EEM - output file to syslog or limit output file size

[Niels J. Larsen]

Hi,

I'm troubleshooting a multicast issue involving some Nexus 5600s (among other devices).

Sine this issue only occurs during an application restart I would like to keep the output from "show ip igmp snooping event-history vlan" for much longer than I'm able to with the current "large" setting on the switch.

E.g. I'm only able to see approx 2-3 minutes back in time.

So, a good colleague provided me with this script:

event manager applet IGMP
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type exact entry-op ge entry-val 1 poll-interval 120
action 10 cli show clock >> bootflash:show_igmp_snooping_event_history_vlan/output.txt
action 20 cli show ip igmp snooping event-history vlan >> bootflash:show_igmp_snooping_event_history_vlan/output.txt

Essentially this runs the show command every 120 seconds and appends the output to a file.

It's great, but I'd like to be able to let this run forever without filling up the entire bootflash, so I'm looking for one of several possible solutions:

1. Create a rolling buffer of e.g. 100 files to provide ~200 minutes of history
2. Limit the file size of output.txt and if it exceeds a certain amount simply overwrite and start over
3. Send all output from the show command directly to syslog.
   This would be the preferred solution, because I could then use Splunk to search and dashboard the information.
   However I also see the most challenges with this, because depending on how often the show command is run (and exported to syslog) I would either lose information or send duplicates.

Any tips or pointers in the direction of one or more of the above - or something completely different - is much appreciated!

Best Regards,

Niels

[Joe Clarke · Accepted solution]

Depending on your version of NX-OS, there may not be a lot of programmatic applet features you can use.  It might be easier to create a timer-based applet that periodically copies the file to a backup and then truncates it.  For example:

feature evmed

!

event manager applet truncate

 event timer watchdog time 3600

 action 001 cli copy bootflash:show_igmp_snooping_event_history_vlan/output.txt bootflash:show_igmp_snooping_event_history_vlan/output.txt.bak

 action 002 cli del bootflash:show_igmp_snooping_event_history_vlan/output.txt no-prompt

[Niels J. Larsen]

Thanks for your help Joe!

Not sure why, but the sequence numbering 001 and 002 didn't work for me - had to change that to 10 and 20.

Also, the idea about backing up the file and then deleting it didn't work.

Not sure why, but what happened was that data kept building up in the original file, was never backed up and then got deleted.

In the end I changed your script slightly to simply sleep longer (14400 seconds / 4 hours) and then simply deleted the original file.