topic EEM Applet using action msg $_syslog_msg in Network Security

EEM Applet using action msg $_syslog_msg

kstamandk — Fri, 21 Feb 2020 12:24:05 GMT

Does anyone have a working sample of an applet using action msg $_syslog_msg in an EEM Applet, where the syslog message produced comes out in a single line?

I'm running IOS 12.4(24)T5 on an 1841 using the applet shown below and it produces 2 lines of output instead of the desired 1.

event manager applet Quiet-Mode-Console

event syslog occurs 1 pattern "LOGIN-3-TOOMANY_AUTHFAILS"

action 1.0 syslog msg "CIPD-CL - Console Login Failures: $_syslog_msg"

The above produces the following

*Jun 29 21:11:53 edt: %HA_EM-6-LOG: Quiet-Mode-Console: CIPD-CL - Console Login Failures:

*Jun 29 21:11:53 edt: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: stamandk] [Source: 0.0.0.0] [localport: 0] [Reason: Login Authentication Failed] at 21:11:53 edt Wed Jun 29 2011

Re: EEM Applet using action msg $_syslog_msg

jepalmer — Thu, 21 Jul 2011 13:30:32 GMT

It is probability a \n causing that. If you use TCL you can remove those. Not sure if it's possible to do that with an applet. Are you trying to replace the original message? If so that may be better suited to ESM. My understanding that EEM 4.0 will be able to replace ESM but I don't believe it's out yet.

Sent from Cisco Technical Support iPad App

EEM Applet using action msg $_syslog_msg

kstamandk — Fri, 12 Aug 2011 20:59:30 GMT

Problem solved - the syslog message only appears on a single line if I APPEND the string as opposed to PREFIX.

action 1.0 syslog msg "Console Login Failures: $_syslog_msg - CIPD-CL"