ctx_checker 0.1.0

data/lib/ctx_checker/checks/optics.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 逐光通道使用模块自身阈值，避免猜测统一的 dBm 限制。
+    class Optics < Base
+      ALARMS = %i[high_alarm low_alarm high_warning low_warning].freeze
+
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        entity = record.slice(:interface, :lane, :metric)
+        if inapplicable?(record)
+          return finding(:unknown, :required_optics_inapplicable, entity: entity) if @policy.required_optics?(record)
+
+          return finding(:not_applicable, :optics_not_applicable, entity: entity)
+        end
+        context = interface(record[:interface])
+        if context && record_complete?(context, @snapshot.observation(:interfaces)) &&
+            context[:admin_status] == :down && !@policy.required_interfaces.include?(record[:interface]) && !@policy.required_optics?(record)
+          return finding(:not_applicable, :administratively_down, entity: entity)
+        end
+        if (record[:present] == false || record[:dom_supported] == false) && !ALARMS.include?(record[:alarm])
+          return finding(:unknown, record[:present] == false ? :transceiver_absent : :dom_unavailable, entity: entity)
+        end
+        policy = @policy.optical_thresholds_for(record)
+        thresholds = policy ? record.merge(Observation::OPTICAL_THRESHOLDS.to_h { |key| [ key, policy[key] ] }) : record
+        measured = assess_thresholds(thresholds, entity)
+        alarm = record[:alarm]
+        explicit = if ALARMS.include?(alarm)
+          finding(:fail, :optical_alarm, entity: entity, actual: alarm, severity: alarm.to_s.end_with?("warning") ? :warning : :critical)
+        end
+        results = explicit ? [ explicit ] : [ measured ]
+        if explicit && measured.status == :fail && (policy || measured.severity == :critical && explicit.severity != :critical)
+          results << measured
+        end
+        if explicit && measured.reason == :invalid_optical_thresholds
+          results << measured
+        elsif !policy && disagreement?(record, measured)
+          results << finding(:unknown, :optical_alarm_threshold_disagreement, entity: entity,
+            actual: { value: record[:value], alarm: alarm }, expected: record.slice(*Observation::OPTICAL_THRESHOLDS))
+        end
+        results
+      end
+
+      # 判定目标缺失需要完整枚举；未编号光通道仍保留身份歧义。
+      def missing
+        fields = Observation::IDENTITIES.fetch(:optics)
+        identities = @observation.records.to_h { |row| [ row.values_at(*fields), true ] }
+        unnumbered = @observation.records.select { |row| row[:lane].nil? }.to_h { |row| [ row.values_at(:interface, :metric), true ] }
+        @policy.required_optics.filter_map do |identity|
+          next if identities.key?(identity.values_at(*fields))
+
+          ambiguous = unnumbered.key?(identity.values_at(:interface, :metric))
+          finding(ambiguous ? :unknown : missing_status, :required_optics_missing, entity: identity, severity: :critical)
+        end
+      end
+
+      # 仅完整且无矛盾的设备证据可以豁免铜缆端口的光学检查。
+      def inapplicable?(record)
+        record[:applicable] == false && record_complete?(record, @observation) &&
+          record[:present] != true && record[:dom_supported] != true && record[:value].nil? &&
+          record.values_at(*Observation::OPTICAL_THRESHOLDS).all?(&:nil?) && !ALARMS.include?(record[:alarm])
+      end
+
+      # 将支持的测量值与适用策略阈值比较。
+      def assess_thresholds(record, entity)
+        value = record[:value]
+        return finding(:unknown, :optical_value_unavailable, entity: entity) if value.nil? || record[:unit] != :dbm
+
+        bounds = record.values_at(*Observation::OPTICAL_THRESHOLDS)
+        unless bounds.compact.each_cons(2).all? { |left, right| left <= right }
+          return finding(:unknown, :invalid_optical_thresholds, entity: entity, actual: value)
+        end
+        severity = if bounds[0] && value < bounds[0] || bounds[3] && value > bounds[3]
+          :critical
+        elsif bounds[1] && value < bounds[1] || bounds[2] && value > bounds[2]
+          :warning
+        else
+          :info
+        end
+        paired = bounds[0] && bounds[3] || bounds[1] && bounds[2]
+        if severity == :info && !paired
+          return finding(:unknown, :optical_thresholds_unavailable, entity: entity, actual: value)
+        end
+        finding(severity == :info ? :pass : :fail, :optical_threshold, entity: entity,
+          actual: value, expected: record.slice(*Observation::OPTICAL_THRESHOLDS), severity: severity)
+      end
+
+      # 保留告警故障并报告来源冲突，不随意选择有利证据。
+      def disagreement?(record, measured)
+        alarm = record[:alarm]
+        return measured.status == :fail if alarm == :normal
+        return false unless ALARMS.include?(alarm) && record[:value] && record[:unit] == :dbm
+        return true if measured.status == :fail && measured.severity == :critical && alarm.to_s.end_with?("warning")
+
+        threshold = record[alarm]
+        return false unless threshold
+
+        alarm.to_s.start_with?("low") ? record[:value] >= threshold : record[:value] <= threshold
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/resources.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 按作用域比较百分比，避免混用 CPU 时间窗、处理平面或内存池。
+    class Resources < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        entity = record.slice(:component, :scope, :window_seconds)
+        results = []
+        state = record[:status]
+        if %i[warning critical failed].include?(state)
+          results << finding(:fail, :memory_pressure_state, entity: entity, actual: state, severity: state == :warning ? :warning : :critical)
+        end
+        if @observation.name == :memory && !%i[used_total available used_minus_cache].include?(record[:basis])
+          return results + [ finding(:unknown, :memory_basis_unavailable, entity: entity, actual: record) ]
+        end
+        if inconsistent?(record)
+          return results + [ finding(:unknown, :resource_measurements_inconsistent, entity: entity, actual: record) ]
+        end
+        value = record[:utilization]
+        return results + [ finding(:unknown, :resource_utilization_unavailable, entity: entity, actual: record) ] unless value
+
+        limits = @policy.system.resource_thresholds.fetch(@observation.name)
+        severity = if value >= limits[:critical]
+          :critical
+        elsif value >= limits[:warning]
+          :warning
+        else
+          :info
+        end
+        results << finding(severity == :info ? :pass : :fail, :resource_utilization, entity: entity,
+          actual: record, expected: limits, severity: severity)
+        results
+      end
+
+      # 总量或中断子集数值不合理时，不能据此判定利用率健康。
+      def inconsistent?(record)
+        if @observation.name == :cpu
+          record[:interrupt_utilization] && record[:utilization] && record[:interrupt_utilization] > record[:utilization]
+        else
+          return true if record[:status] == :absent
+          total = record[:total_bytes]
+          return false unless total
+          return true if total.zero? || record.values_at(:used_bytes, :free_bytes, :available_bytes).compact.any? { |value| value > total }
+          if record[:basis] == :used_total && record[:used_bytes] && record[:free_bytes]
+            return true if record[:used_bytes] + record[:free_bytes] != total
+          end
+          if %i[available used_minus_cache].include?(record[:basis]) && record[:used_bytes] && record[:available_bytes]
+            return true if record[:used_bytes] + record[:available_bytes] != total
+          end
+          used = record[:basis] == :available && record[:available_bytes] ? total - record[:available_bytes] : record[:used_bytes]
+          return true if record[:basis] == :available && used && record[:used_bytes] && used != record[:used_bytes]
+          used && record[:utilization] && (used.fdiv(total) * 100 - record[:utilization]).abs > 1
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/routing.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module CtxChecker
+  module Checks
+    # 在所属 VRF、地址族或进程作用域中解释协议会话状态。
+    class Routing < Base
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        identity = record.slice(*identity_fields)
+        state = record[:state]
+        status, reason = if state.nil? || state == :unknown
+          [ :unknown, :protocol_state_unavailable ]
+        elsif @observation.name == :bgp
+          state == :established ? [ :pass, :bgp_established ] : [ :fail, :bgp_not_established ]
+        elsif state == :full
+          [ :pass, :ospf_full ]
+        elsif state == :two_way
+          two_way_state(record)
+        else
+          [ :fail, :ospf_not_adjacent ]
+        end
+        status, reason = :unknown, :protocol_scope_unavailable if status == :pass && identity.values.any?(&:nil?)
+        finding(status, reason, entity: identity, actual: record, severity: status == :fail ? :critical : :info)
+      end
+
+      # 返回用于跨采样匹配记录的稳定身份字段。
+      def identity_fields = @observation.name == :bgp ? %i[vrf afi_safi peer] : %i[vrf process_id interface router_id]
+
+      # 仅在拓扑明确不要求建立邻接时，将 OSPF 2-Way 状态视为正常。
+      def two_way_state(record)
+        if %i[point_to_point point_to_multipoint virtual_link].include?(record[:network_type]) ||
+            %i[dr bdr].include?(record[:local_role]) || %i[dr bdr].include?(record[:neighbor_role])
+          [ :fail, :ospf_expected_adjacency_missing ]
+        elsif %i[broadcast nbma].include?(record[:network_type]) && record[:local_role] == :drother && record[:neighbor_role] == :drother
+          [ :pass, :ospf_expected_two_way ]
+        else
+          [ :unknown, :ospf_two_way_requires_topology ]
+        end
+      end
+
+      # 为策略要求但未观察到的资源生成证据缺失结果。
+      def missing
+        expected = @observation.name == :bgp ? @policy.expected_bgp : @policy.expected_ospf
+        if expected.empty?
+          reason = @observation.issues.map { |issue| issue[:code] }.find { |code| %i[protocol_not_configured protocol_disabled].include?(code) }
+          return [] unless @observation.records.empty? && reason
+
+          return [ finding(:unknown, reason) ]
+        end
+
+        fields = identity_fields
+        scope = @observation.name == :bgp ? %i[vrf afi_safi] : %i[vrf process_id interface]
+        identities = {}
+        scopes = {}
+        incomplete = Hash.new { |hash, keys| hash[keys] = {} }
+        @observation.records.each do |record|
+          identities[record.values_at(*fields)] = true
+          scopes[record.values_at(*scope)] = true
+          present = fields.reject { |key| record[key].nil? }
+          incomplete[present][record.values_at(*present)] = true unless present == fields
+        end
+        expected.filter_map do |identity|
+          next if identities.key?(identity.values_at(*fields))
+
+          ambiguous = incomplete.any? { |keys, values| values.key?(identity.values_at(*keys)) }
+          enumerated = @observation.covered_scopes.any? { |entry| entry.all? { |key, value| identity[key] == value } }
+          scope_observed = scopes.key?(identity.values_at(*scope))
+          status = if ambiguous
+            :unknown
+          elsif enumerated
+            :fail
+          elsif scope_observed
+            missing_status
+          else
+            :unknown
+          end
+          finding(status, :expected_peer_missing, entity: identity, severity: :critical)
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/checks/temperature.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative "hardware"
+
+module CtxChecker
+  module Checks
+    # 优先使用设备或精确传感器的摄氏度阈值，不虚构通用温度限制。
+    class Temperature < Hardware
+      private
+
+      # 按策略评估资源，同时保留测量值缺失的状态。
+      def assess(record)
+        return super if record[:status] == :absent && record[:value].nil?
+        entity = { component: record[:component] }
+        override = @policy.system.temperature_thresholds[record[:component]]
+        bounds = (override || record).slice(*Observation::OPTICAL_THRESHOLDS).compact
+        comparison = override ? override.fetch(:high_comparison, :gt) : record[:high_comparison]
+        state = record[:status]
+        explicit_fault = %i[warning critical failed].include?(state)
+        results = []
+        results << finding(:unknown, :temperature_presence_inconsistent, entity: entity) if state == :absent
+        results << finding(:fail, :temperature_alarm, entity: entity, actual: state, severity: state == :warning ? :warning : :critical) if explicit_fault
+        unless bounds.values_at(*Observation::OPTICAL_THRESHOLDS).compact.each_cons(2).all? { |low, high| low <= high }
+          return results + [ finding(:unknown, :temperature_thresholds_invalid, entity: entity) ]
+        end
+        value = record[:value]
+        if value && bounds.any?
+          severity = exceeded(value, bounds, comparison)
+          boundary_unknown = comparison.nil? && bounds.values_at(:high_warning, :high_alarm).compact.include?(value)
+          status = severity ? :fail : boundary_unknown || state == :absent ? :unknown : :pass
+          results << finding(status, boundary_unknown && !severity ? :temperature_boundary_unknown : :temperature_threshold, entity: entity,
+            actual: value, expected: bounds.merge(high_comparison: comparison), severity: severity || :info)
+          if !override && (state == :ok && severity || explicit_fault && !severity)
+            results << finding(:unknown, :temperature_state_disagreement, entity: entity)
+          end
+        elsif !explicit_fault
+          results << finding(state == :ok ? :pass : :unknown, :temperature_state, entity: entity, actual: record)
+        end
+        results
+      end
+
+      # 为测量值超出阈值生成检查结果。
+      def exceeded(value, bounds, comparison)
+        return :critical if bounds[:low_alarm] && value < bounds[:low_alarm] || above?(value, bounds[:high_alarm], comparison)
+        return :warning if bounds[:low_warning] && value < bounds[:low_warning] || above?(value, bounds[:high_warning], comparison)
+        nil
+      end
+
+      # 将可用测量值与配置的上限比较。
+      def above?(value, limit, comparison) = limit && (value > limit || comparison == :gte && value == limit)
+    end
+  end
+end

data/lib/ctx_checker/cisco_ios/parsers/show_clock_detail.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require_relative "system_values"
+
+module CtxChecker
+  module CiscoIos
+    module Parsers
+      # 时区缩写不等于 UTC 偏移；有歧义的本地时间保持未知。
+      class ShowClockDetail < CtxChecker::Parsers::Base
+        include SystemValues
+
+        private
+
+        # 解析 show clock detail，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          records, issues = [], []
+          time_source = nil
+          clean(text).each_line.with_index(1) do |source, number|
+            line = source.strip
+            next if line.empty?
+
+            if (match = /\A([*.]?)(\d{1,2}:\d{2}:\d{2}(?:\.\d+)?)\s+(\S+)\s+\w{3}\s+(\w{3})\s+(\d{1,2})\s+(\d{4})\z/.match(line))
+              offset = match[3]
+              offset = "+0000" if %w[UTC GMT].include?(offset)
+              timestamp = nil
+              offset_parts = /\A[+-](\d{2}):?(\d{2})\z/.match(offset)
+              if offset_parts && offset_parts[1].to_i < 24 && offset_parts[2].to_i < 60
+                begin
+                  raise Date::Error unless match[2].split(":").map(&:to_f).zip([ 24, 60, 60 ]).all? { |value, limit| value < limit }
+
+                  format = match[2].include?(".") ? "%H:%M:%S.%N %z %b %d %Y" : "%H:%M:%S %z %b %d %Y"
+                  timestamp = DateTime.strptime("#{match[2]} #{offset} #{match[4]} #{match[5]} #{match[6]}", format).iso8601(3)
+                rescue Date::Error
+                  issues << { code: :invalid_clock_time, line: number }
+                end
+              else
+                issues << { code: :clock_timezone_unknown, line: number }
+              end
+              records << { component: "system", time: timestamp, source: nil, synchronized: match[1].empty? ? nil : false }
+            elsif (match = /\ATime source is (.+)\z/i.match(line))
+              issues << { code: :duplicate_clock_source, line: number } if time_source
+              time_source = match[1]
+            elsif /\A(?:Summer time|Time zone|Timezone|No time source)/i.match?(line)
+              next
+            else
+              issues << unparsed(number)
+            end
+          end
+          records.each { |record| record[:source] = time_source }
+          build_result(records, complete: complete, recognized: records.any?, issues: issues, identity: [ :component ])
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/cisco_ios/parsers/show_environment_all.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require_relative "system_values"
+require "ctx_parser/result_set"
+
+module CtxChecker
+  module CiscoIos
+    module Parsers
+      # Catalyst 组件块与 ASR 传感器表分别保留覆盖状态。
+      class ShowEnvironmentAll < CtxChecker::Parsers::Base
+        include SystemValues
+
+        private
+
+        # 解析 show environment all，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          @rows = { temperature: [], environment: [], power: [] }
+          @problems = @rows.transform_values { [] }
+          @switch = "active"
+          @temperature = nil
+          @sensor_table = false
+          @component_table = nil
+          clean(text).each_line.with_index(1) do |source, number|
+            line = source.strip
+            next if line.empty? || /\A[- ]+\z/.match?(line)
+            next if catalyst_line(line) || stack_component_line(line) || sensor_line(line)
+            next if /\A(?:Sensor List:|Sensor\s+Location|SW\s+PID\s+Serial#)/.match?(line)
+
+            @problems.each_value { |issues| issues << unparsed(number) }
+          end
+          results = @rows.to_h do |dimension, rows|
+            identity = dimension == :temperature ? [ :component ] : %i[component kind]
+            [ dimension, build_result(rows, complete: complete, recognized: rows.any?, issues: @problems[dimension], identity: identity) ]
+          end
+          CtxParser::ResultSet.new(results: results)
+        end
+
+        # Catalyst StackWise Virtual 在传感器后按交换机报告电源和风扇托盘。
+        def stack_component_line(line)
+          case line
+          when /\ASwitch:(\d+)\z/i
+            @switch = Regexp.last_match(1)
+            @sensor_table, @component_table = false, nil
+          when /\APower\s+Fan States\z/i
+            @component_table = :power
+          when /\AFan\s+Fan States\z/i
+            @component_table = :fan
+          when /\ASupply\s+Model No\s+Type\s+Capacity\s+Status\s+(?:\d+\s*)+\z/i,
+            /\ATray\s+Status\s+(?:\d+\s*)+\z/i
+            return false unless @component_table
+          else
+            if @component_table == :power && (match = /\A(PS\d+)\s+\S+\s+(?:AC|DC)\s+(\d+(?:\.\d+)?)\s+W\s+(\S+)\s+(.+)\z/i.match(line))
+              status = stack_component_status(match[3], match[4])
+              return false unless status
+              @rows[:power] << { component: "switch #{@switch}/power supply #{match[1]}", kind: :power_supply,
+                status: status, present: status != :absent, watts: nil, capacity_watts: Float(match[2]) }
+            elsif @component_table == :fan && (match = /\A(FM\d+)\s+(\S+)\s+(.+)\z/i.match(line))
+              status = stack_component_status(match[2], match[3])
+              return false unless status
+              @rows[:environment] << { component: "switch #{@switch}/fan tray #{match[1]}", kind: :fan, status: status }
+            else
+              return false
+            end
+          end
+          true
+        end
+
+        # 单个风扇故障优先于电源或托盘的整体正常状态。
+        def stack_component_status(parent, fans)
+          values = fans.split
+          return unless values.all? { |value| /\A(?:good|bad|ok|fail|failed|N\/A)\z/i.match?(value) }
+
+          states = [ component_status(parent), *values.reject { |value| value.casecmp?("N/A") }.map { |value| component_status(value) } ]
+          most_severe_status(states)
+        end
+
+        # 保留当前交换机身份；本命令不承诺覆盖整个堆叠。
+        def catalyst_line(line)
+          case line
+          when /\A(?:Switch (\d+) )?FAN (\S+) is (.+)\z/i
+            @switch = Regexp.last_match(1) if Regexp.last_match(1)
+            @rows[:environment] << { component: "switch #{@switch}/fan #{Regexp.last_match(2)}", kind: :fan,
+              status: component_status(Regexp.last_match(3)) }
+          when /\ASwitch (\d+): SYSTEM TEMPERATURE is (.+)\z/i
+            @switch = Regexp.last_match(1)
+            @rows[:environment] << { component: "switch #{@switch}/temperature", kind: :overall, status: component_status(Regexp.last_match(2)) }
+          when /\A(.+?) Temperature Value:\s*(#{NUMBER}) Degree Celsius\z/i
+            component = "switch #{@switch}/#{Regexp.last_match(1).downcase}"
+            value = checked_number(Regexp.last_match(2), issues: @problems[:temperature], component: component)
+            @temperature = { component: component, value: value,
+              low_alarm: nil, low_warning: nil, high_warning: nil, high_alarm: nil, status: :unknown }
+            @rows[:temperature] << @temperature
+          when /\A(?:System )?Temperature State:\s*(\S+)\z/i
+            return false unless @temperature
+
+            state = component_status(Regexp.last_match(1))
+            if @temperature[:status] == :unknown
+              @temperature[:status] = state
+            else
+              @problems[:temperature] << { code: :duplicate_sensor_state, component: @temperature[:component] }
+              @temperature[:status] = most_severe_status([ @temperature[:status], state ])
+            end
+          when /\A(Yellow|Red) Threshold\s*:\s*(#{NUMBER}) Degree Celsius\z/i
+            return false unless @temperature
+
+            field = Regexp.last_match(1).casecmp?("yellow") ? :high_warning : :high_alarm
+            @problems[:temperature] << { code: :duplicate_sensor_threshold, component: @temperature[:component] } if @temperature[field]
+            @temperature[field] = checked_number(Regexp.last_match(2), issues: @problems[:temperature], component: @temperature[:component])
+          when /\A(\d+[AB])\s+\S+\s+\S+\s+(.+?)\s+(Good|Bad|N\/A)\s+(Good|Bad|N\/A)\s+(\d+)\z/i
+            match = Regexp.last_match
+            state = component_status(match[2])
+            state = most_severe_status([ state, :failed ]) if [ match[3], match[4] ].any? { |value| value.casecmp?("bad") }
+            @rows[:power] << { component: "power supply #{match[1]}", kind: :power_supply, status: state,
+              present: state == :absent ? false : nil, watts: nil, capacity_watts: Integer(match[5], 10) }
+          when /\ASensor List:.*Environmental Monitoring/i
+            @sensor_table = true
+          else
+            return false
+          end
+          true
+        end
+
+        # 根据读数单位区分传感器类型；仅有转速或风扇百分比不能判定健康。
+        def sensor_line(line)
+          return false unless @sensor_table
+
+          cells = line.split(/\s{2,}/)
+          return false unless cells.size == 4
+
+          sensor, location, state, reading = cells
+          component = "#{location}/#{sensor}"
+          status = component_status(state)
+          if (match = /\A(#{NUMBER}) Celsius\z/i.match(reading))
+            value = checked_number(match[1], issues: @problems[:temperature], component: component)
+            @rows[:temperature] << { component: component, value: value, low_alarm: nil, low_warning: nil,
+              high_warning: nil, high_alarm: nil, status: status }
+            if state.start_with?("Fan Speed")
+              @rows[:environment] << { component: component, kind: :fan, status: :unknown }
+            end
+          elsif /\A(?:PEM|Power)/i.match?(sensor)
+            @rows[:power] << { component: component, kind: :power_rail, status: status, present: nil, watts: nil, capacity_watts: nil }
+          elsif /\A#{NUMBER}\s+(?:mV|V|V AC|mA|A)\z/i.match?(reading)
+            @rows[:environment] << { component: component, kind: :voltage, status: status }
+          else
+            return false
+          end
+          true
+        end
+      end
+    end
+  end
+end

data/lib/ctx_checker/cisco_ios/parsers/show_etherchannel_summary.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+require_relative "../../parsers/interface_names"
+
+module CtxChecker
+  module CiscoIos
+    module Parsers
+      # 保留聚合父接口与成员状态，包括合法的 LACP 备用成员。
+      class ShowEtherchannelSummary < CtxChecker::Parsers::Base
+        PLATFORM = :cisco_ios
+        MEMBER_STATES = { "P" => :active, "H" => :standby, "D" => :down, "s" => :suspended,
+          "I" => :unselected, "w" => :unselected, "M" => :unselected, "r" => :down, "p" => :active,
+          "b" => :unselected }.freeze
+
+        private
+
+        # 要求存在数据表或明确空表证据；标志图例不能作为成员记录。
+        def parse_output(text, complete:)
+          text = clean(text)
+          rows, issues, groups, totals = [], [], [], []
+          current, header, empty = nil, false, false
+          text.each_line.with_index(1) do |source, number|
+            line = source.strip
+            next if line.empty? || line.match?(/\A[-=+ ]+\z/)
+
+            if line.match?(/\AGroup\s+Port-(?:channel|Channel)?\s+(?:Type\s+)?Protocol\s+(?:Ports|Member Ports)\z/i)
+              header = true
+            elsif (match = /\A(\d+)\s+((?:Po|port-channel)\d+)\(([^()\s]+)\)\s+(?:(?:Eth|FC)\s+)?(?:LACP|PAgP|NONE|--|-|None)\s*(.*)\z/i.match(line))
+              current = { group: normalize_name(match[2]), oper_status: group_state(match[3], issues, number) }
+              groups << current
+              append_members(rows, current, match[4], issues, number)
+            elsif line.match?(/\A\d+\s+(?:Po|port-channel)\d+\b/i)
+              current = nil
+              issues << { code: :unparsed_aggregation_group, line: number }
+            elsif current && line.match?(/\A\S+\s*\([^()\s]+\)/)
+              append_members(rows, current, line, issues, number)
+            elsif (match = /\ANumber of (?:port-channels|channel-groups in use):\s*(\d+)\z/i.match(line))
+              totals << Integer(match[1], 10)
+              empty ||= match[1] == "0"
+            elsif line.match?(/\ANo (?:port-channels|channel-groups|EtherChannels)(?: found)?\.?\z/i)
+              empty = true
+            elsif legend?(line)
+              next
+            else
+              issues << { code: :unparsed_row, line: number }
+            end
+          end
+          totals.each do |total|
+            issues << { code: :count_mismatch, expected: total, observed: groups.size } unless total == groups.size
+          end
+          groups.each do |group|
+            next if rows.any? { |row| row[:group] == group[:group] }
+
+            rows << group.merge(member: nil, member_status: :unknown)
+            issues << { code: :aggregation_members_missing, group: group[:group] }
+          end
+          repeated_groups = groups.group_by { |group| group[:group] }.select { |_, entries| entries.size > 1 }.keys
+          if repeated_groups.any?
+            issues << { code: :duplicate_aggregation_group, count: repeated_groups.size }
+            rows.reject! { |row| repeated_groups.include?(row[:group]) }
+          end
+          issues << { code: :contradictory_empty } if empty && groups.any?
+          build_result(rows, complete: complete, recognized: empty || (header && groups.any?), issues: issues, identity: %i[group member])
+        end
+
+        # 将物理成员关联到其逻辑聚合接口。
+        def append_members(rows, group, text, issues, number)
+          return if text.empty?
+          if text == "--"
+            rows << group.merge(member: nil, member_status: :unknown)
+            return
+          end
+
+          text.scan(/[^\s()]+\s*\([^()\s]+\)|\S+/).each do |word|
+            match = /\A([^()\s]+)\s*\(([^()\s]+)\)\z/.match(word)
+            unless match
+              issues << { code: :unparsed_member, line: number }
+              next
+            end
+            state = MEMBER_STATES.fetch(match[2], :unknown)
+            issues << { code: :unknown_member_status, line: number } if state == :unknown
+            rows << group.merge(member: normalize_name(match[1]), member_status: state)
+          end
+        end
+
+        # 归一化聚合组报告的运行状态。
+        def group_state(flags, issues, number)
+          unless flags.match?(/\A[SRUDM]+\z/) && !(flags.include?("U") && (flags.include?("D") || flags.include?("M")))
+            issues << { code: :unknown_aggregation_status, line: number }
+            return :unknown
+          end
+          return :down if flags.include?("D") || flags.include?("M")
+          return :up if flags.include?("U")
+
+          issues << { code: :unknown_aggregation_status, line: number }
+          :unknown
+        end
+
+        # 识别表格图例，避免将其作为资源记录。
+        def legend?(line)
+          line == "Channel" || line.match?(/\A(?:Flags:|[A-Za-z] - |[A-Za-z]\s+-\s+|Number of aggregators:|Number of aggregators in use:)/)
+        end
+
+        # 将接口别名归一化为平台标准身份。
+        def normalize_name(name) = CtxChecker::Parsers::InterfaceNames.normalize(name, platform: self.class::PLATFORM)
+      end
+    end
+  end
+end

data/lib/ctx_checker/cisco_ios/parsers/show_facility_alarm_status.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative "../../parsers/base"
+
+module CtxChecker
+  module CiscoIos
+    module Parsers
+      # Facility 告警表示当前状态，与历史 syslog 记录区分处理。
+      class ShowFacilityAlarmStatus < CtxChecker::Parsers::Base
+        private
+
+        # 解析 show facility alarm status，保留不完整或不支持的证据。
+        def parse_output(text, complete:)
+          records, issues, totals, severities = [], [], [], []
+          clean(text).each_line.with_index(1) do |source, number|
+            line = source.strip
+            next if line.empty? || /\A[- ]+\z/.match?(line) || /\ASource\s+(?:Time\s+)?Severity\s+/.match?(line)
+
+            if (match = /\ASystem Totals\s+Critical:\s*(\d+)\s+Major:\s*(\d+)\s+Minor:\s*(\d+)\z/i.match(line))
+              totals << match.captures.map { |value| Integer(value, 10) }
+            elsif (match = /\A(.+?)\s+(?:(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d+\s+\d{4}\s+\d{2}:\d{2}:\d{2}\s+)?(CRITICAL|MAJOR|MINOR|INFO)\s+.+?\s+\[(\d+)\]\z/i.match(line))
+              severity = match[2].upcase
+              severities << severity
+              records << { component: match[1].strip, alarm_id: match[3],
+                severity: { "CRITICAL" => :critical, "MAJOR" => :critical, "MINOR" => :warning, "INFO" => :info }.fetch(severity), active: true, count: 1 }
+            else
+              issues << { code: :unparsed_row, line: number }
+            end
+          end
+          if !totals.one? || totals.first != %w[CRITICAL MAJOR MINOR].map { |severity| severities.count(severity) }
+            issues << { code: :alarm_count_mismatch }
+          end
+          if records.empty? && totals == [ [ 0, 0, 0 ] ] && issues.empty?
+            records << { component: "system", alarm_id: "facility_summary", severity: :info, active: false, count: 0 }
+          end
+          build_result(records, complete: complete, recognized: totals.any? || records.any?, issues: issues, identity: %i[component alarm_id])
+        end
+      end
+    end
+  end
+end