EEM applet to send interface description

[xayxa30]

Is there a simple way to send the interface description with the syslog message.

I tried this action but it doesn't know var _INTF. It is a C3850- IOS-XE with EEM v 1.0

regexp %LINK-3-UPDOWN.*" "_syslog_msg" match _INTF _STATE

cli command "show interface $_INTF | include ^ Description"

This is working as it is:

event manager applet DOWN-TEST
  event syslog pattern "%LINK-3-UPDOWN.* changed state to down"
      action 1.0 info type routername
      action 2.0 mail server "$_mail_server" to "$_email_to" from "_email_from" subject "Link Alert from $_info_routername" body "$_syslog_msg"

[xayxa30]

Sorry it is EEM version 4.0

[balaji.bandi]

here is the inforamtion you can use to store the cli output and call the input while sending email 

example  :

action 1.5 cli command "sh interface status | in disabled" 
action 2.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "$_event_pub_time: Disabled Interfaces" body "Disabled interfaces :\n$_cli_result"

here is reference :

https://community.cisco.com/t5/networking-documents/eem-built-in-quot-action-quot-variables/ta-p/3123406

[xayxa30]

I was able to get this running but is there a variable syntax to just get the description of the effected interface ?

Thanks for your help.

[xayxa30]

I was able to get the below commands sort of working but the regexp needs work.

I tried different combinations but I can't seem to get the last interface ( ie G1/0/x ) to properly set. The one below  only works for port g1/0/9.

Tried regexp "GigabitEthernet([0-2]/[0-2]/[1-24])" but that didn't work either.

event manager applet DOWN-TEST
  event syslog pattern "%LINK-3-UPDOWN.* changed state to down"
    action 1.0 info type routername
    action 2.0 regexp "GigabitEthernet([0-2]/[0-9]/[0-9])" "$syslog_msg" ifname
    action 3.0 cli command "enable"
    action 4.0 cli command "show interface $ifname | inc Description"
    action 5.0 mail server "$_mail_server" to "$_email_to" from "_email_from" subject "Link Alert from $_info_routername" body "$_syslog_msg$cli_result"

[xayxa30]

Guess I didn't know what [0-9] meant. had to consult reg exp web page

It means digit, so regexp "GigabitEthernet([0-9/]/[0-9]/[0-9])" works. 

[balaji.bandi]

glad at work, is it means 0-9 interface-number start with and end with.

[xayxa30 · Accepted solution]

The expression did not quite work. The expression in brackets [0-9] means 1 digit.

I was able to generate description information for G1/0/9, but not G1/0/10-24 as the last numbers are two digits.

Writing it like "GigabitEthernet([0-9]/[0-9]/[0-9][0-9])" will generate two digits at the end, but then 1 digit numbers will not be process ( ie G1/0/5).

The only syntax that will work for all interface scenarios ( and simpler) is "GigabitEthernet([0-9/]+)"