EEM C6500: disable an interface based on Storm Control syslog

[parisdooz12]

Hi,

I am totally beginner in EEM scripts, and try to find a solution to disable an interface in the following conditions:

- a syslog message appears becaus of Storm control limit reached,

- this message appears at least 1 time during a 30 second period, and at least 1 time in each of the next 5 other 30 seconds period

My first concern is to extract, from the syslog message, the name of interface, as a variable:

018136: Aug  6 05:07:36.002 MET: %PM_PLATFORM-5-PORTDROP: Port GigabitEthernet1/1 dropped packets due to storm control

Is it possible through a EEM applet, or the only solution is TCL script?

Thanks by advance.

Regards.

P.

[Joe Clarke]

What version of IOS is the 6500 running?

[parisdooz12]

I am in train 12.2(33)SXI, and want to upgrade to 12.2(33)SXJ.

Perhaps you will confirm or not, but it seems I can use the feature "action label regexp"; however it is in EEM 3.0 which is provided in 15.1 train ... I am a bit scared to use this IOS train!

[Joe Clarke]

Yeah, you'll need Sup2Ts and 15.x code for EEM 3.x.  And you need EEM 3.x to do what you want with an applet.  For your code, you will need to use Tcl.  That said, you can write your EEM applet using the regexp action, and take that to http://www.marcuscom.com/convert_applet/ to get the Tcl version that will run on your switch.  The action in question would be:

action X regexp "Port ([^ ]+) " $_syslog_msg match intf

Then the $intf variable will hold the interface.  You can then do whatever you want with it.

[parisdooz12]

Many thanks Joseph; I am going to test that and let you know.

Beside that, if I am not wrong, 15.x code works with sup720-10G (knowing that some line cards - I didn't check which one -  are not compatible)