EEM log event question

[jrahm]

I would like to have an event trip on the log entry ".*Crypto.tunnel.is.*" where the value I'm looking for immediately following is UP or DOWN. I see that I can set an environment variable for _syslog_pattern, but I'm unsure with EEM how do utilize the information. Basically, I want to run commands 1-5 when the log message "Crypto Tunnel is UP" occurs and commands 6-10 when the log message "Crypto Tunnel is DOWN" occurs.

Currently, I have a TCL script called by kron every minute that compares current/previous state and runs the cli commands appropriately, but it is not a clean solution and I think I have a memory leak.

Any help would be appreciated.

[Joe Clarke]

If you want to take different actions on UP and DOWN events, you will either need to create two applet policies, or use a TCL policy. With the TCL policy, you can do conditionals so you can take alternate code paths. Applets, however, do not currently support conditionals.

More information on using EEM TCL policies can be found at http://www.cisco.com/en/US/products/ps6441/products_configuration_guide_chapter09186a0080559cd5.html .

[jrahm]

Thanks for the doc. I am confused, however, with what is required to be in the CLI configuration and what needs to be in the TCL script. Preferably, the syslog pattern "Crypto tunnel is" will kick off my script, which will do x cmds if tunnel is UP and y cmds if tunnel is DOWN. How is this setup? And once setup, how do I read that line in the script? I see from the doc you pointed out the event_register_syslog, but I am unsure how to apply that. Thanks. If not obvious by now, I'm not a programmer.

[Joe Clarke]

Then perhaps TCL is not the right choice for you. The applet approach is better for a non-programmer:

event manager applet tunnel_up

event syslog pattern ".*Crypto.tunnel.is.UP.*"

action 1.0 cli command "enable"

action 2.0 cli command "config t"

action 3.0 cli command "int serial0"

action 4.0 cli command "shut"

action 5.0 cli command "end"

This is just an example, but I think you get the picture. You would then create another applet for the DOWN message.

[jrahm]

Actually, I got it figured out, but I like the applet approach better. Thanks