ctx_checker 0.1.0

data/lib/ctx_checker/palo_alto/parsers/show_interface_all.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require_relative "../../parsers/interface_names"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # PAN-OS 分别展示物理状态与逻辑接口清单。
+      class ShowInterfaceAll < CtxChecker::Parsers::Base
+        private
+
+        # 解析 show interface all，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          text = clean(text)
+          rows, issues, section, totals, counts, duplicates = {}, [], nil, {}, Hash.new(0), []
+          logical_names = {}
+          text.each_line do |raw|
+            line = raw.strip
+            if (match = /\Atotal configured (hardware|logical) interfaces:\s*(\d+)\z/i.match(line))
+              section = match[1].downcase.to_sym
+              totals[section] = match[2].to_i
+            elsif (match = /\Aaggregation groups:\s*(\d+)\z/i.match(line))
+              section = :aggregation
+              totals[section] = match[1].to_i
+            elsif line.empty? || line.match?(/\A[- ]+\z/) || line.match?(/\Aname\s+id\s+/i)
+              next
+            elsif section == :hardware && (match = /\A(\S+)\s+\d+\s+\S+\/\S+\/(up|down)(?:\([^\s]*\))?\s+[\da-f:]+\z/i.match(line))
+              name = CtxChecker::Parsers::InterfaceNames.normalize(match[1], platform: :palo_alto)
+              if rows.key?(name)
+                issues << { code: :duplicate_interface, interface: name }
+                duplicates << name
+              end
+              rows[name] = record(name).merge(oper_status: match[2].downcase.to_sym)
+              counts[section] += 1
+            elsif section == :aggregation && line.match?(/\Aae\d+ members:\z/i)
+              counts[section] += 1
+            elsif section == :aggregation && line.match?(/\Aethernet\d+\/\d+(?:\s+ethernet\d+\/\d+)*\z/i)
+              next # 清单中的成员关系不表示 LACP 选中状态或运行状态。
+            elsif section == :logical && (match = /\A(\S+)\s+\d+\s+\d+\s+.+\z/.match(line))
+              name = CtxChecker::Parsers::InterfaceNames.normalize(match[1], platform: :palo_alto)
+              if logical_names.key?(name)
+                issues << { code: :duplicate_interface, interface: name }
+                duplicates << name
+              end
+              logical_names[name] = true
+              rows[name] ||= record(name)
+              counts[section] += 1
+            elsif section == :logical && line.match?(%r{\A[\da-f:.]+/\d+\z}i)
+              next # 地址续行不携带接口状态。
+            else
+              issues << { code: :unrecognized_interface_line }
+            end
+          end
+          totals.each do |kind, total|
+            issues << { code: :count_mismatch, section: kind, expected: total, observed: counts[kind] } if total != counts[kind]
+          end
+          duplicates.each { |name| rows.delete(name) }
+          build_result(rows.values, complete: complete, recognized: totals.key?(:hardware), issues: issues, identity: [ :name ])
+        end
+
+        # 先创建状态未知的接口身份，再由所属表补充明确证据。
+        def record(name)
+          { name: name, kind: CtxChecker::Parsers::InterfaceNames.kind(name), admin_status: :unknown, oper_status: :unknown,
+            protocol_status: :unknown, parent: name.match?(/\A(?:ethernet|ae).*\./) ? name.split(".").first : nil }
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_lacp_aggregate_ethernet.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require_relative "../../parsers/interface_names"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # PAN-OS LACP 回显中的成组关系与选中状态是独立事实。
+      class ShowLacpAggregateEthernet < CtxChecker::Parsers::Base
+        private
+
+        # 解析 show lacp aggregate ethernet，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          text = clean(text)
+          rows, issues, group, header, groups = [], [], nil, false, {}
+          text.each_line do |raw|
+            line = raw.strip
+            if (match = /\AAE group:\s*(ae\d+)\z/i.match(line))
+              group = match[1].downcase
+              groups[group] ||= 0
+            elsif line.match?(/\AMembers:\s+Bndl\s+Rx state\s+Mux state\s+Sel state\z/i)
+              header = true
+            elsif (match = /\A(ethernet\d+\/\d+)\s+(yes|no)\s+(\S+)\s+(\S+)\s+(Selected|Unselected|Standby)(?:\(.*\))?\z/i.match(line))
+              if group
+                state = if match[5].casecmp?("Standby")
+                  :standby
+                elsif match[5].casecmp?("Unselected")
+                  :unselected
+                elsif match[2].casecmp?("yes") && match[4].casecmp?("Tx_Rx")
+                  :active
+                else
+                  :unknown
+                end
+                rows << { group: group, member: match[1].downcase, member_status: state, oper_status: :unknown }
+                groups[group] += 1
+              else
+                issues << { code: :aggregation_group_missing }
+              end
+            elsif line.match?(/\Aethernet\d+\//i)
+              issues << { code: :invalid_aggregation_member }
+            elsif !line.empty? && !line.match?(/\A(?:\*+|-+|LACP:|Status:|Mode:|Rate:|Max-port:|Fast-failover:|Pre-negotiation:|Local:|Partner:|System Priority:|System MAC:|Key:)/i)
+              issues << { code: :unrecognized_aggregation_line }
+            end
+          end
+          groups.each { |name, count| issues << { code: :aggregation_members_missing, group: name } if count.zero? }
+          build_result(rows, complete: complete, recognized: header && rows.any?, issues: issues, identity: %i[group member])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_ntp.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 对等体可达与 LOCAL 回退不能证明 NTP 已同步。
+      class ShowNtp < CtxChecker::Parsers::Base
+        private
+
+        # 解析 show ntp，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          source = clean(text)
+          rows, globals, issues = [], [], []
+          current, fields, header, peer_fields = nil, {}, false, {}
+          source.each_line.with_index(1) do |raw, number|
+            line = raw.strip
+            next if line.empty?
+            if line == "NTP state:"
+              header = true
+            elsif (match = /\ANTP synched to (\S+)\z/i.match(line))
+              globals << { component: "system", synchronized: !match[1].casecmp?("LOCAL"), reference: match[1] }
+              current = nil
+            elsif line.match?(/\ANTP not synched, using local clock\z/i)
+              globals << { component: "system", synchronized: false, reference: "LOCAL" }
+              current = nil
+            elsif (match = /\ANTP server (\S+) connected: (True|False)\z/i.match(line))
+              row = { component: "peer/#{match[1]}", peer: match[1], synchronized: nil }
+              rows << row
+              peer_fields[row.object_id] = { "reachable" => match[2].casecmp?("true") ? "yes" : "no" }
+              current = nil
+            elsif (match = /\ANTP server:\s*(\S+)\z/.match(line))
+              current = { component: "peer/#{match[1]}", peer: match[1], synchronized: nil }
+              rows << current
+              fields = {}
+              peer_fields[current.object_id] = fields
+            elsif current && (match = /\A(status|reachable|authentication-type):\s*(\S+)\z/.match(line))
+              key, value = match[1], match[2].downcase
+              if fields.key?(key)
+                issues << { code: :duplicate_ntp_field, line: number }
+                current[:synchronized] = nil if key == "status"
+              elsif key == "status"
+                current[:synchronized] = { "synched" => true, "rejected" => false, "unsynched" => false }[value]
+                # 可用备份对等体可以参与同步，但不是当前选中的同步源。
+                issues << { code: :unknown_ntp_status, line: number } if current[:synchronized].nil? && value != "available"
+              elsif key == "reachable" && !%w[yes no].include?(value)
+                issues << { code: :unknown_ntp_reachability, line: number }
+              end
+              fields[key] = value
+            else
+              issues << { code: :unrecognized_ntp_row, line: number }
+            end
+          end
+          rows.each do |row|
+            if row[:synchronized] == true && peer_fields.fetch(row.object_id, {})["reachable"] == "no"
+              row[:synchronized] = nil
+              issues << { code: :conflicting_ntp_state, component: row[:component] }
+            end
+          end
+          globals.each do |global|
+            next unless global[:synchronized] == true
+            peers = rows.select { |row| row[:peer] == global[:reference] }
+            if peers.any? { |row| row[:synchronized] == false || peer_fields.fetch(row.object_id, {})["reachable"] == "no" }
+              global[:synchronized] = nil
+              issues << { code: :conflicting_ntp_state, component: "system" }
+            end
+          end
+          if globals.empty? && header
+            globals << { component: "system", synchronized: nil }
+            issues << { code: :ntp_system_status_missing }
+          end
+          build_result(globals + rows, complete: complete, recognized: header && globals.any?, issues: issues, identity: [ :component ])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_routing_protocol_bgp_peer.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 同一对等体可能报告多个地址族。
+      class ShowRoutingProtocolBgpPeer < CtxChecker::Parsers::Base
+        STATES = %w[established idle active connect opensent openconfirm shutdown].freeze
+        FIELDS = /\A(?:Peer:|virtual router:|Peer router id:|Remote AS:|Peer group:|Peer status:|Password set:|Passive:|Multi-hop TTL:|Remote Address:|Local Address:|\(R\) reflector client:|same confederation:|send aggr confed as-path:|peering type:|Connect-Retry interval:|Open Delay:|Idle Hold:|Prefix limit:|Holdtime:|Keep-Alive interval:|Update messages:|Total messages:|Last update age:|Last error:|Flap counts:|\(R\) ORF entries:|Nexthop set to self:|use 3rd party as next-hop:|override nexthop to peer:|remove private AS number:|Capability:|Prefix counter for:|Incoming Prefix:|Outgoing Prefix:|Advertised Prefix:|[-=]+\z)/i
+
+        private
+
+        # 解析 show routing protocol bgp peer，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          text = clean(text)
+          rows, issues = [], []
+          text.split(/(?=^\s*Peer:\s)/i).each do |block|
+            next if block.strip.empty? || block.strip.match?(/\A=+\z/)
+            unless block.match?(/\A\s*Peer:\s/i)
+              issues << { code: :unrecognized_bgp_block }
+              next
+            end
+            if block.lines.any? { |line| !line.strip.empty? && !FIELDS.match?(line.strip) }
+              issues << { code: :unrecognized_bgp_field }
+            end
+            if [ "Remote Address", "Peer status", "Remote AS", "virtual router" ].any? { |field| block.scan(/^\s*#{Regexp.escape(field)}:/i).size > 1 }
+              issues << { code: :duplicate_bgp_field }
+              next
+            end
+            address = block[/^\s*Remote Address:\s*(\S+)/i, 1]
+            peer = address&.sub(/\A\[([^\]]+)\]:\d+\z/, '\1')
+            peer = peer.sub(/:\d+\z/, "") if peer&.match?(/\A\d+(?:\.\d+){3}:\d+\z/)
+            unless CtxParser::Values.valid_host?(peer)
+              issues << { code: :bgp_peer_address_missing }
+              next
+            end
+            peer = CtxParser::Values.host(peer)
+            state = block[/^\s*Peer status:\s*([^,\n]+)/i, 1]&.strip&.downcase
+            state = STATES.include?(state) ? state.to_sym : :unknown
+            remote_as = block[/^\s*Remote AS:\s*(\d+)\s*$/i, 1]&.to_i
+            if remote_as && !(1..4_294_967_295).cover?(remote_as)
+              issues << { code: :invalid_bgp_asn }
+              remote_as = nil
+            end
+            issues << { code: :bgp_peer_fields_missing } if state == :unknown || remote_as.nil?
+            base = { vrf: block[/^\s*virtual router:\s*(\S+)/i, 1], peer: peer, state: state, remote_as: remote_as }
+            families = block.split(/(?=^\s*Prefix counter for:)/i).drop(1)
+            if families.empty?
+              rows << base.merge(afi_safi: nil, received_prefixes: nil)
+            else
+              families.each do |family|
+                scope = /^[ \t]*Prefix counter for:[ \t]*bgpAfiIpv([46])[ \t]*\/[ \t]*(unicast|multicast)[ \t]*$/i.match(family)
+                prefixes = family[/^\s*Incoming Prefix:\s*Accepted \d+, Rejected \d+, Policy Rej \d+, Total (\d+)\s*$/i, 1]
+                issues << { code: :bgp_address_family_unknown } unless scope
+                rows << base.merge(afi_safi: scope ? "ipv#{scope[1]}_#{scope[2].downcase}" : nil, received_prefixes: prefixes&.to_i)
+              end
+            end
+          end
+          build_result(rows, complete: complete, recognized: rows.any?, issues: issues, identity: %i[vrf afi_safi peer])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_routing_protocol_ospf_neighbor.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 旧版 PAN-OS 邻居回显不标明本地接口或进程。
+      class ShowRoutingProtocolOspfNeighbor < CtxChecker::Parsers::Base
+        STATES = { "full" => :full, "down" => :down, "init" => :init, "attempt" => :attempt,
+          "2-way" => :two_way, "two way" => :two_way, "exchange start" => :exstart, "exstart" => :exstart,
+          "exchange" => :exchange, "loading" => :loading }.freeze
+        FIELDS = /\A(?:virtual router:|neighbor address:|local address binding:|type:|status:|neighbor router ID:|area id:|neighbor priority:|lifetime remain:|messages pending:|LSA request pending:|options:|hello suppressed:|restart helper status:|restart helper time remaining:|restart helper exit reason:|=+\z)/i
+
+        private
+
+        # 解析 show routing protocol ospf neighbor，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          text = clean(text)
+          rows, issues = [], []
+          text.split(/(?=^\s*virtual router:)/i).each do |block|
+            unless block.match?(/\A\s*virtual router:/i)
+              # 文档规定的图例位于首个邻居前，任意前导文本不构成证据。
+              lines = block.lines.map(&:strip).reject(&:empty?)
+              unless lines.all? { |line| line.match?(/\A(?:=+|Options: 0x80:reserved,.*|N\/P:NSSA option,.*)\z/i) }
+                issues << { code: :unrecognized_ospf_block }
+              end
+              next
+            end
+            issues << { code: :unrecognized_ospf_field } if block.lines.any? { |line| !line.strip.empty? && !FIELDS.match?(line.strip) }
+            if [ "neighbor address", "neighbor router ID", "status" ].any? { |field| block.scan(/^\s*#{Regexp.escape(field)}:/i).size > 1 }
+              issues << { code: :duplicate_ospf_field }
+              next
+            end
+            neighbor = block[/^\s*neighbor address:\s*(\S+)/i, 1]
+            router_id = block[/^\s*neighbor router ID:\s*(\S+)/i, 1]
+            unless CtxParser::Values.valid_host?(neighbor) && CtxParser::Values.valid_host?(router_id)
+              issues << { code: :ospf_neighbor_identity_missing }
+              next
+            end
+            neighbor = CtxParser::Values.host(neighbor)
+            router_id = CtxParser::Values.host(router_id)
+            state = STATES.fetch(block[/^\s*status:\s*(.+)$/i, 1]&.strip&.downcase, :unknown)
+            issues << { code: :ospf_state_unknown } if state == :unknown
+            rows << { vrf: block[/^\s*virtual router:\s*(\S+)/i, 1], process_id: nil,
+              area: block[/^\s*area id:\s*(\S+)/i, 1], interface: nil, router_id: router_id, neighbor_address: neighbor,
+              state: state, network_type: :unknown, local_role: :unknown, neighbor_role: :unknown }
+          end
+          build_result(rows, complete: complete, recognized: rows.any?, issues: issues, identity: %i[vrf process_id interface router_id neighbor_address])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_system_environmentals.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require "ctx_parser/result_set"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 特定章节的硬件传感器不能证明未出现的电源或风扇已被覆盖。
+      class ShowSystemEnvironmentals < CtxChecker::Parsers::Base
+        SECTIONS = { "thermal" => :temperature, "fans" => :environment, "fan tray" => :environment,
+          "power" => :power, "power supplies" => :power }.freeze
+
+        private
+
+        # 解析 show system environmentals，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          source = clean(text)
+          rows = { temperature: [], environment: [], power: [] }
+          issues = rows.transform_values { [] }
+          section, header, sections, section_rows = nil, nil, [], 0
+          source.each_line.with_index(1) do |raw, number|
+            line = raw.strip
+            next if line.empty?
+            if (match = /\A-+\s*([^-]+?)\s*-+\z/.match(line))
+              empty_section(section, section_rows, issues)
+              section, header = match[1].downcase, nil
+              section_rows = 0
+              sections << section
+              issues.each_value { |items| items << { code: :unrecognized_environment_section, line: number } } unless SECTIONS.key?(section)
+            elsif line.match?(/\ASlot\s+Description\s+Alarm\s+/)
+              header = line
+            elsif SECTIONS.key?(section) && header
+              dimension = SECTIONS.fetch(section)
+              if (match = /\A(\S+)\s+(.+?)\s+(True|False)\s+(.+)\z/i.match(line))
+                section_rows += 1
+                component = "#{match[1]}/#{match[2].strip}"
+                alarm = match[3].casecmp?("true")
+                status = alarm ? :critical : :ok
+                values = match[4].split
+                case section
+                when "thermal"
+                  measurements = values.map { |value| numeric(value) }
+                  expected = header.include?("Min C") && header.include?("Max C") ? 3 : 1
+                  valid = measurements.size == expected && measurements.none?(&:nil?)
+                  issues[:temperature] << { code: :invalid_temperature_measurement, component: component } unless valid
+                  rows[:temperature] << { component: component, value: valid ? measurements.first : nil,
+                    low_alarm: valid && expected == 3 ? measurements[1] : nil,
+                    high_alarm: valid && expected == 3 ? measurements[2] : nil, status: status }
+                when "power supplies", "fan tray"
+                  present = values.one? && %w[true false].include?(values.first.downcase) ? values.first.casecmp?("true") : nil
+                  status = :absent if !alarm && present == false
+                  issues[dimension] << { code: :invalid_presence, component: component } if present.nil?
+                  rows[dimension] << if section == "power supplies"
+                    { component: component, kind: :power_supply, status: status, present: present }
+                  else
+                    { component: component, kind: :fan, status: status }
+                  end
+                when "fans", "power"
+                  valid = sensor_values?(section, header, values)
+                  issues[dimension] << { code: :invalid_environment_measurement, component: component } unless valid
+                  status = :unknown if !valid && !alarm
+                  if valid && limits_invalid?(section, header, values)
+                    issues[dimension] << { code: :invalid_environment_thresholds, component: component }
+                    status = :unknown unless alarm
+                  elsif valid && outside_limits?(section, header, values)
+                    issues[dimension] << { code: :conflicting_environment_state, component: component } unless alarm
+                    status = :failed unless alarm
+                  end
+                  if section == "fans" && header.match?(/Operational\s*\z/) && values == [ "False" ]
+                    issues[dimension] << { code: :conflicting_environment_state, component: component } unless alarm
+                    status = :failed
+                  end
+                  if section == "power"
+                    rows[:power] << { component: component, kind: :power_rail, status: status }
+                  else
+                    rows[:environment] << { component: component, kind: :fan, status: status }
+                  end
+                end
+              else
+                issues[dimension] << { code: :unrecognized_environment_row, line: number }
+              end
+            else
+              issues.each_value { |items| items << { code: :unrecognized_environment_row, line: number } }
+            end
+          end
+          empty_section(section, section_rows, issues)
+          if rows[:power].any? && !sections.include?("power supplies")
+            issues[:power] << { code: :power_supply_status_missing }
+          end
+          CtxParser::ResultSet.new(results: rows.to_h do |dimension, values|
+            identity = dimension == :temperature ? [ :component ] : %i[component kind]
+            [ dimension, build_result(values, complete: complete, recognized: values.any?, issues: issues.fetch(dimension), identity: identity) ]
+          end)
+        end
+
+        # 解析支持的数值字段，并拒绝格式错误的测量值。
+        def numeric(value)
+          return unless /\A-?\d+(?:\.\d+)?\z/.match?(value)
+          number = Float(value)
+          number if number.finite?
+        end
+
+        # 表达明确的空章节，不虚构组件记录。
+        def empty_section(section, count, issues)
+          return unless SECTIONS.key?(section) && count.zero?
+          issues.fetch(SECTIONS.fetch(section)) << { code: :empty_environment_section, section: section }
+        end
+
+        # 检查传感器行是否包含可用的数值测量。
+        def sensor_values?(section, header, values)
+          if section == "fans" && header.match?(/Operational\s*\z/)
+            values.one? && %w[True False].include?(values.first)
+          else
+            expected = if section == "fans"
+              header.include?("Min RPM") ? 2 : 1
+            else
+              header.include?("Min V") && header.include?("Max V") ? 3 : 1
+            end
+            values.size == expected && values.all? { |value| (number = numeric(value)) && (section != "fans" || number >= 0) }
+          end
+        end
+
+        # 识别矛盾或格式错误的传感器阈值边界。
+        def limits_invalid?(section, header, values)
+          section == "power" && header.include?("Min V") && header.include?("Max V") && numeric(values[1]) > numeric(values[2])
+        end
+
+        # 过期的 False 告警标志不能抹除实际观察到的设备阈值违规。
+        def outside_limits?(section, header, values)
+          if section == "fans" && header.include?("Min RPM")
+            numeric(values[0]) < numeric(values[1])
+          elsif section == "power" && header.include?("Min V") && header.include?("Max V")
+            !numeric(values[0]).between?(numeric(values[1]), numeric(values[2]))
+          else
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_system_resources.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require "ctx_parser/result_set"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # PAN top 描述管理平面，并包含可回收内存。
+      class ShowSystemResources < CtxChecker::Parsers::Base
+        UNITS = { "KiB" => 1024, "MiB" => 1024**2, "GiB" => 1024**3, "TiB" => 1024**4 }.freeze
+        NUMBER = /\d+(?:\.\d+)?/
+
+        private
+
+        # 解析 show system resources，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          source = clean(text)
+          cpus, memories, cpu_issues, memory_issues, shared_issues = [], [], [], [], []
+          swap_lines = source.lines.grep(/\A\s*(?:(?:KiB|MiB|GiB|TiB)\s+)?Swap\s*:/)
+          process_table = false
+          source.each_line.with_index(1) do |raw, number|
+            line = raw.strip
+            if (match = /\A%?Cpu(?:\(s\)|(\d+))\s*:\s*(.*)\z/i.match(line))
+              cpus << cpu(match, cpu_issues)
+            elsif line.match?(/\A(?:(?:KiB|MiB|GiB|TiB)\s+)?Mem\s*:/)
+              memories << memory(line, swap_lines, memory_issues)
+            elsif line.match?(/\APID\s+USER\s+/)
+              process_table = true
+            elsif line.empty? || line.match?(/\A(?:top - |Tasks:|(?:(?:KiB|MiB|GiB|TiB)\s+)?Swap\s*:)/) || process_table && line.match?(/\A\d+\s+/)
+              next
+            else
+              shared_issues << { code: :unrecognized_resource_row, line: number }
+            end
+          end
+          CtxParser::ResultSet.new(results: {
+            cpu: build_result(cpus, complete: complete, recognized: cpus.any?, issues: shared_issues + cpu_issues,
+              identity: %i[component scope window_seconds]),
+            memory: build_result(memories, complete: complete, recognized: memories.any?, issues: shared_issues + memory_issues,
+              identity: %i[component scope])
+          })
+        end
+
+        # 归一化 CPU 利用率，并保留其采样周期。
+        def cpu(match, issues)
+          parts = match[2].split(",").map { |part| /\A\s*(#{NUMBER})\s*%?\s*(us|sy|ni|id|wa|hi|si|st)\s*\z/.match(part) }
+          values = parts.compact.to_h { |part| [ part[2], Float(part[1]) ] }
+          valid = parts.size == 8 && parts.all? && values.size == 8 && values.values.all? { |value| value.finite? && value.between?(0, 100) } &&
+            (values.values.sum - 100).abs <= 1
+          issues << { code: :invalid_cpu_measurement } unless valid
+          { component: match[1] ? "management/cpu#{match[1]}" : "management", scope: "management_plane", window_seconds: nil,
+            utilization: valid ? (100 - values.fetch("id")).round(6) : nil, interrupt_utilization: valid ? (values.fetch("hi") + values.fetch("si")).round(6) : nil }
+        end
+
+        # 仅根据可用内存，或文档明确的旧版缓存调整方式计算利用率。
+        def memory(line, swap_lines, issues)
+          header = /\A(?:(KiB|MiB|GiB|TiB)\s+)?Mem\s*:\s*(.*)\z/.match(line)
+          unit = header[1] ? UNITS.fetch(header[1]) : 1024
+          pairs = header[2].split(",").map { |part| /\A\s*(#{NUMBER})(k?)\s+(total|used|free|buffers|buff\/cache)\s*\z/.match(part) }
+          values = pairs.compact.to_h { |pair| [ pair[3], bytes(pair[1], unit) ] }
+          available = swap_lines.flat_map { |swap| swap.scan(/(?:\A|[\s,.])(#{NUMBER})\s+avail Mem\s*\z/).flatten }
+          cached = swap_lines.flat_map { |swap| swap.scan(/(?:\A|[\s,])(#{NUMBER})k\s+cached\s*\z/).flatten }
+          row = { component: "management", scope: "management_plane", total_bytes: values["total"], free_bytes: values["free"],
+            used_bytes: values["used"], available_bytes: nil, utilization: nil, basis: :unknown }
+          valid_units = pairs.all? { |pair| pair && (header[1] ? pair[2].empty? : pair[2] == "k") }
+          valid = valid_units && pairs.size == values.size && values.values.none?(&:nil?) && row[:total_bytes]&.positive? &&
+            values.values.all? { |value| value <= row[:total_bytes] }
+          if valid && available.one? && swap_lines.one?
+            swap_unit = /\A\s*(KiB|MiB|GiB|TiB)\s+Swap/.match(swap_lines.first)&.[](1)
+            row[:available_bytes] = bytes(available.first, swap_unit ? UNITS.fetch(swap_unit) : 1024)
+            valid &&= row[:available_bytes] && row[:available_bytes] <= row[:total_bytes]
+            row[:used_bytes] = row[:total_bytes] - row[:available_bytes] if valid
+            row[:basis] = :available if valid
+          elsif valid && header[1].nil? && cached.one? && swap_lines.one? && values["buffers"] && values["used"]
+            cache_bytes = bytes(cached.first, 1024)
+            adjusted = cache_bytes && values["used"] - values["buffers"] - cache_bytes
+            valid &&= adjusted && adjusted >= 0
+            row[:used_bytes], row[:basis] = adjusted, :used_minus_cache if valid
+            row[:available_bytes] = row[:total_bytes] - adjusted if valid
+          else
+            valid = false
+          end
+          if valid
+            row[:utilization] = (100.0 * row[:used_bytes] / row[:total_bytes]).round(6)
+          else
+            issues << { code: :memory_available_unknown, component: "management" }
+            row[:basis] = :unknown
+            row[:available_bytes] = nil
+            row[:used_bytes] = nil if row[:used_bytes] && row[:total_bytes] && row[:used_bytes] > row[:total_bytes]
+          end
+          row
+        end
+
+        # 将支持的内存单位转换为字节。
+        def bytes(value, multiplier)
+          number = Float(value) * multiplier
+          number.round if number.finite? && number >= 0
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/palo_alto/parsers/show_system_state_alarms.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module PaloAlto
+    module Parsers
+      # 读取当前告警布尔值，不执行 PAN 类 Python 状态文本。
+      class ShowSystemStateAlarms < CtxChecker::Parsers::Base
+        private
+
+        # 解析 show system state alarms，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          source = clean(text)
+          rows, issues = [], []
+          source.each_line.with_index(1) do |raw, number|
+            line = raw.strip
+            # 配置阈值和复制的 HA 对端状态不属于本地当前告警。
+            next if line.empty? || line.match?(/\A(?:cfg\.|peer\.)/)
+            if line.match?(/\Achassis\.alarm:\s*\{\s*\}\z/)
+              rows << { component: "chassis", alarm_id: "summary", active: false, count: 0, severity: :unknown }
+            elsif (match = /\A(ha\.(?:runtime\.device|app\.local)\.alarm):\s*(True|False)\z/i.match(line))
+              rows << alarm(match[1], match[2])
+            elsif (match = /\A(env\.[a-z0-9_.-]+):\s*\{(.+)\}\z/i.match(line))
+              states = match[2].scan(/(?:\A|,)\s*'alarm':\s*(True|False)\s*(?=,|\z)/i).flatten
+              if states.one?
+                rows << alarm(match[1], states.first)
+              else
+                issues << { code: :ambiguous_alarm_state, line: number }
+              end
+            elsif (match = /\A((?:chassis(?:\.s\d+)?|hw\.(?:slot\d+|s\d+\.mp))\.leds):\s*\{(.+)\}\z/i.match(line))
+              states = match[2].scan(/(?:\A|,)\s*'alarm':\s*(Off|Red|Green|Yellow|Amber)\s*(?=,|\z)/i).flatten
+              if states.one?
+                value = states.first.downcase
+                rows << { component: match[1], alarm_id: "alarm_led", active: !%w[off green].include?(value),
+                  severity: :unknown, count: nil }
+              else
+                issues << { code: :ambiguous_alarm_state, line: number }
+              end
+            else
+              issues << { code: :unrecognized_alarm_state, line: number }
+            end
+          end
+          build_result(rows, complete: complete, recognized: rows.any?, issues: issues, identity: %i[component alarm_id])
+        end
+
+        # 归一化单条当前告警及其严重级别。
+        def alarm(component, value)
+          { component: component, alarm_id: "alarm", active: value.casecmp?("true"), severity: :unknown, count: nil }
+        end
+      end
+    end
+  end
+end