cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1115
Views
0
Helpful
1
Replies
Highlighted
Beginner

Creating a basic syslog message but masking "EEM-prefix"

Trying to create a simple syslog message, but I want to remove the "EEM prefix" so that it looks like a legitimate syslog message for testing.  Is there a way to remove or mask what the applet has included?

!

event manager applet none

event none

action 100 syslog msg "WAAS-3-WAAS_AD_BLACKLIST_FAILURE: IOS-WAAS auto-discovery negotiation failed with peer AB-CD-EE-00-12-34  for the following reason: WAAS-X"

!

what I want to see:

Jun  3 12:41:31.205:  WAAS-3-WAAS_AD_BLACKLIST_FAILURE: IOS-WAAS  auto-discovery negotiation  failed with peer AB-CD-EE-00-12-34  for the  following reason: WAAS-X

What I see: <<red lines through what I don't want to see>>

Jun  3 12:41:31.205: %HA_EM-6-LOG: none: WAAS-3-WAAS_AD_BLACKLIST_FAILURE: IOS-WAAS auto-discovery negotiation failed with peer AB-CD-EE-00-12-34  for the following reason: WAAS-X

Thank You.

1 REPLY 1
Highlighted
Hall of Fame Cisco Employee

With applets, this can only be done in EEM 4.0.  Prior to that, you'd need to use Tcl and send your syslogs using the "syslog:" channel.  For example:

set fd [open "syslog:" "w"]

puts $fd {WAAS-3-WAAS_AD_BLACKLIST_FAILURE: IOS-WAAS auto-discovery negotiation  failed with peer AB-CD-EE-00-12-34  for the following reason: WAAS-X}

close $fd

Note, that doing this will create a syslog that EEM can intercept.  As such be careful not to create an infinite loop.

Content for Community-Ad