`netops.check` — Health & Compliance Checks¶

Composable health, BGP, interface, VLAN, and vendor-specific checks.

`netops.check.health`¶

Composable health checks for network devices.

Runs CPU, memory, interface-error, and log checks across vendors and reports results as structured JSON for monitoring integration.

CLI usage:

python -m netops.check.health --inventory inv.yaml --group core \
    --threshold cpu=80,mem=85
python -m netops.check.health --host 10.0.0.1 --vendor cisco_ios \
    --threshold cpu=80,mem=85 --json

health ¶

Composable health checks for network devices.

Runs CPU, memory, interface-error, and log checks across vendors and reports results as structured JSON for monitoring integration.

Usage::

python -m netops.check.health --inventory inv.yaml --group core \\
    --threshold cpu=80,mem=85

python -m netops.check.health --host 10.0.0.1 --vendor cisco_ios \\
    --threshold cpu=80,mem=85 --json

Classes¶

Functions:¶

check_cpu ¶

check_cpu(conn: DeviceConnection, device_type: str, threshold: float) -> dict

Return CPU utilisation check result.

check_memory ¶

check_memory(conn: DeviceConnection, device_type: str, threshold: float) -> dict

Return memory utilisation check result.

check_interface_errors ¶

check_interface_errors(conn: DeviceConnection, device_type: str) -> dict

Return interface error-counter check result.

check_logs ¶

check_logs(conn: DeviceConnection, device_type: str) -> dict

Return log-scan check result (critical/major events).

run_health_check ¶

run_health_check(params: ConnectionParams, cpu_threshold: float = DEFAULT_CPU_THRESHOLD, mem_threshold: float = DEFAULT_MEM_THRESHOLD) -> dict

Run all health checks against a single device.

Returns:

Type	Description
`dict`	Result dict with keys: `host` – device IP/hostname `timestamp` – ISO-8601 UTC timestamp `success` – `True` when connection succeeded `checks` – dict of individual check results `overall_alert`– `True` when any check triggered an alert `error` – error message when connection failed

build_health_report ¶

build_health_report(results: list[dict]) -> dict

Build an aggregated health report from a list of per-device results.

Parameters:

Name	Type	Description	Default
`results`	`list[dict]`	List of dicts returned by :func:`run_health_check`.	required

Returns:

Type Description

dict

Summary dict with keys:

devices – total devices polled
devices_reachable – devices successfully reached
devices_with_alerts – count of devices with at least one alert
cpu_alerts – count of devices with a CPU alert
memory_alerts – count of devices with a memory alert
interface_error_alerts – count of devices with interface error alerts
log_alerts – count of devices with log alerts
overall_alert – True when any device triggered an alert
results – original per-device result list

main ¶

main() -> None

CLI entry point for composable device health checks.

`netops.check.bgp`¶

BGP peer monitoring — peer state, prefix counts, and flap detection.

CLI usage:

python -m netops.check.bgp --inventory inv.yaml
python -m netops.check.bgp --inventory inv.yaml --expected-prefixes 10.0.0.2=100 --fail-on-alert

bgp ¶

BGP session monitor — peer status, prefix counts, flap detection.

Checks BGP sessions across one or many routers and reports:

Peer up/down status
Prefix count vs expected (alert on configurable deviation %)
Flap detection — sessions established for fewer than flap_min_uptime seconds are flagged as potentially flapping
Summary report aggregated across all polled routers

Supports Cisco IOS/IOS-XE/IOS-XR and Nokia SR-OS.

Usage::

python -m netops.check.bgp --inventory inventory.yaml \\
    --expected-prefixes 10.0.0.2=100,10.0.0.3=200 \\
    --flap-min-uptime 300 --prefix-deviation 20

python -m netops.check.bgp --host 10.0.0.1 --vendor cisco_ios --json

Classes¶

Functions:¶

check_bgp_peers ¶

check_bgp_peers(params: ConnectionParams, expected_prefixes: dict[str, int] | None = None, flap_min_uptime: int = DEFAULT_FLAP_MIN_UPTIME, prefix_deviation_pct: float = DEFAULT_PREFIX_DEVIATION_PCT) -> dict

Check BGP peer status on a single device.

Parameters:

Name	Type	Description	Default
`params`	`ConnectionParams`	Device connection parameters.	required
`expected_prefixes`	`dict[str, int] \| None`	Optional dict mapping neighbor IP → expected prefix count. An alert fires when the actual received-prefix count deviates from the expected value by more than prefix_deviation_pct percent.	`None`
`flap_min_uptime`	`int`	Sessions established for fewer than this many seconds are flagged as potentially flapping (default: 300 s = 5 min).	`DEFAULT_FLAP_MIN_UPTIME`
`prefix_deviation_pct`	`float`	Percentage threshold for prefix-count deviation alerts (default: 20%).	`DEFAULT_PREFIX_DEVIATION_PCT`

Returns:

Type	Description
`dict`	Result dict with keys: `host` – device IP/hostname `timestamp` – ISO-8601 UTC timestamp `success` – `True` when the device was reached `peers` – list of per-peer check dicts `summary` – aggregate counts across all peers on this device `overall_alert` – `True` when any alert fired `error` – error message when connection failed

build_bgp_report ¶

build_bgp_report(results: list[dict]) -> dict

Build an aggregated BGP report from a list of per-device results.

Parameters:

Name	Type	Description	Default
`results`	`list[dict]`	List of dicts returned by :func:`check_bgp_peers`.	required

Returns:

Type Description

dict

Summary dict with keys:

routers – total routers polled
routers_reachable – routers successfully reached
total_peers – total BGP peers across all routers
established – peers in Established state
not_established – peers not in Established state
flapping – peers flagged as potentially flapping
prefix_alerts – peers with prefix-count deviations
overall_alert – True when any alert fired
peers – flat list of all peer dicts with router key

main ¶

main() -> None

CLI entry point for the BGP session monitor.

`netops.check.interfaces`¶

Interface status and error checking.

CLI usage:

python -m netops.check.interfaces --host 10.0.0.1 --vendor cisco_ios --json
python -m netops.check.interfaces --host 10.0.0.1 --vendor cisco_ios --down-only

interfaces ¶

Check interface status across devices.

Usage: python -m netops.check.interfaces --inventory inventory.yaml --down-only python -m netops.check.interfaces --host 10.0.0.1 --vendor cisco_ios

Classes¶

Functions:¶

parse_cisco_interfaces ¶

parse_cisco_interfaces(output: str) -> list[dict]

Parse 'show ip interface brief' output.

check_interfaces ¶

check_interfaces(params: ConnectionParams, down_only: bool = False) -> dict

Check interface status on a device.

main ¶

main() -> None

CLI entry point for the interface status checker.

`netops.check.vlan`¶

VLAN consistency audit across switching infrastructure.

CLI usage:

python -m netops.check.vlan --inventory inv.yaml --expected-vlans 10,20,30-50
python -m netops.check.vlan --inventory inv.yaml --vlan-db vlans.yaml --json

vlan ¶

VLAN audit — compare declared vs actual VLAN configuration across switches.

Checks VLAN configuration on a switch fabric and reports:

Missing VLANs — declared VLANs not present on a switch
Extra VLANs — VLANs present on a switch but not in the declared database
Name mismatches — VLANs present but with a different name than declared
Trunk mismatches — declared VLANs not active on trunk interfaces
Per-switch compliance status

Supports Cisco IOS/IOS-XE.

Usage::

python -m netops.check.vlan --inventory inventory.yaml \\
    --expected-vlans 10,20,30-50,100 \\
    --check-trunks

python -m netops.check.vlan --host 10.0.0.1 --vendor cisco_ios \\
    --vlan-db vlans.yaml --json

VLAN database file (vlans.yaml) format::

vlans:
  10: MANAGEMENT
  20: SERVERS
  100: DMZ

Classes¶

Functions:¶

audit_vlans ¶

audit_vlans(params: ConnectionParams, expected_vlans: set[int], expected_names: dict[int, str] | None = None, check_trunks: bool = False, ignore_vlans: set[int] | None = None) -> dict

Audit VLAN configuration on a single switch.

Parameters:

Name	Type	Description	Default
`params`	`ConnectionParams`	Device connection parameters.	required
`expected_vlans`	`set[int]`	Set of VLAN IDs that should be present on the switch.	required
`expected_names`	`dict[int, str] \| None`	Optional mapping of VLAN ID → declared VLAN name. When provided, name mismatches are included in the result.	`None`
`check_trunks`	`bool`	When `True`, also issue `show interfaces trunk` and flag any expected VLAN that is not active on a trunking interface.	`False`
`ignore_vlans`	`set[int] \| None`	Additional VLAN IDs to exclude from the extra VLANs check (system VLANs 1002–1005 are always excluded regardless).	`None`

Returns:

Type Description

dict

Result dict with keys:

host – device IP/hostname
timestamp – ISO-8601 UTC timestamp
success – True when the device was reached
actual_vlans – list of per-VLAN dicts from :func:~netops.parsers.vlan.parse_vlan_brief
trunks – list of trunk-port dicts (empty when check_trunks is False)
missing_vlans – VLAN IDs in expected_vlans but absent from the switch
extra_vlans – VLAN IDs on switch but not in expected_vlans
name_mismatches – list of {vlan_id, expected_name, actual_name}
trunk_mismatches – list of {port, missing_vlans} (empty when check_trunks is False)
compliant – True when no discrepancies were found
alerts – human-readable list of alert messages
error – error message when the connection failed

build_vlan_report ¶

build_vlan_report(results: list[dict]) -> dict

Build an aggregated VLAN audit report from per-switch results.

Parameters:

Name	Type	Description	Default
`results`	`list[dict]`	List of dicts returned by :func:`audit_vlans`.	required

Returns:

Type Description

dict

Summary dict with keys:

switches – total switches polled
switches_reachable – switches successfully reached
switches_compliant – fully compliant switches
overall_alert – True when any switch is non-compliant
missing_vlan_switches – list of {host, missing_vlans}
extra_vlan_switches – list of {host, extra_vlans}
name_mismatch_switches – list of {host, name_mismatches}
trunk_mismatch_switches – list of {host, trunk_mismatches}

main ¶

main() -> None

CLI entry point for the VLAN configuration auditor.

`netops.check.arista`¶

Arista EOS health checks — uses eAPI JSON as the primary transport with CLI text fallback.

arista ¶

Arista EOS health checker.

Provides health checks for Arista EOS devices (DCS-7xxx, DCS-720x, etc.):

CPU and memory utilisation
Interface error counters and transceiver DOM
BGP/EVPN session state
OSPF adjacency verification
MLAG health and config-consistency
Environment — temperature sensors, fans, power supplies

eAPI JSON is the primary transport. Plain-text CLI output is used as a fallback when eAPI is unavailable.

Usage::

python -m netops.check.arista --host 10.0.0.1 --user netops \\
    --threshold cpu=80,mem=85 --json

python -m netops.check.arista --inventory inv.yaml --group arista \\
    --threshold cpu=80,mem=85 --fail-on-alert

Classes¶

Functions:¶

check_eos_cpu_memory ¶

check_eos_cpu_memory(conn: DeviceConnection, cpu_threshold: float, mem_threshold: float) -> dict

Return CPU and memory utilisation check result.

Queries show version (JSON) and returns:

cpu_utilization – overall CPU % (float) or None
memory_util – memory utilisation % (float) or None
cpu_threshold – configured CPU alert threshold
mem_threshold – configured memory alert threshold
cpu_alert – True when CPU ≥ cpu_threshold
mem_alert – True when memory ≥ mem_threshold
alert – True when either cpu_alert or mem_alert
eos_version – EOS software version string or None
model – hardware model or None
serial_number – chassis serial number or None
error – error message on failure, else None

check_eos_interfaces ¶

check_eos_interfaces(conn: DeviceConnection) -> dict

Return interface error-counter check result.

Queries show interfaces (JSON) and returns:

interfaces – list of per-interface dicts
total – total interfaces parsed
with_errors – count of interfaces with at least one error counter > 0
alert – True when any interface has errors
error – error message on failure, else None

check_eos_transceivers ¶

check_eos_transceivers(conn: DeviceConnection) -> dict

Return transceiver DOM check result.

Queries show interfaces transceiver (JSON) and returns:

transceivers – list of transceiver DOM dicts
total – total transceivers parsed
with_alerts – count of transceivers with DOM alerts
alert – True when any transceiver has a DOM alert
error – error message on failure, else None

check_eos_bgp ¶

check_eos_bgp(conn: DeviceConnection) -> dict

Return BGP session state check result.

Queries show bgp summary (JSON) and returns:

peers – list of BGP peer dicts
total – total peers parsed
established – count of peers in Established state
not_established – count of peers not Established
alert – True when any peer is not Established
error – error message on failure, else None

check_eos_bgp_evpn ¶

check_eos_bgp_evpn(conn: DeviceConnection) -> dict

Return BGP EVPN session state check result.

Queries show bgp evpn summary (JSON). Returns the same structure as :func:check_eos_bgp.

check_eos_ospf ¶

check_eos_ospf(conn: DeviceConnection) -> dict

Return OSPF neighbour state check result.

Queries show ip ospf neighbor (JSON) and returns:

neighbors – list of OSPF neighbour dicts
total – total neighbours parsed
full – count of adjacencies in Full state
not_full – count of adjacencies not in Full state
alert – True when any adjacency is not Full
error – error message on failure, else None

check_eos_mlag ¶

check_eos_mlag(conn: DeviceConnection) -> dict

Return MLAG health check result.

Queries show mlag and show mlag config-sanity (JSON) and returns:

mlag – parsed mlag status dict
config_sanity – parsed mlag config-sanity dict
is_active – True when MLAG state is active
peer_link_ok – True when peer-link is up
peer_active – True when peer is active
config_consistent – True when config-sanity reports consistent
alert – True when MLAG is active but has issues
error – error message on failure, else None

check_eos_environment ¶

check_eos_environment(conn: DeviceConnection) -> dict

Return environment (temperature, fans, PSUs) check result.

Queries show environment all (JSON) and returns:

power_supplies – list of PSU status dicts
fans – list of fan status dicts
temperatures – list of temperature sensor dicts
overall_ok – True when every component reports OK
alert – True when overall_ok is False
error – error message on failure, else None

run_health_check ¶

run_health_check(params: ConnectionParams, cpu_threshold: float = DEFAULT_CPU_THRESHOLD, mem_threshold: float = DEFAULT_MEM_THRESHOLD, check_bgp: bool = True, check_evpn: bool = False, check_ospf: bool = True, check_mlag: bool = True, check_transceivers: bool = False) -> dict

Run all EOS health checks against a single device.

Runs:

cpu_memory – CPU and memory utilisation
interfaces – interface error counters
transceivers – DOM alerts (when check_transceivers is True)
bgp – BGP session states (when check_bgp is True)
bgp_evpn – EVPN BGP sessions (when check_evpn is True)
ospf – OSPF adjacency states (when check_ospf is True)
mlag – MLAG health and config-sanity (when check_mlag is True)
environment – PSUs, fans and temperatures

Returns:

Type	Description
`dict`	Result dict with keys: `host` – device IP/hostname `timestamp` – ISO-8601 UTC timestamp `success` – `True` when connection succeeded `checks` – dict of individual check results `overall_alert` – `True` when any check triggered an alert `error` – error message when connection failed

build_eos_health_report ¶

build_eos_health_report(results: list[dict]) -> dict

Build an aggregated health report from a list of per-device results.

Parameters:

Name	Type	Description	Default
`results`	`list[dict]`	List of dicts returned by :func:`run_health_check`.	required

Returns:

Type Description

dict

Summary dict with keys:

devices – total devices polled
devices_reachable – devices successfully reached
devices_with_alerts – count of devices with at least one alert
cpu_memory_alerts – count of devices with CPU/memory alerts
interface_alerts – count of devices with interface error alerts
bgp_alerts – count of devices with BGP peer alerts
ospf_alerts – count of devices with OSPF adjacency alerts
mlag_alerts – count of devices with MLAG health alerts
environment_alerts – count of devices with environment alerts
overall_alert – True when any device triggered an alert
results – original per-device result list

main ¶

main(argv: list[str] | None = None) -> int

CLI entry point for Arista EOS health checks.

`netops.check.cisco`¶

Cisco IOS/IOS-XE/IOS-XR/NX-OS health checks.

cisco ¶

Cisco IOS/IOS-XE health checker.

Extends the generic health check with Cisco-specific checks:

CPU utilisation (show processes cpu)
Memory utilisation (show processes memory)
Interface error counters (CRC, input/output errors, drops)
BGP neighbour state and prefix counts
OSPF adjacency verification
Environment — temperature, power supplies, fans
Uptime and last reload reason

Supports IOS 15.x+ and IOS-XE 16.x+.

Usage::

python -m netops.check.cisco --host 10.0.0.1 --user admin \\
    --threshold cpu=80,mem=85 --json

python -m netops.check.cisco --inventory inv.yaml --group core \\
    --threshold cpu=80,mem=85 --fail-on-alert

Classes¶

Functions:¶

check_cisco_cpu ¶

check_cisco_cpu(conn: DeviceConnection, threshold: float) -> dict

Return CPU utilisation check result for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `utilization` – 1-minute average CPU % (`float`) or `None` on parse failure `threshold` – configured alert threshold `alert` – `True` when `utilization >= threshold` `raw` – full parsed data from the `show processes cpu` output

check_cisco_memory ¶

check_cisco_memory(conn: DeviceConnection, threshold: float) -> dict

Return memory utilisation check result for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `utilization` – memory used % (`float`) or `None` on parse failure `threshold` – configured alert threshold `alert` – `True` when `utilization >= threshold` `raw` – full parsed data from the `show processes memory` output

check_cisco_interfaces ¶

check_cisco_interfaces(conn: DeviceConnection) -> dict

Return interface error-counter check result for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `interfaces` – list of per-interface error dicts `total` – total number of interfaces parsed `with_errors` – count of interfaces that have at least one error counter > 0 `alert` – `True` when any interface has errors

check_cisco_logs ¶

check_cisco_logs(conn: DeviceConnection) -> dict

Return log-scan check result (severity 0–3 events) for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `critical_count` – count of severity 0–2 events `major_count` – count of severity 3 events `events` – list of parsed event dicts `alert` – `True` when any critical or major events are present

check_cisco_bgp ¶

check_cisco_bgp(conn: DeviceConnection, device_type: str = 'cisco_ios') -> dict

Return BGP neighbour state check result for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `peers` – list of peer dicts from the BGP summary parser `total` – total BGP peers parsed `established` – count of peers in Established state `not_established` – count of peers not in Established state `alert` – `True` when any peer is not Established

check_cisco_ospf ¶

check_cisco_ospf(conn: DeviceConnection) -> dict

Return OSPF adjacency check result for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `neighbors` – list of neighbour dicts from the OSPF parser `total` – total OSPF neighbours parsed `full` – count of neighbours in FULL state `not_full` – count of neighbours not in FULL state `alert` – `True` when any neighbour is not in FULL state

check_cisco_environment ¶

check_cisco_environment(conn: DeviceConnection) -> dict

Return environment check result for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `fans` – list of fan status dicts `temperatures` – list of temperature sensor dicts `power_supplies` – list of power-supply status dicts `overall_ok` – `True` when all reported components are OK `alert` – `True` when `overall_ok` is `False`

check_cisco_uptime ¶

check_cisco_uptime(conn: DeviceConnection) -> dict

Return uptime and reload reason check result for a Cisco IOS/IOS-XE device.

Returns:

Type	Description
`dict`	Dict with keys: `version` – IOS/IOS-XE version string `platform` – hardware platform identifier `uptime` – uptime string as reported by the device `reload_reason` – last reload or restart reason `image` – system image file path `alert` – always `False` (informational only)

run_cisco_health_check ¶

run_cisco_health_check(params: ConnectionParams, cpu_threshold: float = DEFAULT_CPU_THRESHOLD, mem_threshold: float = DEFAULT_MEM_THRESHOLD, include_bgp: bool = True, include_ospf: bool = True, include_environment: bool = True) -> dict

Run all Cisco IOS/IOS-XE health checks against a single device.

Parameters:

Name	Type	Description	Default
`params`	`ConnectionParams`	Device connection parameters.	required
`cpu_threshold`	`float`	CPU alert threshold in percent (default: 80).	`DEFAULT_CPU_THRESHOLD`
`mem_threshold`	`float`	Memory alert threshold in percent (default: 85).	`DEFAULT_MEM_THRESHOLD`
`include_bgp`	`bool`	When `True` (default), run the BGP peer check.	`True`
`include_ospf`	`bool`	When `True` (default), run the OSPF adjacency check.	`True`
`include_environment`	`bool`	When `True` (default), run the environment check.	`True`

Returns:

Type Description

dict

Result dict matching the standard health-check schema::

{
    "host":          <str>,
    "timestamp":     <ISO-8601 UTC>,
    "success":       <bool>,
    "checks": {
        "cpu":               { "utilization": <float>, "alert": <bool>, ... },
        "memory":            { "utilization": <float>, "alert": <bool>, ... },
        "interface_errors":  { "with_errors": <int>,   "alert": <bool>, ... },
        "logs":              { "critical_count": <int>, "alert": <bool>, ... },
        "bgp":               { "not_established": <int>, "alert": <bool>, ... },
        "ospf":              { "not_full": <int>,      "alert": <bool>, ... },
        "environment":       { "overall_ok": <bool>,   "alert": <bool>, ... },
        "uptime":            { "uptime": <str>,        "alert": False, ... },
    },
    "overall_alert": <bool>,
    "error":         <str | None>,
}

build_cisco_health_report ¶

build_cisco_health_report(results: list[dict]) -> dict

Build an aggregated health report from a list of per-device results.

Parameters:

Name	Type	Description	Default
`results`	`list[dict]`	List of dicts returned by :func:`run_cisco_health_check`.	required

Returns:

Type Description

dict

Summary dict with keys:

devices – total devices polled
devices_reachable – devices successfully reached
devices_with_alerts – count of devices with at least one alert
cpu_alerts – devices with a CPU alert
memory_alerts – devices with a memory alert
interface_error_alerts – devices with interface error alerts
log_alerts – devices with log alerts
bgp_alerts – devices with BGP peer alerts
ospf_alerts – devices with OSPF adjacency alerts
environment_alerts – devices with environment alerts
overall_alert – True when any device triggered an alert
results – original per-device result list

main ¶

main() -> None

CLI entry point for Cisco IOS/IOS-XE health checks.

`netops.check.juniper`¶

Juniper JunOS health checks — Routing Engine status, FPC, BGP, OSPF, chassis alarms, environment, and route summary.

juniper ¶

Juniper JunOS health checker.

Provides health checks for Juniper JunOS devices (MX, QFX, EX, SRX):

Routing Engine (RE) CPU and memory utilisation
FPC slot operational status
Interface error counters
BGP neighbour state and prefix counts
OSPF adjacency verification
Chassis alarms (major/minor)
Chassis environment — power, cooling, temperature
Routing table summary

Supports JunOS 18.x+. Works with both XML RPC and CLI (text) modes via Netmiko's juniper / juniper_junos device type.

Usage::

python -m netops.check.juniper --host 10.0.0.1 --user netops \\
    --threshold cpu=80,mem=85 --json

python -m netops.check.juniper --inventory inv.yaml --group juniper \\
    --threshold cpu=80,mem=85 --fail-on-alert

Classes¶

Functions:¶

check_junos_re ¶

check_junos_re(conn: DeviceConnection, cpu_threshold: float, mem_threshold: float) -> dict

Return Routing Engine CPU and memory check result.

Queries show chassis routing-engine and returns:

routing_engines – list of per-RE dicts from the parser
cpu_utilization – highest CPU % across all REs (float) or None
mem_utilization – highest memory % across all REs (float) or None
cpu_threshold – configured CPU alert threshold
mem_threshold – configured memory alert threshold
cpu_alert – True when any RE CPU ≥ cpu_threshold
mem_alert – True when any RE memory ≥ mem_threshold
alert – True when either cpu_alert or mem_alert is True
error – error message on failure, else None

check_junos_fpc ¶

check_junos_fpc(conn: DeviceConnection) -> dict

Return FPC slot status check result.

Queries show chassis fpc and returns:

fpcs – list of per-FPC dicts from the parser
total – total FPC slots parsed
online – count of FPCs in Online state
offline – count of FPCs in Offline state (excluding Empty/Spare)
alert – True when any non-empty FPC is not Online
error – error message on failure, else None

check_junos_interfaces ¶

check_junos_interfaces(conn: DeviceConnection) -> dict

Return interface error-counter check result.

Queries show interfaces extensive and returns:

interfaces – list of per-interface error dicts from the parser
total – total interfaces parsed
with_errors – count of interfaces with at least one non-zero error counter
alert – True when any interface has errors
error – error message on failure, else None

check_junos_bgp ¶

check_junos_bgp(conn: DeviceConnection) -> dict

Return BGP neighbour state check result.

Queries show bgp summary and returns:

peers – list of peer dicts from the parser
total – total BGP peers parsed
established – count of peers in Established state
not_established – count of peers not in Established state
alert – True when any peer is not Established
error – error message on failure, else None

check_junos_ospf ¶

check_junos_ospf(conn: DeviceConnection) -> dict

Return OSPF neighbour state check result.

Queries show ospf neighbor and returns:

neighbors – list of neighbour dicts from the parser
total – total OSPF neighbours parsed
full – count of adjacencies in Full state
not_full – count of adjacencies not in Full state
alert – True when any adjacency is not Full
error – error message on failure, else None

check_junos_alarms ¶

check_junos_alarms(conn: DeviceConnection) -> dict

Return chassis alarm check result.

Queries show chassis alarms and returns:

alarms – list of alarm dicts from the parser
major_count – number of Major alarms
minor_count – number of Minor alarms
alert – True when any Major alarm is present
error – error message on failure, else None

check_junos_environment ¶

check_junos_environment(conn: DeviceConnection) -> dict

Return chassis environment check result.

Queries show chassis environment and returns:

power_supplies – list of PSU status dicts
fans – list of fan status dicts
temperatures – list of temperature sensor dicts
overall_ok – True when every component reports OK
alert – True when overall_ok is False
error – error message on failure, else None

check_junos_routes ¶

check_junos_routes(conn: DeviceConnection) -> dict

Return routing table summary check result (informational).

Queries show route summary and returns:

tables – list of routing-table summary dicts
alert – always False (informational only)
error – error message on failure, else None

run_health_check ¶

run_health_check(params: ConnectionParams, cpu_threshold: float = DEFAULT_CPU_THRESHOLD, mem_threshold: float = DEFAULT_MEM_THRESHOLD, check_bgp: bool = True, check_ospf: bool = True) -> dict

Run all JunOS health checks against a single device.

Runs:

RE – Routing Engine CPU and memory utilisation
FPC – slot operational status
interfaces – error counters
BGP – neighbour session states (when check_bgp is True)
OSPF – adjacency states (when check_ospf is True)
alarms – chassis alarm summary
environment – power supplies, fans and temperatures
routes – routing table summary (informational)

Returns:

Type	Description
`dict`	Result dict with keys: `host` – device IP/hostname `timestamp` – ISO-8601 UTC timestamp `success` – `True` when connection succeeded `checks` – dict of individual check results `overall_alert` – `True` when any check triggered an alert `error` – error message when connection failed

build_junos_health_report ¶

build_junos_health_report(results: list[dict]) -> dict

Build an aggregated health report from a list of per-device results.

Parameters:

Name	Type	Description	Default
`results`	`list[dict]`	List of dicts returned by :func:`run_health_check`.	required

Returns:

Type Description

dict

Summary dict with keys:

devices – total devices polled
devices_reachable – devices successfully reached
devices_with_alerts – count of devices with at least one alert
re_alerts – count of devices with RE CPU/memory alerts
fpc_alerts – count of devices with FPC alerts
interface_alerts – count of devices with interface error alerts
bgp_alerts – count of devices with BGP peer alerts
ospf_alerts – count of devices with OSPF adjacency alerts
alarm_alerts – count of devices with chassis alarm alerts
environment_alerts – count of devices with environment alerts
overall_alert – True when any device triggered an alert
results – original per-device result list

main ¶

main() -> None

CLI entry point for JunOS health checks.

`netops.check.paloalto`¶

Palo Alto PAN-OS health checks and security policy audit.

paloalto ¶

Security policy audit and health checks for Palo Alto Networks PAN-OS devices.

Policy audit::

python -m netops.check.paloalto --host 10.0.0.1 --audit

Health checks::

python -m netops.check.paloalto --inventory inv.yaml --group firewalls \\
    --health --json

Classes¶

Functions:¶

check_unused_rules ¶

check_unused_rules(policy: list[dict], stats: list[dict]) -> list[dict]

Identify security rules that have never been matched.

Correlates policy (from :func:~netops.parsers.paloalto.parse_security_policy) with stats (from :func:~netops.parsers.paloalto.parse_security_policy_stats) and returns those rules whose hit count is zero.

Each returned dict is the original rule dict augmented with a hit_count key (int).

:param policy: parsed list of security rule dicts :param stats: parsed list of per-rule hit-count dicts :returns: list of unused rule dicts (hit count == 0)

check_shadowed_rules ¶

check_shadowed_rules(policy: list[dict]) -> list[dict]

Identify security rules that are shadowed by an earlier, broader rule.

A rule R[i] is considered shadowed when there exists an earlier rule R[j] (j < i) such that:

R[j]'s source zones cover all of R[i]'s source zones (or R[j] uses any)
R[j]'s destination zones cover all of R[i]'s destination zones (or any)
R[j]'s sources cover R[i]'s sources (or any)
R[j]'s destinations cover R[i]'s destinations (or any)
R[j]'s applications cover R[i]'s applications (or any)

The action of the shadowing rule is noted but not required to match — an allow above a deny shadows the deny just as much as two deny rules would.

Each returned dict is the original rule dict augmented with:

shadowed_by – name of the first earlier rule that shadows this one

:param policy: parsed list of security rule dicts (ordered as on device) :returns: list of shadowed rule dicts

run_policy_audit ¶

run_policy_audit(conn: DeviceConnection) -> dict

Run a full security policy audit against a connected device.

Collects the security policy and per-rule hit counts, then runs:

unused rules – rules with zero hits
shadowed rules – rules obscured by a broader preceding rule

Returns:

Type	Description
`dict`	Dict with keys: `policy` – full list of parsed security rules `stats` – full list of hit-count records `unused_rules` – list of rules with no hits `shadowed_rules` – list of rules shadowed by an earlier rule `rule_count` – total number of security rules `alert` – `True` when unused or shadowed rules were found `error` – error message on failure, else `None`

check_ha ¶

check_ha(conn: DeviceConnection) -> dict

Return HA state check result.

Returns:

Type	Description
`dict`	Dict with keys: `enabled` – `True` when HA is configured `mode` – HA mode string (e.g. `'Active-Passive'`) `local_state` – local HA state (e.g. `'active'`) `peer_state` – peer HA state `peer_ip` – peer management IP `alert` – `True` when local state is not `'active'` or `'passive'` in a known-good pair `error` – error message on failure, else `None`

check_sessions ¶

check_sessions(conn: DeviceConnection, threshold: float) -> dict

Return session table utilization check result.

Returns:

Type	Description
`dict`	Dict with keys: `max_sessions` – maximum supported sessions `active_sessions` – current active sessions `session_utilization` – utilization percentage (`float`) `threshold` – alert threshold percentage `alert` – `True` when utilization >= threshold `error` – error message on failure, else `None`

check_threat_status ¶

check_threat_status(conn: DeviceConnection) -> dict

Return threat and URL filtering content status.

Returns:

Type	Description
`dict`	Dict with keys: `threat_version` – installed threat content version `url_version` – installed URL filtering database version `ha_mode` – HA mode from `show system info` `alert` – always `False` (informational only) `error` – error message on failure, else `None`

run_health_check ¶

run_health_check(params: ConnectionParams, session_threshold: float = DEFAULT_SESSION_THRESHOLD) -> dict

Run all PAN-OS-specific health checks against a single device.

Runs:

HA state – checks that the local unit is in a stable HA role
Sessions – checks session-table utilization against session_threshold
Threat status – reports content versions (informational)

Returns:

Type	Description
`dict`	Result dict with keys: `host` – device IP/hostname `timestamp` – ISO-8601 UTC timestamp `success` – `True` when connection succeeded `checks` – dict of individual check results `overall_alert` – `True` when any check triggered an alert `error` – error message when connection failed

main ¶

main() -> None

CLI entry point for the Palo Alto PAN-OS security policy auditor.

netops.check — Health & Compliance Checks¶