EEM - Set Variable(s) from Syslog message

[@mforman2]

Greetings community,

I'm  working on an event manager applet to is triggered by a syslog message for a:

%CDP-4-NATIVE_VLAN_MISMATCH

Then it captures the interface that generated the error and changes it to the appropriate VLAN.

event manager applet native-vlan-mismatch

 event syslog pattern "%CDP-4-NATIVE_VLAN_MISMATCH"

 *Capture interface that created the message and store a s a variable

 *enable, config, enter captured interface, configure.

I've pretty much gotten everything where I want it but I'm struggling with storing the interface as a variable to be called for configuration.

If anyone could give me some insight if this is possible to store a variable from a syslog message or know of another way to get that variable for the syslog message I would be grateful.

Regards-

@mforman2

[balaji.bandi]

Not sure (i belive) you would not  be able to achieve what you looking to capure the information built in with EEM. Instead you can send the SYSLOG information to SYSLOG- make nessary script to take action by SSH to device.

is this make sense ?

[@mforman2]

Thank you for your response.

Let me clarify just a little:

syslog on a 4510+E that is running the applet:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch TenGigabitEthernet1/1/4 (150).

I want to store this section of the syslog message as a variable:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch TenGigabitEthernet1/1/4 (150).

and call that variable in a an action cli command "$variable" 

___________________________________________________________________

So I would need to take the syslog message, send it somewhere else to run a script only to SSH it back to the same switch?

Or do you think the above is possible?

[Dan Frey · Accepted solution]

Need to parse the value out of the syslog message.

event manager applet CDP

event syslog pattern "CDP-4-NATIVE_VLAN_MISMATCH.*"

action 020 regexp "discovered on ([A-Za-z0-9\/]+)" "$_syslog_msg" match variable

action 030 puts "variable = $variable"

Test policy using send log:

lab-csr6#send log CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch

lab-csr6#

*Jan 27 22:27:19.206: %SYS-7-USERLOG_DEBUG: Message from tty0(user id: admin): CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/41 (1), with test_switch

lab-csr6#

*Jan 27 22:27:19.210: %HA_EM-6-LOG: CDP: variable = GigabitEthernet1/41

[@mforman2]

That was the link I was missing!

action XXX puts (matched value) = $(variable)

Thank you Daniel!

[balaji.bandi]

@Dan Frey 

Good one, another tip learned using regex[..thank you.