Solved: EEM configuration for a TCL script dissapear from config if it is an "abort"

lmcruzmir · ‎02-25-2013

Friday 22...

I loaded 4 TCL scripts to the router

I configured EEM to execute the TCL scripts with kron event trigger.

Saturday 25

The EEM launched the 4 scripts...

3 3 Actv success Sat Feb23 09:00:00 2013 timer cron applet: 1-refresh

4 4 Actv success Sat Feb23 09:52:00 2013 timer cron applet: 2-refresh

5 5 Actv abort Sat Feb23 09:55:00 2013 timer cron applet: 3-refresh

6 6 Actv abort Sat Feb23 09:58:00 2013 timer cron applet: 4-refresh

The EEM code for the scripts that failed was removed by system from running-config at this time without human intervention.

Saturday 24

EEM only executes the "success" scripts becuase there is no more code for anything else:

7 7 Actv success Sun Feb24 09:00:00 2013 timer cron applet: 1-refresh

8 8 Actv success Sun Feb24 09:52:00 2013 timer cron applet: 2-refresh

Monday 25 (today)

I review the running-config:

Router#sh run | i event manager

event manager applet 1-refresh

event manager applet 2-refresh

No more applets in the running-config.

IOS with this issue is: c7200p-advipservicesk9-mz.151-4.M6.bin (it also happens in M5)

All scripts works fine with c7200p-advipservicesk9-mz.152-4.M2.bin for several days.

Re-enter the missing code in 151-4.M6 (also M5) in the running config doesn't fix the issue, it is happening again.

Is this the expected behaviour of 15.1-4M train?

Joe Clarke · ‎03-11-2013

The EEM Tcl code has the header on it to run directly out of EEM. I also simplified the code by using the built-in HTTP API provided in EEM Tcl. Using tclsh is fine if you are only using tclsh. When you need to use EEM to schedule or automate code, you shouldn't wrap tclsh within EEM. Instead, use EEM Tcl.

No, it doesn't explain the removal of config. That I have never seen, and you were unable to capture debug that showed the abort. If the config is modified now, hopefully things will be simpler and easy to debug using the single Tcl policy. Tcl hasn't had any "major" changes since it was introduced in 12.3(2)T.

View solution in original post

Joe Clarke · ‎02-25-2013

I'm not really understanding this. Can you include the full snippets of config before and after the problem occurred? Note: kron can only execute non-interactive commands. If the commands are interactive or configured as one-shot, then kron will remove them from the config after they execute.

lmcruzmir · ‎02-26-2013

The EEM code is like this for all TCL scripts:

event manager applet 1-refresh

description Este es un script de pruebas de Luismi. Hablar con el si se quiere tocar.

event timer cron name 1-refresh cron-entry "00 09 * * *" maxrun 300

action 1.0 syslog msg "1... cargando"

action 1.5 cli command "enable"

action 1.6 cli command "tclsh disk2:/tclcode/1.tcl"

action 2.0 syslog msg "1... cargado"

action 3.0 cli command "exit"

! The next code dissapear from running-config after the first execution by cron, no messages on log at all.

event manager applet 2-refresh

description Este es un script de pruebas de Luismi. Hablar con el si se quiere tocar.

event timer cron name 2-refresh cron-entry "52 09 * * *" maxrun 300

action 1.0 syslog msg "2... cargando"

action 1.5 cli command "enable"

action 1.6 cli command "tclsh disk2:/tclcode/2.tcl"

action 2.0 syslog msg "2... cargado"

action 3.0 cli command "exit"

The TCL script is simple:

Get a file from a web server with a list of some IP addresses, parse that file, then create routes as well ACLs based on that.

Code is the same for both TCL scrips 1.tcl and 2.tcl, the format of the webpage with info is also the same, simple txt file.

The strange thing is...

script 1.tcl works fine and it is not removed from the running-config

script 2.tcl reports and "abort" and it is removed from the running-config

Both scripts are executed correctly manually.

Joe Clarke · ‎02-26-2013

I've never seen any EEM configuration removed from the config automatically. Can you provide the output of running "debug event manager action cli". Are there any other messages logged for these aborted? Perhaps the script is taking longer than 300 seconds.

lmcruzmir · ‎03-09-2013

Ok, "debug event manager action cli" doesn't show anything wrong for me.

Mar 9 19:51:04 10.255.255.61 11386: 028704: Mar 9 19:51:06.475 UTC: %HA_EM-6-LOG: Spamhaus-manual: Spamhaus... cargando

Mar 9 19:51:06 10.255.255.61 11387: 028705: Mar 9 19:51:06.475 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : CTL : cli_open called.

Mar 9 19:51:06 10.255.255.61 11388: 028706: Mar 9 19:51:06.475 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : OUT : TCL-Router#

Mar 9 19:51:06 10.255.255.61 11389: 028707: Mar 9 19:51:06.475 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : IN : TCL-Router#enable

Mar 9 19:51:06 10.255.255.61 11390: 028708: Mar 9 19:51:06.487 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : OUT : TCL-Router#

Mar 9 19:51:06 10.255.255.61 11391: 028709: Mar 9 19:51:06.487 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : IN : TCL-Router#tclsh flash:/tclcode/spamhaus2.tcl

Mar 9 19:51:06 10.255.255.61 11392: 028710: Mar 9 19:51:06.603 UTC: %SYS-5-CONFIG_I: Configured from console by on vty3

Mar 9 19:51:06 10.255.255.61 11393: 028711: Mar 9 19:51:06.607 UTC: %SYS-5-CONFIG_I: Configured from console by on vty3

Mar 9 19:51:06 10.255.255.61 11394: 028712: Mar 9 19:51:06.611 UTC: %SYS-5-CONFIG_I: Configured from console by on vty3

Mar 9 19:51:06 10.255.255.61 11395: 028713: Mar 9 19:51:06.615 UTC: %SYS-5-CONFIG_I: Configured from console by on vty3

Mar 9 19:51:06 10.255.255.61 11396: 028714: Mar 9 19:51:06.619 UTC: %SYS-5-CONFIG_I: Configured from console by on vty3

[...] Several lines here configuring the router (ip routes to null0) [...]

Mar 9 19:51:09 10.255.255.61 12326: 029644: Mar 9 19:51:10.467 UTC: %SYS-5-CONFIG_I: Configured from console by on vty3

Mar 9 19:51:09 10.255.255.61 12327: 029645: Mar 9 19:51:10.471 UTC: %SYS-5-CONFIG_I: Configured from console by on vty3

Mar 9 19:51:28 10.255.255.61 12328: 029646: Mar 9 19:51:30.223 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : OUT : Translating "www.spamhaus.org"...domain server (10.255.255.123) [OK]

Mar 9 19:51:28 10.255.255.61 12329: 029647: Mar 9 19:51:30.223 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : OUT : fin

Mar 9 19:51:28 10.255.255.61 12330: 029648: Mar 9 19:51:30.223 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : OUT :

Mar 9 19:51:28 10.255.255.61 12331: 029649: Mar 9 19:51:30.223 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : OUT : TCL-Router#

Mar 9 19:51:28 10.255.255.61 12332: 029650: Mar 9 19:51:30.223 UTC: %HA_EM-6-LOG: Spamhaus-manual: Spamhaus... cargado

Mar 9 19:51:29 10.255.255.61 12333: 029651: Mar 9 19:51:30.223 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : IN : TCL-Router#exit

Mar 9 19:51:29 10.255.255.61 12334: 029652: Mar 9 19:51:30.235 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : OUT : TCL-Router>

Mar 9 19:51:29 10.255.255.61 12335: 029653: Mar 9 19:51:30.235 UTC: %HA_EM-6-LOG: Spamhaus-manual : DEBUG(cli_lib) : : CTL : cli_close called.

Mar 9 19:51:29 10.255.255.61 12336: 029654: Mar 9 19:51:30.235 UTC: tty is now going through its death sequence

Script executed manually, result = ok

Script executed over timer cron from EEM, result = abort

But it is not always like that, sometimes, the manual execution also fails, router is just dedicated so far to TCL scripting, no load in the CPU at all.

TCL-Router#sh event manager history events

[...]

6 9 Actv abort Sat Mar 9 18:26:24 2013 none applet: Spamhaus-manual

7 10 Actv abort Sat Mar 9 18:29:31 2013 none applet: Spamhaus-manual

8 11 Actv abort Sat Mar 9 18:34:44 2013 none applet: Spamhaus-manual

9 12 Actv success Sat Mar 9 18:36:06 2013 none applet: Spamhaus-manual

10 13 Actv success Sat Mar 9 19:48:06 2013 none applet: Spamhaus-manual

IOS:c3825-advsecurityk9-mz.151-4.M5.bin

Joe Clarke · ‎03-09-2013

The abort is typically caused by an expiration of the maxrun timer. However, I don't see a debug for an abort. I don't know what your Tcl script is doing, but perhaps it needs longer than 300 seconds to do it. That said, what you are doing is not recommended. You should not call tclsh our of applets. Instead, port your tclsh script to EEM Tcl. Depending on what the script does it may be very easy to do that. But without seeing the script I cannot know for certain.

lmcruzmir · ‎03-10-2013

This is the EEM...

event manager applet Spamhaus-manual

description Este es un script de pruebas de Luismi. Hablar con el si se quiere tocar.

event none maxrun 600

action 1.0 syslog msg "Spamhaus... cargando"

action 1.5 cli command "enable"

action 1.6 cli command "tclsh flash:/tclcode/spamhaus2.tcl"

action 2.0 syslog msg "Spamhaus... cargado"

action 3.0 cli command "exit"

This is the script:

TCL-Router# more flash:/tclcode/spamhaus2.tcl

############################################################

# updatedrop.tcl #

# #

# Thomas Magill #

# tclish@tmagill.net #

# #

# Updates DROP list from Spamhaus and null routes it. #

# #

# *Before updating it removes all existing DROP entries #

# which are know by the name "Spamhaus_SBL". A smaller #

# standalone script i call removedrop.tcl will force the #

# removal of SBL prefixes added my this app. #

# #

############################################################

#puts "Entrando en script"

proc convertmask {args} {

#puts "Entrando en funcion convertmask"

set mask [expr {~ 0 << ( 32 - $args )}]

format "%d.%d.%d.%d" [expr {$mask >> 24 & 255}] [expr {$mask >> 16 & 255}] [expr {$mask >> 8 & 255}] [expr {$mask & 255}]

}

proc getfile {url} {

#puts "Entrando en funcion getfile"

#puts "Mostrando variable $url"

global http

if {![regexp -nocase {^(http://)?([^:/]+)(:([0-9])+)?(/.*)} \

$url x protocol server y port path]} {

error "bogus URL: $url"

}

#puts "He salido del primer IF"

#puts "La variable URL es: $url"

#puts "La variable SERVER es: $server"

#puts "La variable PORT es: $port"

if {[string length $port] == 0} {

set port 80

}

#puts "La variable PORT despues del segundo IF es: $port"

# set sock [socket $server $port]

set sock [socket $server $port]

#puts "Mostrando la variable SOCK: $sock"

#puts "Mostrando la variable PATH: $path"

puts $sock "GET $path HTTP/1.0"

puts $sock "Accept: */*"

puts $sock "Accept-Language: en-us"

# puts $sock "Accept-Encoding: gzip, deflate"

puts $sock "Host: www.spamhaus.org"

puts $sock "Connection: Keep-Alive"

puts $sock "Cache-Control: no-cache"

puts $sock ""

flush $sock

return $sock

}

#REMOVE OLD SBLs

set oldline [ exec "show run | inc Spamhaus_SBL" ]

foreach line [split $oldline "\n"] {

if {$line != ""} {

ios_config "no $line"} {}

}

#UPDATE SBLs

set newline [getfile www.spamhaus.org/drop/drop.lasso]

while { [gets $newline line] >= 0 } {

if {[regexp {(\S+)/(\S+) ; (\S+)} $line ignore ipaddr cidr sblnum]} {

set mask [convertmask $cidr]

#puts "Cargado ruta...ip route vrf spam $ipaddr $mask null0 name Spamhaus $sblnum"

ios_config "ip route vrf spam $ipaddr $mask null0 name Spamhaus_$sblnum"

}

puts "fin"

Joe Clarke · ‎03-10-2013

This EEM Tcl policy replaces your tclsh script and both applets. It will run either out of cron or manually. Before registering it, define the EEM environment variable spamhaus_cron:

event manager environment spamhaus_cron 0 0 * * *

That would run the script every night at midnight.

To register it, copy this script to your router into a directory on flash called policies. Then configure:

event manager directory user policy flash:/policies

event manager policy tm_update_spamhaus.tcl

This policy may still abort is it takes longer than five minutes to get and process the data via HTTP. If it does, just increase the maxrun timer until it runs successfully.

lmcruzmir · ‎03-11-2013

Hi Joseph,

First of all: thanks for your quick answer and the .zip file.

Script loaded here:

8 script user multiple Off Mon Mar 11 10:03:55 2013 tm_update_spamhaus.tcl

none: none: policyname {tm_update_spamhaus.tcl} sync {yes}

timer: timer cron: name {spamhaus_timer} cron entry {0 0 * * *}

trigger

correlate event timer or event none

nice 0 queue-priority normal maxrun 300.000 scheduler rp_primary Secu none

Let's see what is going on.

I have few questions and comments to share with you:

- What is the difference between the EEM code+TCL script I did and the EEM code+TLC script you added to this thread. I mean, from the point of view of execution, both ways should be valid, when do i need to use one way or another? call the execution of a TCL script as I did is not ok? (when I say is not ok I mean efficient, supported, recommended, secure...).

- If your script fix the "abort" result, it would be great, but it doesn't explain why the EEM code I applied was removed from running-config. Which is weird because there is not way to check it. Is there any major change between TCL engine over 15.1 and 15.2, I asked that because 15.2 was perfectly fine as far as I tested over a 7200.

Joe Clarke · ‎03-11-2013

The EEM Tcl code has the header on it to run directly out of EEM. I also simplified the code by using the built-in HTTP API provided in EEM Tcl. Using tclsh is fine if you are only using tclsh. When you need to use EEM to schedule or automate code, you shouldn't wrap tclsh within EEM. Instead, use EEM Tcl.

No, it doesn't explain the removal of config. That I have never seen, and you were unable to capture debug that showed the abort. If the config is modified now, hopefully things will be simpler and easy to debug using the single Tcl policy. Tcl hasn't had any "major" changes since it was introduced in 12.3(2)T.

lmcruzmir · ‎03-12-2013

Thanks for the fast answer, everything clear.

By the way:

7 41 Actv success Tue Mar12 00:00:00 2013 timer cron script: tm_update_spamhaus.tcl

lmcruzmir · ‎03-14-2013

Hi Joseph,

Some feedback from here.

Everything works fine so far :-)

I am very happy.

Thanks for all

lmcruzmir · ‎04-03-2013

Hi there Joseph,

After a while running the script I noted that it is not doing anything (yes I know, I didnt look at it the first time properly)

Here is the output of the debug:

Apr 3 11:44:40 10.255.255.61 722327: 739644: Apr 3 11:43:51.376 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:40 10.255.255.61 722328: 739645: Apr 3 11:43:51.376 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : CTL : cli_open called.

Apr 3 11:44:40 10.255.255.61 722329: 739646: Apr 3 11:43:51.376 UTC: [fh_tty_open_cmd]

Apr 3 11:44:40 10.255.255.61 722330: 739647: Apr 3 11:43:51.380 UTC: [fh_sys_reqinfo_routername_cmd]

Apr 3 11:44:40 10.255.255.61 722331: 739648: Apr 3 11:43:51.392 UTC: [fh_tty_read_cmd]

Apr 3 11:44:40 10.255.255.61 722332: 739649: Apr 3 11:43:51.392 UTC: [fh_tty_read_cmd] size= 13

Apr 3 11:44:40 10.255.255.61 722333: 739650: Apr 3 11:43:51.392 UTC: [fh_tty_prompt_cmd]

Apr 3 11:44:40 10.255.255.61 722334: 739651: Apr 3 11:43:51.504 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:40 10.255.255.61 722335: 739652: Apr 3 11:43:51.504 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : OUT : TCL-Router>

Apr 3 11:44:40 10.255.255.61 722336: 739653: Apr 3 11:43:51.504 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:40 10.255.255.61 722337: 739654: Apr 3 11:43:51.504 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : IN : TCL-Router>enable

Apr 3 11:44:40 10.255.255.61 722338: 739655: Apr 3 11:43:51.504 UTC: [fh_tty_write_cmd]

Apr 3 11:44:40 10.255.255.61 722339: 739656: Apr 3 11:43:51.504 UTC: [fh_tty_write_cmd] cmd = enable, cmdsize = 6

Apr 3 11:44:40 10.255.255.61 722340: 739657: Apr 3 11:43:51.504 UTC: [fh_sys_reqinfo_routername_cmd]

Apr 3 11:44:40 10.255.255.61 722341: 739658: Apr 3 11:43:51.516 UTC: [fh_tty_read_cmd]

Apr 3 11:44:40 10.255.255.61 722342: 739659: Apr 3 11:43:51.516 UTC: [fh_tty_read_cmd] size= 13

Apr 3 11:44:40 10.255.255.61 722343: 739660: Apr 3 11:43:51.516 UTC: [fh_tty_prompt_cmd]

Apr 3 11:44:40 10.255.255.61 722344: 739661: Apr 3 11:43:51.616 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:40 10.255.255.61 722345: 739662: Apr 3 11:43:51.616 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : OUT : TCL-Router#

Apr 3 11:44:40 10.255.255.61 722346: 739663: Apr 3 11:43:51.616 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:40 10.255.255.61 722347: 739664: Apr 3 11:43:51.616 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : IN : TCL-Router#show run | inc Spamhaus_SBL

Apr 3 11:44:40 10.255.255.61 722348: 739665: Apr 3 11:43:51.616 UTC: [fh_tty_write_cmd]

Apr 3 11:44:40 10.255.255.61 722349: 739666: Apr 3 11:43:51.616 UTC: [fh_tty_write_cmd] cmd = show run | inc Spamhaus_SBL, cmdsize = 27

Apr 3 11:44:40 10.255.255.61 722350: 739667: Apr 3 11:43:51.616 UTC: [fh_sys_reqinfo_routername_cmd]

Apr 3 11:44:40 10.255.255.61 722351: 739668: Apr 3 11:43:51.676 UTC: [fh_tty_read_cmd]

Apr 3 11:44:40 10.255.255.61 722352: 739669: Apr 3 11:43:51.676 UTC: [fh_tty_read_cmd] read not ready

Apr 3 11:44:40 10.255.255.61 722353: 739670: Apr 3 11:43:51.776 UTC: [fh_tty_read_cmd]

Apr 3 11:44:40 10.255.255.61 722354: 739671: Apr 3 11:43:51.776 UTC: [fh_tty_read_cmd] size= 11

Apr 3 11:44:40 10.255.255.61 722355: 739672: Apr 3 11:43:51.776 UTC: [fh_tty_prompt_cmd]

Apr 3 11:44:40 10.255.255.61 722356: 739673: Apr 3 11:43:51.876 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:40 10.255.255.61 722357: 739674: Apr 3 11:43:51.876 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : OUT : TCL-Router#

Apr 3 11:44:40 10.255.255.61 722358: 739675: Apr 3 11:43:51.876 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:41 10.255.255.61 722359: 739676: Apr 3 11:43:51.876 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : IN : TCL-Router#config t

Apr 3 11:44:41 10.255.255.61 722360: 739677: Apr 3 11:43:51.876 UTC: [fh_tty_write_cmd]

Apr 3 11:44:41 10.255.255.61 722361: 739678: Apr 3 11:43:51.876 UTC: [fh_tty_write_cmd] cmd = config t, cmdsize = 8

Apr 3 11:44:41 10.255.255.61 722362: 739679: Apr 3 11:43:51.876 UTC: [fh_sys_reqinfo_routername_cmd]

Apr 3 11:44:41 10.255.255.61 722363: 739680: Apr 3 11:43:51.888 UTC: [fh_tty_read_cmd]

Apr 3 11:44:41 10.255.255.61 722364: 739681: Apr 3 11:43:51.888 UTC: [fh_tty_read_cmd] size= 84

Apr 3 11:44:41 10.255.255.61 722365: 739682: Apr 3 11:43:51.888 UTC: [fh_tty_prompt_cmd]

Apr 3 11:44:41 10.255.255.61 722366: 739683: Apr 3 11:43:52.000 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:42 10.255.255.61 722367: 739684: Apr 3 11:43:52.000 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : OUT : Enter configuration commands, one per line. End with CNTL/Z.

Apr 3 11:44:42 10.255.255.61 722368: 739685: Apr 3 11:43:52.000 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : OUT : TCL-Router(config)#

Apr 3 11:44:42 10.255.255.61 722369: 739686: Apr 3 11:43:52.164 UTC: [fh_cli_debug_cmd]

Apr 3 11:44:42 10.255.255.61 722370: 739687: Apr 3 11:43:52.164 UTC: %HA_EM-6-LOG: tm_update_spamhaus2.tcl : DEBUG(cli_lib) : CTL : cli_close called.

Apr 3 11:44:42 10.255.255.61 722371: 739688: Apr 3 11:43:52.164 UTC: [fh_tty_close_cmd]

Apr 3 11:44:42 10.255.255.61 722372: 739689: Apr 3 11:43:52.176 UTC: fh_tcl_assoc_data_delproc: freeing tctx=0x66153984

I just renamed the file to tm_update_spamhaus2.tcl, it is the same script you posted here, no changes

Joe Clarke · ‎04-03-2013

Can you confirm the spamhaus URL is working for you? It's no longer working for me.

lmcruzmir · ‎04-04-2013

I confirm you it is working fine, I just did a telnet to port 80 from the CLI of the router, then I requested the web, and finally the server sent me back all the web page.

I also go access to it from other 2 DSL connections.

Here is part of that operation:

TCL-Router>telnet www.spamhaus.org 80

Translating "www.spamhaus.org"...domain server (10.255.255.123) [OK]

Trying cdn-cf.spamhaus.eu (190.93.241.93, 80)... Open

GET /drop/drop.lasso HTTP/1.0

Accept: */*

Accept-Language: en-us

Host: www.spamhaus.org

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: cloudflare-nginx

Date: Thu, 04 Apr 2013 13:54:16 GMT

Content-Type: text/plain; charset=UTF-8

Connection: close

Last-Modified: Thu, 4 Apr 2013 10:16:21 GMT

Expires: Fri, 05 Apr 2013 13:54:16 GMT

MIME-Version: 1.0

Set-Cookie: __cfduid=dfd062469b91a8b0b7daf6845cd0318f21365083656; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.spamhaus.org

CF-RAY: 59e7d52cb9904a9

; http://www.spamhaus.org/drop/drop.txt

; Last-Modified: Thu, 4 Apr 2013 10:16:21 GMT

; Expires: Fri, 05 Apr 2013 13:54:16 GMT

5.62.128.0/17 ; SBL167294

5.72.0.0/14 ; SBL167293

5.180.0.0/14 ; SBL169697

14.192.48.0/21 ; SBL131019

14.192.56.0/22 ; SBL131020.......................