08-29-2011 04:17 PM
Hi,
I am trying to use EEM on a 2800 running 12.4(25b) Adv IP, to capture some output, when a particular syslog message is seen. When the syslog is seen, EEM runs but bails out, since it cannot write to flash.
router#sh ver | i IOS
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(25b), RELEASE SOFTWARE (fc1)
router#
My EEM policy:
event manager applet EEM-TEST
event syslog pattern "TRACKING-5-STATE: 1 rtr 999999 state Up->Down"
action 1.0 cli command "enable"
action 2.0 cli command "ping 4.2.2.2 source Loopback0 | append flash:EEM"
action 3.0 cli command "traceroute 4.2.2.2 source Loopback0 | append flash:EEM"
action 4.0 cli command "ping 4.2.2.2 | append flash:EEM"
action 5.0 cli command "traceroute 4.2.2.2 | append flash:EEM"
action 6.0 cli command "more flash:EEM.txt"
When the event occurs, I see the event in below command, which confirms EEM runs:
router#sh event manager history events detailed
Load for five secs: 7%/1%; one minute: 8%; five minutes: 9%
Time source is NTP, 14:54:44.748 PDST Mon Aug 29 2011
No. Time of Event Event Type Name
1 Sun Aug28 22:07:08 2011 syslog applet: EEM-TEST
msg {Aug 28 22:07:08.063: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
2 Sun Aug28 22:09:38 2011 syslog applet: EEM-TEST
msg {Aug 28 22:09:38.067: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
3 Mon Aug29 04:06:39 2011 syslog applet: EEM-TEST
msg {Aug 29 04:06:39.943: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
4 Mon Aug29 09:36:41 2011 syslog applet: EEM-TEST
msg {Aug 29 09:36:41.057: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
5 Mon Aug29 12:24:11 2011 syslog applet: EEM-TEST
msg {Aug 29 12:24:11.675: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
6 Mon Aug29 14:26:37 2011 syslog applet: EEM-TEST
msg {Aug 29 14:26:37.162: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
7 Mon Aug29 14:30:12 2011 syslog applet: EEM-TEST
msg {Aug 29 14:30:12.167: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
8 Mon Aug29 14:37:12 2011 syslog applet: EEM-TEST
msg {Aug 29 14:37:12.176: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
9 Mon Aug29 14:44:12 2011 syslog applet: EEM-TEST
msg {Aug 29 14:44:12.186: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
10 Mon Aug29 14:48:42 2011 syslog applet: EEM-TEST
msg {Aug 29 14:48:42.192: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
router#
I did a "debug event manager action cli" and see below, which explains why flash does not have a 'EEM' file created:
Aug 29 14:48:42.192: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down
Aug 29 14:48:42.196: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : CTL : cli_open called.
Aug 29 14:48:42.196: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN :
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : >enable
Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #ping 4.2.2.2 source Loopback0 | append flash:EEM
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #traceroute 4.2.2.2 source Loopback0 | append flash:EEM
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #ping 4.2.2.2 | append flash:EEM
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #traceroute 4.2.2.2 | append flash:EEM
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #more flash:EEM.txt
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : %Error opening flash:EEM.txt (File not found)
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #exit
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : CTL : cli_close called.
router#
Looks like parser does not like the flash:EEM part. I don't know why.
Some information on the file system and flash:
router#sh file systems
Load for five secs: 5%/1%; one minute: 7%; five minutes: 8%
Time source is NTP, 14:39:27.976 PDST Mon Aug 29 2011
File Systems:
Size(b) Free(b) Type Flags Prefixes
- - opaque rw archive:
- - opaque rw system:
- - opaque rw null:
- - network rw tftp:
* 64016384 16502784 disk rw flash:#
245752 143748 nvram rw nvram:
- - opaque wo syslog:
- - opaque rw xmodem:
- - opaque rw ymodem:
- - network rw rcp:
- - network rw pram:
- - network rw ftp:
- - network rw http:
- - network rw scp:
- - network rw https:
- - opaque ro cns:
router#show flash: all
Load for five secs: 6%/1%; one minute: 8%; five minutes: 9%
Time source is NTP, 14:54:13.851 PDST Mon Aug 29 2011
-#- --length-- -----date/time------ path
1 38187152 Jan 27 2010 17:17:40 -08:00 c2800nm-advipservicesk9-mz.124-25b.bin
2 1826 Aug 22 2006 12:55:44 -07:00 sdmconfig-28xx.cfg
3 4734464 Aug 22 2006 12:56:10 -07:00 sdm.tar
4 833024 Aug 22 2006 12:56:26 -07:00 es.tar
5 1052160 Aug 22 2006 12:56:44 -07:00 common.tar
6 1038 Aug 22 2006 12:57:00 -07:00 home.shtml
7 102400 Aug 22 2006 12:57:16 -07:00 home.tar
8 491213 Aug 22 2006 12:57:34 -07:00 128MB.sdf
9 1684577 Aug 22 2006 12:58:02 -07:00 securedesktop-ios-3.1.1.27-k9.pkg
10 398305 Aug 22 2006 12:58:22 -07:00 sslclient-win-1.1.0.154.pkg
11 4039 Sep 18 2006 14:03:12 -07:00 running-config
12 660 Jan 14 2009 16:46:34 -08:00 vlan.dat
16502784 bytes available (47513600 bytes used)
******** ATA Flash Card Geometry/Format Info ********
ATA CARD GEOMETRY
Number of Heads: 8
Number of Cylinders 490
Sectors per Cylinder 32
Sector Size 512
Total Sectors 125440
ATA CARD FORMAT
Number of FAT Sectors 62
Sectors Per Cluster 8
Number of Clusters 15629
Number of Data Sectors 125301
Base Root Sector 231
Base FAT Sector 107
Base Data Sector 263
ATA MONLIB INFO
Image Monlib size = 61400
Disk monlib size = 54784
Name = piptom-atafslib-m
Monlib Start sector = 2
Monlib End sector = 100
Monlib updated by = C2800NM-IPBASE-M12.3(8)T8
Monlib version = 1
router#
Thanks
Shimol
Solved! Go to Solution.
09-01-2011 08:30 AM
Hi,
Is there an EEM file present on flash?
I'm just guessing but it seems as though you would need to do something along the lines of:
Original
action 2.0 cli command "ping 4.2.2.2 source Loopback0 | append flash:EEM"
Proposed
action 1.9 cli command "delete /force flash:EEM"
action 2.0 cli command "ping 4.2.2.2 source Loopback0"
action 2.1 cli command "more $_cli_result | append flash:EEM"
Again, just a guess.
Thanks!
Addendum:
It is not possible to "more" a variable nor can you pipe ping. So to achieve the desired result you will need to use Tcl. When EEM 4.0 is released there may be some additional file manipulation abilities.
09-01-2011 08:30 AM
Hi,
Is there an EEM file present on flash?
I'm just guessing but it seems as though you would need to do something along the lines of:
Original
action 2.0 cli command "ping 4.2.2.2 source Loopback0 | append flash:EEM"
Proposed
action 1.9 cli command "delete /force flash:EEM"
action 2.0 cli command "ping 4.2.2.2 source Loopback0"
action 2.1 cli command "more $_cli_result | append flash:EEM"
Again, just a guess.
Thanks!
Addendum:
It is not possible to "more" a variable nor can you pipe ping. So to achieve the desired result you will need to use Tcl. When EEM 4.0 is released there may be some additional file manipulation abilities.
09-07-2011 12:25 PM
Yup, that did it. Thanks for helping out !
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide