EEM help on IOS: Redirect ping output to a file

[Nikhil Thakur]

Hi All,

I'm working on creating an EEM script which is working fine for the most part of it except one thing.

I'm trying to redirect the output of ping results (run on an IOS router) to a file in the flash however having a hard time finding the right syntax/way.

I came across a few posts talking about converting the EEM script to TCL using the converter but would like to know if that's the only way around it.

Does the EEM has to be converted to the TCL syntax for this need or is there a syntax in EEM itself which can be used to redirect that output to a file?

If there is an EEM way to do this, please suggest as soon as you can as it's quite urgent.

TIA!

[Philip D'Ath]

What about an action like:

action 1.0 cli command "ping 8.8.8.8 | append flash:ping.txt"

[Nikhil Thakur]

Thanks Philip.

I had tried that already and it doesn't work. Any other ideas?

Regards,

Nick

[Philip D'Ath]

ip sla using history metrics, and then extract the history?

[Joe Clarke · Accepted solution]

Depends on your version of IOS.  If your device supports EEM 4.0, then you can use direct file access from applets:

cli "ping 8.8.8.8"

file open fd "flash:ping.txt" w

file write fd "$_cli_result"

file close fd

If not, then Tcl is the only recourse.

[Nikhil Thakur]

Hey Joe,

Appreciate your response! It did help me getting over this problem however I'm still running into some other issues with my script where the script doesn't seem to execute any command after the 'action 6.5 wait 120' statement and closes the EEM with the following log:

DEBUG(cli_lib) : : CTL : cli_close called.

tty is now going through its death sequence

--snip from my EEM--

 action 6.1 cli command "monitor capture point start POINT"
 action 6.2 cli command "monitor capture point start POINT-CEF"
 action 6.3 cli command "ping 1.1.1.1"
 action 6.4 cli command "ping 8.8.8.8"
 action 6.5 wait 120
 action 6.6 cli command "undebug all"
 action 6.7 cli command "monitor cap point stop POINT"

 action 6.8 cli command "monitor cap point stop POINT-CEF"

----end----

So, lines starting from 6.1 to 6.4 are executed fine however lines after 6.5 are not. Not sure what could be going wrong here? Just an FYI, debugs (debug event manager action cli) doesn't show any errors.

My need is to let the debugs and captures run for at least 120 seconds and stop the captures and disable the debugs after that as seen in line 6.6 to 6.8.

Can you suggest what could be wrong?

[Joe Clarke]

EEM policies have a default 20 second maximum runtime.  You need to increase maxrun to cover your wait.  Set maxrun to 140 or higher.

[Nikhil Thakur]

Thanks again Joe! Appreciate a lot :)

[hitzemann.daniel]

Hello Joe,

I am having problems trying to record debug ip ospf events in a text file can you help me out?  I included everything below that I have so far just need the piece that records the debug.

event manager environment _email_server 10.x.x.x
event manager environment _email_from switch_name@domain.com
event manager environment _email_to user_name@doamain.com

event manager scheduler applet thread class default number 1
event manager applet OSPF-FLAP
event syslog pattern "FULL to DOWN, Neighbor Down: Dead timer expired" maxrun 36000
action 2.0 cli command "enable"
action 3.0 cli command "show clock | append flash:OSPF_OUTPUT.txt"
action 3.1 cli command "sh proc cpu sorted | append flash:OSPF_OUTPUT.txt"
action 3.2 cli command "show proc memory | append flash:OSPF_OUTPUT.txt"
action 3.3 cli command "sh ip ospf nei | append flash:OSPF_OUTPUT.txt"
action 3.4 cli command "sh ip ospf int br | append flash:OSPF_OUTPUT.txt"
action 3.5 cli command "show interface GigabitEthernet1/0/3 | append flash:OSPF_OUTPUT.txt"
action 3.6 cli command "show interface Vlan1000 | append flash:OSPF_OUTPUT.txt"
action 3.7 cli command "debug ip ospf events"
action 3.8 cli command "show debugging | append flash:OSPF_OUTPUT.txt"
action 3.9 cli command "show ip ospf events | append flash:OSPF_OUTPUT.txt"
action 4.0 syslog priority notifications msg "OSPF Neighbor is Down."
action 6.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "OSPF WENT DOWN - OSPF info from Switch_Name" body "$_syslog_msg"
action 6.1 syslog msg "**** E-mail was sent ****"
action 8.0 wait 180
action 8.1 cli command "no debug all"
action 8.2 cli command "show debugging | append flash:OSPF_OUTPUT.txt"
action 8.3 syslog msg "**** Debug was turned off ****"
action 9.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "IP OSPF DEBUG WAS TURNED OFF from Switch_Name" body "IP OSPF Debug was Turned Off"

[Joe Clarke]

You need to either increase maxrun to 140 (not recommended) or use my guide to introducing large, arbitrary delays into EEM policies : How To Introduce Large Delays In EEM Policies .

[hitzemann.daniel]

Thank you for replying to my question.  I have increased the maxrun to 36000 but my main question is trying to preserve the data that the debug produces.  I know a show command you can append to a text file but what is the mechanism that captures the data that a debug spits out?

Daniel

[Joe Clarke]

You need to run "show logg" and capture the $_cli_result.