cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1293
Views
0
Helpful
5
Replies

EEM doesn't work properly while reporting< FAILURE> on accounting log.

thsmfe001
Level 1
Level 1

Hi All,

I've been making EEM scripts for a workaround of ITD function but i face with problem not to adopt  all EEM policies.

Below are EEM Configurations and accounting logs.

How should I modify EEM policy or another configurations?

event manager scheduler applet thread class default number 32
event manager applet Node_check
action 1.0 cli command "show itd session device-group | in node | count"
action 1.1 regexp "([0-9]+)" "$_cli_result" "match" "count"
action 1.12 puts "$count"
action 2.1 if $count eq "0" goto 3.0
action 2.3 cli command "config t"
action 2.4 cli command "itd session device-group test"
action 2.5 cli command "commit"
action 2.6 puts " Count mismatch & commit
action 2.7 exit
action 3.0 puts "Count OK"
event manager applet node_down
event syslog pattern "OTM-5-OTM_OBJECT_STATUS: Status of tracking object .* ch
anged to DOWN"
maxrun 300
action 1.0 regexp "object ([0-9]+)" "$_syslog_msg" "match" "track"
action 1.1 if $track lt "300" goto 3.0
action 1.2 cli command "show ip sla configuration $track | in Target"
action 1.3 regexp "Target address/Source address: ([0-9]+\.[0-9]+\.[0-9]+\.[0-
9]+)" "$_cli_result" "match" "node"
action 2.1 cli command "config t"
action 2.2 cli command "itd session device-group test"
action 2.3 cli command "no node ip $node"
action 2.7 exit
action 3.0 exit
event manager applet node_up
event syslog pattern "OTM-5-OTM_OBJECT_STATUS: Status of tracking object .* ch
anged to UP"
maxrun 300
action 1.0 regexp "object ([0-9]+)" "$_syslog_msg" "match" "track"
action 1.1 if $track lt "300" goto 3.0
action 1.2 cli command "show ip sla configuration $track | in Target"
action 1.3 regexp "Target address/Source address: ([0-9]+\.[0-9]+\.[0-9]+\.[0-
9]+)" "$_cli_result" "match" "node"
action 2.1 cli command "config t"
action 2.2 cli command "itd session device-group test"
action 2.3 cli command "node ip $node"
action 2.7 exit
action 3.0 exit

on Aug 22 17:55:20 2016:type=start:id=slot-9@pts/35:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/34:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/36:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/65:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/38:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/37:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/70:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/71:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/39:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/44:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/67:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/69:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/72:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/74:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/66:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/68:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/75:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/77:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/73:user=svc-isan:cmd=
Mon Aug 22 17:55:20 2016:type=start:id=slot-9@pts/76:user=svc-isan:cmd=
Mon Aug 22 17:55:21 2016:type=start:id=slot-9@pts/79:user=svc-isan:cmd=
Mon Aug 22 17:55:21 2016:type=start:id=slot-9@pts/78:user=svc-isan:cmd=
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/34:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/35:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/37:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/65:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/67:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/69:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/77:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/72:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/36:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/38:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/75:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/39:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/74:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/44:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/66:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/68:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/70:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/71:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/76:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/73:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/34:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.3 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/35:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.4 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/37:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.8 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/65:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.14 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/67:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.1 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/69:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.18 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/77:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.19 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/72:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.6 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/36:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.2 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/75:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.20 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/38:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.7 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/39:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.10 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/74:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.22 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/44:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.11 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/66:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.12 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/68:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.5 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/70:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.9 (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/71:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.16 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/76:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.17 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/73:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.21 (FAILURE)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/79:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:23 2016:type=update:id=slot-9@pts/78:user=svc-isan:cmd=configur
e terminal ; itd session device-group test (SUCCESS)
Mon Aug 22 17:55:24 2016:type=update:id=slot-9@pts/79:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.13 (FAILURE)
Mon Aug 22 17:55:24 2016:type=update:id=slot-9@pts/78:user=svc-isan:cmd=configur
e terminal ; itd session device-group test ; node ip 1.1.61.15 (FAILURE)

5 Replies 5

Joe Clarke
Cisco Employee
Cisco Employee

Seems like the user "svc-isan", which I assume is your EEM session CLI user, is not authorized to run some of the commands.  This isn't an EEM issue, but something to do with your AAA configuration.  If you want to bypass AAA authz, then add "auth bypass" to your applet's configuration line.

Thank you for quick reply.

These EEM is working on NX-OS but i haven't find auth bypass under my applets.

What command is for NX-OS to bypass authz.

Thank you.

NX-OS doesn't have the auth bypass.  It could be that the chaining together of commands is making your AAA unhappy.  Try separating commands as separate actions:

cli command "config t"

cli command "itd session device-group test"

cli command "node ip 1.1.61.13"

Thank you for your help.

I found out the cause why it reported fail log on accounting logs.

It was duplicated commands that already applied.

But I still have problem that is not to apply all EEM policies for Events triggered.

I am attaching debug logs.

One is 64 node fail case, the other is only one node fail case.

In 64 node fail case, EEM was just assigned to 21 threads so the rest wasn't applied.

I think EEM has some limitations for message queue.

Please check them.

Thank you.

In IOS, there is a 64 message count limit as I recall.  I'm not sure if NX-OS has the same limitation.  If you feel that you could get an arbitrary number of events at once, you should probably try and change the event to be more generic.  For example, while it wouldn't be edge-triggered, you could use a timer to sweep the track states and adjust the commands as needed.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco