EEM applet variables and regex

[eekman]

Hi,

Im fiddeling with various EEM applets and feel a bit held back by the lack of documentation. Or maybe my google-searching skills have declined. First: Is there an official documentation of variables somewhere? So far I have pretty much brute-forced my way through whatever I see people use in scripts. This takes forever, especially when doing neighbor-discovery and you have to wait a few minutes for an access point to start and send cdp/lldp packets in order for the event to trigger. If you try to access a variable that is not set the whole applet fails (there is no "try/catch" as far as I know). 

Second: Is there documentation of what regex syntax an eem applet can handle? As far as I can tell it is a bit limited, some "common" regex syntax is accepted when configured, the applet runs without failing, but the regex does not match a value in the expected way. Doing things like [0-9]{2} for example does not work the way I expected it to.

Example: $_nd_cdp_platform is "cisco CW9164I-E" after a neighbor discovery event. 

# This match
action 0040 regexp "(.*)CW91(.*)" "$_nd_cdp_platform"

# This does not match
action 0040 regexp "(.*)CW91[0-9]{2}(.*)" "$_nd_cdp_platform"

This is all run on Catalyst 9000 devices, running IOSXE 17.12.4. Since it must work on 9200, any TCL solution is out.

[MHM Cisco World]

You want to detect device by cdp?

Give me exact name of device (like it appear in cdp) let me check.

MHM

[eekman]

Detecting devices by CDP/LLDP is one use case, yes. My question though is general, I want to understand EEM script capabilities enough to develop sustainable solutions and not just blindly copy what other people have done that may work but I don't know why.

For the example above with the 9164 AP, CDP output looks like this:

switch#show cdp neighbors gi1/0/2 detail
-------------------------
Device ID: ap1
Entry address(es):
  IP address: 10.1.1.93
Platform: cisco CW9164I-E,  Capabilities: Router Trans-Bridge
Interface: GigabitEthernet1/0/2,  Port ID (outgoing port): GigabitEthernet0
Holdtime : 142 sec

Version :
Cisco AP Software, ap1g6a-k9w8 Version: 17.12.5.41
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2014-2015 by Cisco Systems, Inc.

advertisement version: 2
Duplex: full
Power drawn: 30.000 Watts
Power request id: 2193, Power management id: 2
Power request levels are:30000 15400 0 0 0
Management address(es):
  IP address: 10.1.1.93


Total cdp entries displayed : 1

[MHM Cisco World]

https://www.cisco.com/c/en/us/td/docs/ios/12_2/dial/configuration/guide/dafaapre.html

Offical doc you need

MHM

[eekman]

Thanks! But it is 20 years old... but I cant find any info that regex actually has evolved since version 1, so maybe that is srtill accurate. I may also have found the list of variables. In this doc, accurate for the IOSXE version Im running, the different features of various EEM versions is listed (and also that EEM is backwards compatible):

https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/syst-mgmt/b-system-management/m_eem-policy-cli.html 

There one can see that CDP was added in EEM version 3.2. The documentation for that is here:

https://www.cisco.com/c/en/us/td/docs/ios/netmgmt/configuration/guide/nm_eem_3-2.html

... and lo and behold, a list of variables!

[MHM Cisco World]

CW9164I-E

Your regex must match 

CW91(any number)(any letter)-(any letter)

^CW91\d+[A-Za-z]-[A-Za-z]$

Note:- way I mention above is how regex understand what you need

Note:- /d+ is same as [0-9]+

MHM

[Jens Albrecht]

Hello @eekman,

Cisco supports a subset of the classic RegEx and most of the basic stuff should work as expected.
As you noticed some of the modern constructs are not supported:

• Curly brace quantifiers do not work
  So instead of [0-9]{2} you need to use [0-9][0-9]. Looks ugly but should work.
• Some advanced constructs like lookahead, non-greedy *? are also not supported.

You can find some EEM example for CDP/LLDP using RegEx here:

https://github.com/kebaldwi/DNAC-TEMPLATES/blob/master/TUTORIALS/EEM.md

HTH!

[Jonatan Jonasson]

Just out of curiosity, since I'm probably missing something, but why is TCL out due to 9200?
I've used TCL on some 9200 in the past, and I have a 9200L in my lab (C9200L-48PXG-4X running 17.9.4a) I tested and it works using the ::cisco::eem::event_register_neighbor_discovery trigger, using regex to match C91[0-9][0-9] to match my 9120 AP and creating a log entry.

[eekman]

I tried it briefly, but when I run the command to point to the file on flash: I got an error message. GPT said TCL requires 9300 and up and I did not verify that. Considering GPTs accuracy on EEM scripts overall there is a good chance it lied to me.

[MHM Cisco World]

Switch#debug embedded event manager action cli

Run this debug after add regex as event abd action as anything like puts hello message.

I dont think it issue of regex any more 

MHM

[Jonatan Jonasson]

For what it's worth, I asked GPT the same, and it told me this as well.
When I challenged it, it said that while guest shells are not supported on 9200, sometimes people may (incorrectly) interpret that as TCL scripts also not being supported, and changed its mind.

Just for reference, this is the snippet I made and tested today

::cisco::eem::event_register_neighbor_discovery interface .* cdp add

namespace import ::cisco::eem::*
namespace import ::cisco::lib::*

array set arr_einfo [event_reqinfo]

set platform $arr_einfo(cdp_platform)
set interface $arr_einfo(local_intf_name) 


if {[regexp {C91[0-9][0-9]} $platform]} {
    puts "Matched CDP platform: $platform on $interface"
}

Which gave me this log line:

*Jul 30 10:34:13.199: %HA_EM-6-LOG: myscript.tcl: Matched CDP platform: cisco C9120AXI-E on TenGigabitEthernet1/0/48

And my cdp nei looks like this:

switch#sh cdp nei
[...]
Device ID Local Intrfce Holdtme Capability Platform Port ID
AP[...] Ten 1/0/48 169 R T C9120AXI- Gig 0

This DOC was my reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-16-10/eem-xe-16-10-book/eem-event-reg-tcl.html#GUID-C5FC21FE-C9F6-417C-8713-033857204C9F

personally I favor TCL scripts over in-config EEMs for more complex scripts, both because of the flexibility and you have error handling (try/catch).
But this of course depends on the overall team you're in, as others may need to be able to work and troubleshoot this functionality.