EEM configuration for a TCL script dissapear from config if it is an "abort"

[lmcruzmir]

Friday 22...

I loaded 4 TCL scripts to the router

I configured EEM to execute the TCL scripts with kron event trigger.

Saturday 25

The EEM launched the 4 scripts...

3    3      Actv success  Sat Feb23 09:00:00 2013  timer cron         applet: 1-refresh

4    4      Actv success  Sat Feb23 09:52:00 2013  timer cron         applet: 2-refresh

5    5      Actv abort    Sat Feb23 09:55:00 2013  timer cron         applet: 3-refresh

6    6      Actv abort    Sat Feb23 09:58:00 2013  timer cron         applet: 4-refresh

The EEM code for the scripts that failed was removed by system from running-config at this time without human intervention.

Saturday 24

EEM only executes the "success" scripts becuase there is no more code for anything else:

7    7      Actv success  Sun Feb24 09:00:00 2013  timer cron         applet: 1-refresh

8    8      Actv success  Sun Feb24 09:52:00 2013  timer cron         applet: 2-refresh

Monday 25 (today)

I review the running-config:

Router#sh run | i event manager

event manager applet 1-refresh

event manager applet 2-refresh

No more applets in the running-config.

IOS with this issue is: c7200p-advipservicesk9-mz.151-4.M6.bin (it also happens in M5)

All scripts works fine with c7200p-advipservicesk9-mz.152-4.M2.bin for several days.

Re-enter the missing code in 151-4.M6 (also M5) in the running config doesn't fix the issue, it is happening again.

Is this the expected behaviour of 15.1-4M train?

[Joe Clarke]

Try this version to see what you get back from the HTTP session.  Each line should be printed in the logging buffer.

[lmcruzmir]

Here we go:

[...]

Apr 16 00:01:41 10.255.255.61 990787: 1008104: Apr 16 00:00:01.182 UTC: %HA_EM-6-LOG: tm_update_spamhaus3.tcl: XXX: Read line                

Access Denied

 
Apr 16 00:01:41 10.255.255.61 990788: 1008105: Apr 16 00:00:01.182 UTC: %HA_EM-6-LOG: tm_update_spamhaus3.tcl: XXX: Read line                

The owner of this website (www.spamhaus.org) has banned your access based on your browser's signature (957e201d-cl-ua-81). (Ref. 1010)

               

Apr 16 00:01:41 10.255.255.61 990789: 1008106: Apr 16 00:00:01.182 UTC: %HA_EM-6-LOG: tm_update_spamhaus3.tcl: XXX: Read line                        

• Timestamp: Mon, 15 Apr 2013 17:00:01 -0700
  Apr 16 00:01:41 10.255.255.61 990790: 1008107: Apr 16 00:00:01.182 UTC: %HA_EM-6-LOG: tm_update_spamhaus3.tcl: XXX: Read line                        

• Your IP address: 149.126.32.29


Apr 16 00:01:41 10.255.255.61 990791: 1008108: Apr 16 00:00:01.182 UTC: %HA_EM-6-LOG: tm_update_spamhaus3.tcl: XXX: Read line                        

• Requested URL: www.spamhaus.org/drop/drop.lasso


[...]

Useragent is the problem, looks like

[Joe Clarke]

You can try changing the user agent by adding this code right before the ::http::geturl call:

::http::config -useragent ”Spamhaus Updater/1.0 (Cisco EEM)”

It's not clear whether that will help.  You may want to set the UA to emulate Firefox.

[lmcruzmir]

Changed, let's wait to the next cron cycle, for sure it works