automatic generating syslogs logs

[mragula01]

hello all, i would like to ask you for advice. i would need to send from my devices each hour a syslog message (for example heartbeat_nameofdevice) each hour to Qradar. those devices are nexus 9K (9.3.9) and ASA firewall. i tried to configure it with event manager on nexus in this way

event manager applet heartbeat

action 1 syslog msg test_BEUWVVSSPRLESW009N93

but i am not able to set up timer in order to trigger this action each hour

thank you

Michal

[Georg Pauwen]

Hello,

you can add a CRON timer (in the example below, the syslog message would be run one minute after each hour):

event manager applet heartbeat
--> event timer cron cron-entry "01 * * * *" maxrun 99999999
action 1 syslog msg test_BEUWVVSSPRLESW009N93

[mragula01]

unfortunately event timer is not a option which is enabled on my nexus devices

(config-applet)# event ?
cli  - Create a cli event specification
counter -  Create a counter event
fanabsent -  Create fanabsent event specification
fanbad - Create fanbad event specification
fib -  FIB related event
gold  - Create a 'Diagnostic' event specification
internal-link-flap -  Create a 'internal-link-flap' event specification
memory - Create memory thresholds event specification
module - Create a 'module' event specification
module-failure -  Create a 'module-failure' event specification
neighbor-discovery - Show CDP new neighbors
oir - Create Online-Insertion-Removal event specification
policy-default -  Use the event in the system policy being overridden
poweroverbudget - Create poweroverbudget event specification
snmp - Create a 'snmp' event specification.
storm-control -  Create a storm control event specification
syslog - Create a syslog event specification
sysmgr - System manager related events
tag - Event tag identifier
temperature - Create temperature event specification
test - Create a 'test' event specification
track - Create a 'track' event specification

is there some other option ?

[Georg Pauwen]

Hello,

check if you can use KRON instead:

event manager applet EVERYHOUR_APP
event none
action 1 syslog msg test_BEUWVVSSPRLESW009N93
!
kron policy-list EVERYHOUR_POL
cli event man run EVERYHOUR_APP
!
kron occurence EVERYHOUR_OCC in 60 recurring
policy-list EVERYHOUR_POL

[mragula01]

hello Georg,

unfortunately even KRON is not enabled on our nexuses

 (config-applet)# kron ?
^
% Invalid command at '^' marker.
(config-applet)# exit

(config)# kron ?
^
% Invalid command at '^' marker.

[mragula01]

maybe is there some other way how to automatically generate log on nexus and ASA each hour ?

[Georg Pauwen]

Hello,

for the Nexus, try the below:

feature scheduler
!
scheduler job name SYSLOG_JOB
syslog msg test_BEUWVVSSPRLESW009N93
!
scheduler schedule name SCHED_HOURLY
job name SYSLOG_JOB
time hourly 00

[balaji.bandi]

Try EEM with scheduler :

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide/sm_12eem.html

[fmacias.duarte]

Where you able to figure this out? I'm trying to do the same thing

[balaji.bandi]

each device have different configuration what device you looking to configure or what is the config not working ?

[fmacias.duarte]

I'm trying to send a keepalive message every 10 min to sour syslog server in a Nexus 93180YC-FX3 switch. running NXOS version 10.4(5). I tried using scheduler, but the message is only being sent to the console: 

scheduler job name KEEPALIVE_LOG
    send log 6 "Keepalive: Device is alive"

end-job

scheduler schedule name KEEPALIVE_LOG
   time start 2025:09:19:14:52 repeat 0:0:10

[balaji.bandi]

how about this :

event manager applet EEM_KEEPALIVE
event timer watchdog time 3600 (1hours you can change this)
action 1.0 syslog msg "EEM-KEEPALIVE: Nexus 9K alive"

[fmacias.duarte]

Thanks for your response. I had tried something similar that I found online, but the "event timer" command is not an option for event manager. I also tried this, but didn't work either:

event manager applet KEEPALIVE_LOG
    event syslog pattern ".*"
    action 1.0 syslog priority notifications msg Keepalive: Device is alive

[fmacias.duarte]

This is what worked for me:

1. Created a python script to generate the log:

     1.1 open notepad++ and paste the following:

             #!/usr/bin/env python3
             import cli
             cli.cli('syslog priority notifications msg Keepalive: Device is alive')

      1.2 Save the file as keepalive.py and copy it to switch bootflash:

2. Create a scheduler job

3. Schedule to run the script every 5 min (you can adjust the time according to your needs)

Complete configuration :

scheduler job name python-keepalive
     python3 bootflash:/keepalive.py

end-job

scheduler schedule name keepalive
     job name python-keepalive
     time start now repeat 0:0:5

[balaji.bandi]

My next suggestion was that, since Nexus support Python, glad all good, thank you sharing the information with community.

even i did from syslog server same kind of script to check with nexus Managment IP, and report or generate syslog.