could do a wizard for doing
MPLS L3VPNs, pseudowires, and TE tunnels.
ccall: Here are some new scripting features in the last three releases
that you might not be aware of: JUNOS 9.4 - Retrieve interactive input through
jcs:input() function JUNOS 9.4 - EXSLT functions support
JUNOS 9.5 - Script integrity checking through checksums JUNOS 9.5 - Login
scripts - op scripts run automatically at user login JUNOS 9.6 - Retrieve
interactive input without echoing to the screen (for passwords) through
jcs:get-secret() function JUNOS 9.6 - Event Script multi-box capabilities
skreenerd: what if someone, in his part of the net, wants to be aware of
anyone running scripts in some of his devices?? is it detectable somehow?
PhilShafer: To skreenerd CLI commands are "events", so an
event script can detect when a script is run and trigger any behavior, such as
syslog, snmp trap, logoff, disable the user's incoming interface, etc. Or you
can detect that someone is using the script you want them to, and trigger a
script that gets them promoted!
PhilShafer: Yes, if you can give the decision tree and the output
config, the logic between them is fairly trivial to construct.
seemer: What are my options for analyzing command output in scripts,
just basic UNIX "grep" or are there any more sophisticated tools?
ccall: To seemer The tools available within scripts are much more
powerful than grep. The command output is retrieved in XML format allowing you
to use XPATH location paths to pinpoint the exact data you want. For an
example, append | display xml to any CLI command to see what data the script
would be working with. The hierarchy of XML, and the syntax provided for
location paths, make it very simple to pinpoint exactly what data is desired.
ericwchan: I used expect script to ssh to the EX and run "show
ethernet-switching table" to help me keep track of mac-addresses on the
network every hour. Can JUNOS script do the same? Which do you think is better?
roy_lee: To ericwchan JUNOS script can do exactly what your expect
script does, and more Since script uses XML so the input and output are
well-defined and structured. Say for example, if there is a minor change to the
output or format, an expect script would/may need to be tweaked to adjust for
this change, but with JUNOS script, you don't. You would spend less time in
maintaining or revising JUNOS script to accomplish what you need.
skreenerd: so it is like an specific script to detect scripts,is that
what u mean?
PhilShafer: To skreenerd Yes, the CLI generates events on the box when
the user runs a script, so a second script (an event script) can detect that.
jmattan: this question came in prior to the event. Q: Why are there two
programming languages in writing scripts: SLAX vs XSLT? A: XSLT is the original
language for writing automation scripts. SLAX stands for Stylesheet Language
Alternative SyntaX, is a language which is similar to C/Perl, which should be
easier for developers to get a head start on writing scripts. Anything you can
do in XSLT, you can write it equivalently in SLAX. We also have a built-in
command to convert back-and-forth between the two languages.
PhilShafer: To ericwchan An example of the benefits of well-defined XML
data would be using XPath expressions like: for-each ($route/rt-entry[med <
10 && preference >= 100]) { ... } The expression can refer to xml
element name. Try running your favorite JUNOS "show" command with the
" | display xml " pipe to see the raw XML that we use internally and
publish via the API. These are the tags your script will see. No more regular
expressions to find your data.
jtb: we know there is perl JUNOscript library, any plans for something
non-perl (python ?) Most of my scripts (non JUNOscript) are perl but I would
like to migrate to something more programmer friendly :-) It would be good to
have community based scripts repository (one single place).
PhilShafer: To jtb We have Perl modules on CPAN, and want to publish API
libraries in other languages. Since the API is also NETCONF based (RFC4741),
and NETCONF libraries can also be used. I don't have the URL handy but have
seen Java NETCONF libraries at least, but won't remember any python ones.
jmattan: Again, don't forget to come back to J-Net with future
scripting/ JUNOS/ Juniper questions as the community has answers.
skreenerd: is there a way of confirmation, before running it, that the
script will work properly?
ccall: To skreenerd The logic of the script would have to be verified by
the programmer, prior to running it, but there is a SLAX debugging script
available which will scan other scripts and catch many syntax and programming
errors:
http://junoscriptorium.googlecode.com/svn/trunk/li
jmattan: This questions came in prior to the event. Q: Does scripting
work across all Juniper platforms? A: Scripting works in all JUNOS platforms.
Unlike many of our competitors, the scripting toolset is a single
implementation consistently available across JUNOS platforms.
ghedge: Isn't there also a perl based scripting method as well or how
does that work with XML?
roy_lee: To ghedge For the perl based scripting method, I'd assume
you're referring to the XML APIs (JUNOScript/Netconf) for remote configuration
and management. The same set of XML APIs is leveraged for on-box scripting
automation. They are complementary in terms of usage. There are benefits to run
a script on-box and off-box. The best part is they all run on top of the same
XML underpinnings in JUNOS.
jmattan: about 10 minutes left so go ahead and get in your questions
while you can.
PhilShafer: To skreenerd Re: debugging: In most cases, you can run
commit scripts using "xsltproc" off the box. You also
PhilShafer: To skreenerd ... have "commit check" and
"commit check | display detail" to help you.
ac: Don't forget to check out our latest J-Net registration promo:
register for a new account or refer a friend for a chance to win a netbook,
iPod Touch or Vado HD camera http://forums.juniper.net/t5/J-Net-News/Time-for-a
jmattan: Secret question and answer seemer What is the best source of
information on writing scripts? A book, web page? ccall: To seemer There are a
copy of good sources. First, we have a free eLearning course available:
http://www.juniper.net/us/en/training/elearning/ju
PhilShafer: Another example: "itr" (intelligent traceroute)
logs into each route along a path between two endpoints and reports the device
type, running software, and data on the local links. Other common issues
(duplex and mtu mismatches) are checked on each hop.
jtb: I'm aware Curtis is the author of Day One, so the first 'thanks'
were not an coincidence. Just one note: the quotation marks in the PDF file
were converted to different characters, so one must careful with cut&paste.
Just a minor issue with great
jmattan: To jtb Thanks for joining and for the heads up on quotation
marks in PDFs. I'll pass that feedback along.
jmattan: One more question that came in prior to the event. Q: Any tools
available to help me to test and debug scripts? A: There are various log files
and commands available to test and debug scripts, e.g. traceoptions, commit |
display detail, /var/log/cscript.log. We also have an tool called the SLAX
doctor which is written as an op-script which checks for basic syntax error
jmattan: we're working on the reply to danshtr.
jmattan: any last questions?
danshtr: in a mixed cisco/juniper networks, how do you suggest doing
cross platrom scripting?
PhilShafer: To danshtr Our scripting is NETCONF-based, so any
NETCONF-enabled device should be able to receive our inter-box RPCs. The RPC
and RPC reply contents will vary, but the communications should work.
roy_lee: To danshtr The easy answer would to upgrade all your Cisco gear
to Juniper :-). Cisco provides similar scripting support,
but not to the same extent as in JUNOS.
mpreath: you will be posting this chat online afterwards right?
jmattan: The transcript of this chat will be posted today or tomorrow
and while we have until the 15th to notify the winners of the prizes, we'll do
that by the end of the week. Thanks all for joining!!
ac: Thank you everyone, bye now
danshtr: thanks
ericwchan: thank you
mpreath: thank you
BryanM: Thanks!
seemer: Thanks!
