Hi,
I am trying to use EEM on a 2800 running 12.4(25b) Adv IP, to capture some output, when a particular syslog message is seen. When the syslog is seen, EEM runs but bails out, since it cannot write to flash.
router#sh ver | i IOS
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(25b), RELEASE SOFTWARE (fc1)
router#
My EEM policy:
event manager applet EEM-TEST
event syslog pattern "TRACKING-5-STATE: 1 rtr 999999 state Up->Down"
action 1.0 cli command "enable"
action 2.0 cli command "ping 4.2.2.2 source Loopback0 | append flash:EEM"
action 3.0 cli command "traceroute 4.2.2.2 source Loopback0 | append flash:EEM"
action 4.0 cli command "ping 4.2.2.2 | append flash:EEM"
action 5.0 cli command "traceroute 4.2.2.2 | append flash:EEM"
action 6.0 cli command "more flash:EEM.txt"
When the event occurs, I see the event in below command, which confirms EEM runs:
router#sh event manager history events detailed
Load for five secs: 7%/1%; one minute: 8%; five minutes: 9%
Time source is NTP, 14:54:44.748 PDST Mon Aug 29 2011
No. Time of Event Event Type Name
1 Sun Aug28 22:07:08 2011 syslog applet: EEM-TEST
msg {Aug 28 22:07:08.063: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
2 Sun Aug28 22:09:38 2011 syslog applet: EEM-TEST
msg {Aug 28 22:09:38.067: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
3 Mon Aug29 04:06:39 2011 syslog applet: EEM-TEST
msg {Aug 29 04:06:39.943: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
4 Mon Aug29 09:36:41 2011 syslog applet: EEM-TEST
msg {Aug 29 09:36:41.057: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
5 Mon Aug29 12:24:11 2011 syslog applet: EEM-TEST
msg {Aug 29 12:24:11.675: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
6 Mon Aug29 14:26:37 2011 syslog applet: EEM-TEST
msg {Aug 29 14:26:37.162: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
7 Mon Aug29 14:30:12 2011 syslog applet: EEM-TEST
msg {Aug 29 14:30:12.167: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
8 Mon Aug29 14:37:12 2011 syslog applet: EEM-TEST
msg {Aug 29 14:37:12.176: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
9 Mon Aug29 14:44:12 2011 syslog applet: EEM-TEST
msg {Aug 29 14:44:12.186: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
10 Mon Aug29 14:48:42 2011 syslog applet: EEM-TEST
msg {Aug 29 14:48:42.192: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
router#
I did a "debug event manager action cli" and see below, which explains why flash does not have a 'EEM' file created:
Aug 29 14:48:42.192: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down
Aug 29 14:48:42.196: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : CTL : cli_open called.
Aug 29 14:48:42.196: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN :
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : >enable
Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #ping 4.2.2.2 source Loopback0 | append flash:EEM
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #traceroute 4.2.2.2 source Loopback0 | append flash:EEM
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #ping 4.2.2.2 | append flash:EEM
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #traceroute 4.2.2.2 | append flash:EEM
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : ^
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #more flash:EEM.txt
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : %Error opening flash:EEM.txt (File not found)
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN : #exit
Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : CTL : cli_close called.
router#
Looks like parser does not like the flash:EEM part. I don't know why.
Some information on the file system and flash:
router#sh file systems
Load for five secs: 5%/1%; one minute: 7%; five minutes: 8%
Time source is NTP, 14:39:27.976 PDST Mon Aug 29 2011
File Systems:
Size(b) Free(b) Type Flags Prefixes
- - opaque rw archive:
- - opaque rw system:
- - opaque rw null:
- - network rw tftp:
* 64016384 16502784 disk rw flash:#
245752 143748 nvram rw nvram:
- - opaque wo syslog:
- - opaque rw xmodem:
- - opaque rw ymodem:
- - network rw rcp:
- - network rw pram:
- - network rw ftp:
- - network rw http:
- - network rw scp:
- - network rw https:
- - opaque ro cns:
router#show flash: all
Load for five secs: 6%/1%; one minute: 8%; five minutes: 9%
Time source is NTP, 14:54:13.851 PDST Mon Aug 29 2011
-#- --length-- -----date/time------ path
1 38187152 Jan 27 2010 17:17:40 -08:00 c2800nm-advipservicesk9-mz.124-25b.bin
2 1826 Aug 22 2006 12:55:44 -07:00 sdmconfig-28xx.cfg
3 4734464 Aug 22 2006 12:56:10 -07:00 sdm.tar
4 833024 Aug 22 2006 12:56:26 -07:00 es.tar
5 1052160 Aug 22 2006 12:56:44 -07:00 common.tar
6 1038 Aug 22 2006 12:57:00 -07:00 home.shtml
7 102400 Aug 22 2006 12:57:16 -07:00 home.tar
8 491213 Aug 22 2006 12:57:34 -07:00 128MB.sdf
9 1684577 Aug 22 2006 12:58:02 -07:00 securedesktop-ios-3.1.1.27-k9.pkg
10 398305 Aug 22 2006 12:58:22 -07:00 sslclient-win-1.1.0.154.pkg
11 4039 Sep 18 2006 14:03:12 -07:00 running-config
12 660 Jan 14 2009 16:46:34 -08:00 vlan.dat
16502784 bytes available (47513600 bytes used)
******** ATA Flash Card Geometry/Format Info ********
ATA CARD GEOMETRY
Number of Heads: 8
Number of Cylinders 490
Sectors per Cylinder 32
Sector Size 512
Total Sectors 125440
ATA CARD FORMAT
Number of FAT Sectors 62
Sectors Per Cluster 8
Number of Clusters 15629
Number of Data Sectors 125301
Base Root Sector 231
Base FAT Sector 107
Base Data Sector 263
ATA MONLIB INFO
Image Monlib size = 61400
Disk monlib size = 54784
Name = piptom-atafslib-m
Monlib Start sector = 2
Monlib End sector = 100
Monlib updated by = C2800NM-IPBASE-M12.3(8)T8
Monlib version = 1
router#
Thanks
Shimol
