EEM script doesn't work properly

[John Blakley]

All,

I have an eem script that I want to run when bgp goes down. I tested the script in GNS by doing a simple syslog message when the condition was met. I have the following script:

**** Doesn't work below *****

event manager applet Notify_DOWN

event syslog pattern "%BGP-5-ADJCHANGE: neighbor 172.16.9.2 Down*"

action 1.0 cli command "enable"

action 2.0 cli command "del /force flash:/Notify.txt"

action 2.1 cli command "show clock | append flash:/Notify.txt"

action 3.0 cli command "sh ip int brie | append flash:/Notify.txt"

action 4.0 cli command "sh ip bgp summary | append flash:/Notify.txt"

action 5.0 cli command "sh standby | append flash:/Notify.txt"

action 6.0 cli command "sh track | append flash:/Notify.txt"

action 7.0 cli command "more flash:/Notify.txt"

action 8.0 mail server "xxxxx" to "xxxxxx" from "xxxxxxx" subject "xxxxx" body "$_cli_result"

action 9.0 syslog msg "Mail sent successfully for failure."

action 9.1 cli command "end"

action 9.2 cli command "exit"

I think my problem has something to do with the pattern matching. When I'm testing, it shows:

%BGP-5-ADJCHANGE: neighbor 172.16.9.2 Down Interface flap"

I want to catch the pattern "neighbor 172.16.9.2 Down" or "neighbor 172.16.9.2 Down <anything after>". I tried to put ".* after Down and that didn't work, so I currently have just "*" after down which doesn't work. How can I match on just Down. or Down <anything> afterward?

I've tried:

event syslog pattern "%BGP-5-ADJCHANGE: neighbor 172.16.9.2 Down"

event syslog pattern "%BGP-5-ADJCHANGE: neighbor 172.16.9.2 Down.*"

event syslog pattern "%BGP-5-ADJCHANGE: neighbor 172.16.9.2 Down*"

event syslog pattern "BGP-5-ADJCHANGE: neighbor 172.16.9.2 Down"

I also tried creating tags for the first two and creating a trigger correlating the 2 tags with an OR statement and that didn't work either.

None of these are working...

Thanks!

John

[Dan-Ciprian Cicioiu]

Hi John,

Can you try :

event syslog pattern "%BGP-5-ADJCHANGE.*_172.16.9.2_.*Down"

Dan

[John Blakley]

Dan,

It's working. I've been fighting with this for a while. I was setting a wait on the script because initially it was timing out while sending to the smtp server because of convergence. Maxrun by default is 20 seconds and I had set my wait time to 20. I increased the maxrun to 30 and left the wait to 20 and I just got my email . Thanks for the response!

Oh, btw, I had a chance to use those triggers at one point

The final string was:

event syslog pattern "%BGP-5-ADJCHANGE: neighbor 172.16.9.2 Down.*" maxrun 30

Thanks!

John

[Dan-Ciprian Cicioiu]

After I posted , I realized that It's wired that It does not work like this.

I belive that you will have some problems with writing into the file - not very sure.

Yes , trigger is a fantastic feature in eem.

Dan

[John Blakley]

Dan,

Writing info to the file works perfectly The trick was getting it out of the file and into the body of the message. If you more the file, it'll store it in variable and you can set that variable up as the body of the message. Works nicely.

Thanks!

John

[Dan-Ciprian Cicioiu]

Hmm... I do not think that the match is the problem.

I think that your output file will not contain all the need it info.

Did you tried to see what's wrong :

debug event manager action

debug event manager all

Dan