cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Popup Hotspot Using ISR 1000 with WiFi/LTE for Teleworkers and Micro Branchesr
235
Views
5
Helpful
5
Replies
Highlighted
Beginner

EEM - Set Variable(s) from Syslog message

Greetings community,

 

I'm  working on an event manager applet to is triggered by a syslog message for a:

%CDP-4-NATIVE_VLAN_MISMATCH

 

Then it captures the interface that generated the error and changes it to the appropriate VLAN.

 

event manager applet native-vlan-mismatch

 event syslog pattern "%CDP-4-NATIVE_VLAN_MISMATCH"

 *Capture interface that created the message and store a s a variable

 *enable, config, enter captured interface, configure.

 

I've pretty much gotten everything where I want it but I'm struggling with storing the interface as a variable to be called for configuration.

 

If anyone could give me some insight if this is possible to store a variable from a syslog message or know of another way to get that variable for the syslog message I would be grateful.

 

Regards-

@mforman2

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Re: EEM - Set Variable(s) from Syslog message

Need to parse the value out of the syslog message.

 

event manager applet CDP

event syslog pattern "CDP-4-NATIVE_VLAN_MISMATCH.*"

action 020 regexp "discovered on ([A-Za-z0-9\/]+)" "$_syslog_msg" match variable

action 030 puts "variable = $variable"

 

Test policy using send log:

lab-csr6#send log CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch

lab-csr6#

*Jan 27 22:27:19.206: %SYS-7-USERLOG_DEBUG: Message from tty0(user id: admin): CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch

lab-csr6#

*Jan 27 22:27:19.210: %HA_EM-6-LOG: CDP: variable = GigabitEthernet1/41

View solution in original post

5 REPLIES 5
Highlighted
VIP Mentor

Re: EEM - Set Variable(s) from Syslog message

Not sure (i belive) you would not  be able to achieve what you looking to capure the information built in with EEM. Instead you can send the SYSLOG information to SYSLOG- make nessary script to take action by SSH to device.

 

is this make sense ?

 

BB
*** Rate All Helpful Responses ***
Highlighted
Beginner

Re: EEM - Set Variable(s) from Syslog message

Thank you for your response.

 

Let me clarify just a little:

 

syslog on a 4510+E that is running the applet:

 

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch TenGigabitEthernet1/1/4 (150).

 

I want to store this section of the syslog message as a variable:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch TenGigabitEthernet1/1/4 (150).

 

and call that variable in a an action cli command "$variable

 

___________________________________________________________________

 

So I would need to take the syslog message, send it somewhere else to run a script only to SSH it back to the same switch?

 

Or do you think the above is possible?

Highlighted
Cisco Employee

Re: EEM - Set Variable(s) from Syslog message

Need to parse the value out of the syslog message.

 

event manager applet CDP

event syslog pattern "CDP-4-NATIVE_VLAN_MISMATCH.*"

action 020 regexp "discovered on ([A-Za-z0-9\/]+)" "$_syslog_msg" match variable

action 030 puts "variable = $variable"

 

Test policy using send log:

lab-csr6#send log CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch

lab-csr6#

*Jan 27 22:27:19.206: %SYS-7-USERLOG_DEBUG: Message from tty0(user id: admin): CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch

lab-csr6#

*Jan 27 22:27:19.210: %HA_EM-6-LOG: CDP: variable = GigabitEthernet1/41

View solution in original post

Highlighted
Beginner

Re: EEM - Set Variable(s) from Syslog message

That was the link I was missing!

action XXX puts (matched value) = $(variable)

Thank you Daniel!
Highlighted
VIP Mentor

Re: EEM - Set Variable(s) from Syslog message

@Daniel Frey 

 

Good one, another tip learned using regex[..thank you.

BB
*** Rate All Helpful Responses ***
CreatePlease to create content
Content for Community-Ad