I am totally beginner in EEM scripts, and try to find a solution to disable an interface in the following conditions:
- a syslog message appears becaus of Storm control limit reached,
- this message appears at least 1 time during a 30 second period, and at least 1 time in each of the next 5 other 30 seconds period
My first concern is to extract, from the syslog message, the name of interface, as a variable:
018136: Aug 6 05:07:36.002 MET: %PM_PLATFORM-5-PORTDROP: Port GigabitEthernet1/1 dropped packets due to storm control
Is it possible through a EEM applet, or the only solution is TCL script?
Thanks by advance.
Yeah, you'll need Sup2Ts and 15.x code for EEM 3.x. And you need EEM 3.x to do what you want with an applet. For your code, you will need to use Tcl. That said, you can write your EEM applet using the regexp action, and take that to http://www.marcuscom.com/convert_applet/ to get the Tcl version that will run on your switch. The action in question would be:
action X regexp "Port ([^ ]+) " $_syslog_msg match intf
Then the $intf variable will hold the interface. You can then do whatever you want with it.