Hey guys, thanks for your offers of help!
I've got the TCL scripting book that you were part of Joe and it's become my bible for the next few weeks! As always with learning a new language though, it's the syntax that's letting me down (I think).
Apologies for the delay in responding though.
So the reason why I want to do this in TCL rather than Event Manager is that I'm trying to use this as a bit of a platform for building more structured code. So please forgive me if I ask that we don't do this using EEM (Unless if we can't do it in TCL).
A couple of basic questions first:
1) If TCLSH is not the same as TCL, I guess the question is why does it exist?
I tried to run that command in TCLSH because I actually have a script in a .tcl file saved in flash, and had the same error when attempting to run the script. Therefore question 2:
2) Just for the sake of my potential stupidity, how do you run a script(.tcl file) that is sitting in flash?
Finally, the butchered script is as follows (With some pseudocode shoved in for good measure):
#------------------------------------------------------------------
# EEM policy that will monitor SYSLOG for 0900 number successful calls.
# If a successful syslog message is detected then,
# send an email alert to ServiceDesk with the time and current
# "show isdn active" information.
#
#------------------------------------------------------------------
### The following EEM environment variables are used:
###
### _email_server
### - A Simple Mail Transfer Protocol (SMTP)
### mail server used to send e-mail.
### Example: _email_server mailserver.example.com
# NAMESPACE IMPORT
# Imports Cisco specific TCL extensions that can be used in the body of the code such as the first line of the code above.
# Add the following lines to your script:
# Register for a Syslog event. Event Detector: Syslog
# Match pattern for ISDN Connect Messages
::cisco::eem::event_register_Syslog pattern "%ISDN-6-CONNECT"
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
# Set array for event_reqinfo
# Array is populated with additional event information
array set Syslog_info [event_reqinfo]
set msg $Syslog_info(msg)
# Set routername variable for use later
set routername [info hostname]
# Debug message to verify a premium number is now a connected call
# action_Syslog msg "Premium Number Detected"
# Open CLI to get show isdn status
#
# ------------------- cli open -------------------
#
if [catch {cli_open} result] {
error $result $errorInfo
} else {
array set cli $result
}
if [catch {cli_exec $cli(fd) "enable"} result] {
error $result $errorInfo
}
# Execute CLI command and store in variable
if [catch {cli_exec $cli(fd) "show isdn active"} isdnactive ] {
error $result $errorInfo
}
#
#--------------------- cli close ------------------------
#
cli_close $cli(fd) $cli(tty_id)
# ACTION if call is a premium call
if [regexp {is connected to 09} $msg] {
action_Syslog msg "Premium call detected"
# save exact execution time
set time_now [clock seconds]
set time_now [clock format $time_now -format "%T %Z %a %b %d %Y"]
# EMAIL MESSAGE
# This manually creates a text message with specific format to be used by the
# smtp_send_email command later to send an email alert.
#
# Ensure the following are configured:
# ip domain-name
#
# If a hostname is used for mailservername, ensure the following are configured:
# ip name-server
# ip domain-lookup
#
# NOTE: Change environment variable _email_server to your SMTP server
#
# The email below references the following variables:
#
# $routername: hostname of device
# $time_now: time when specific Syslog message was detected
# $msg: Syslog message received
# $isdnactive: output of "show isdn active"
#
#
set email_message "Mailservername: $_email_server
From: mgerrard@acme.co.uk
To: servicedesk@acme.co.uk
Cc:
Subject: EEM: Premium Phone Call Detected On $routername
This email is generated by EEM.
$time_now
$msg
show ISDN active:
$isdnactive
"
# Send email message
if {[catch {smtp_send_email $email_message} result]} {
set result "Email send failed"
} else {
set result "Email Sent To ServiceDesk"
}
# Debug message to check email transmission status
action_Syslog msg "$result"
#Close ACTION
}
#ACTION if call is international
if [regexp {is connected to 00} $msg] {
action_Syslog msg "International call detected"
# save exact execution time
set time_now [clock seconds]
set time_now [clock format $time_now -format "%T %Z %a %b %d %Y"]
PSEUDOCODE:
Kick off a cron timer event that checks ISDN active table every 10 minutes.
set still active = true
If call is no longer active, then end script
If call has been up longer than 1 hour, then send the email with isdn active included
#EMAIL MESSAGE
set email_message "Mailservername: $_email_server
From: mgerrard@acme.co.uk
To: servicedesk@acme.com
Cc:
Subject: EEM: Suspicious International call on $routername
This email is generated by EEM.
$time_now
$msg
show isdn active:
$isdnactive
"
# Send email message
if {[catch {smtp_send_email $email_message} result]} {
set result "Email send failed"
} else {
set result "Email Sent"
}
Debug message to check email transmission status
action_Syslog msg "$result"
Close ACTION
}
