EEM / Tcl Script showing last Five Commands

[Carlton Patterson]

Hello Community,

Is there a EEM that will show the last five commands executed on a router. For example, I need a EEM that that will send a syslog message and list the previous five commands.

Thanks in advance for your help.

Cheers

Carlton

[Joe Clarke · Accepted solution]

Something like this would work.

event manager applet last-five-commands

event none

action 001 cli command "enable"

action 002 cli command "show history all"

action 003 set buf ""

action 004 set i 0

action 005 foreach line $_cli_result "\n"

action 006  if $i gt 4

action 007   break

action 008  end

action 009  regexp "^CMD:" $line

action 010  if $_regexp_result eq 1

action 011   append buf $line

action 012   incr i

action 013  end

action 014 end

action 015 syslog msg "Last 5 commands: $buf" 

[Carlton Patterson]

Joseph,

This is great mate.

I can't wait to try it out.

Cheers mate..

[Joe Clarke]

All this does is print a syslog message (and syslog really isn't the best delivery medium for this output).  It does work, so check your console or logging buffer for output.  It won't print anything on the calling VTY unless terminal monitor is enabled.

[Carlton Patterson]

Hi Joseph,

I have finally had a chance to test this script. I'm not sure what I'm doing wrong, but the script won't show the last five commands. I have configured logging buffered 32768, logging console 7.

When a issue the command event manager run xxxxxx.tcl I get the following response:

CMD: PASSWORD statement not printed UTC Fri Mar 1 2002TC Fri Mar 1 2002red/configchange.tcl: Last 5 commands: CMD: 'service timestamps debug datetime msec' 00:00:04 UTC Fri Mar 1 2002

R1#

Syslog logging: enabled (11 messages dropped, 0 messages rate-limited,

                0 flushes, 0 overruns, xml disabled, filtering disabled)

    Console logging: level debugging, 28 messages logged, xml disabled,

                     filtering disabled

    Monitor logging: level debugging, 0 messages logged, xml disabled,

                     filtering disabled

    Buffer logging: level debugging, 8 messages logged, xml disabled,

                    filtering disabled

    Logging Exception size (4096 bytes)

    Count and timestamp logging messages: disabled

Any thoughts mate?

Cheers

Carlton

[Joe Clarke]

The script uses the "show history all" command to get the last CLI commands run.  So test that command to see that your history is there.  Note: you will see commands on multiple lines, so some lines will print without a syslog message header.  This is why I said syslog is not the ideal delivery system for such data.

[Carlton Patterson]

Hi Joseph,

Thanks for getting back to me.

I'm just a little confused as to where the output of the last commnads will be displayed?

For example, the last few commands from the 'show history all' contain the following:

CMD: 'action 012   incr i' 09:05:46 UTC Mon Aug 5 2013

CMD: 'action 013  end' 09:05:46 UTC Mon Aug 5 2013

CMD: 'action 014 end' 09:05:46 UTC Mon Aug 5 2013

CMD: 'action 015 syslog msg "Last 5 commands: $buf" ' 09:05:47 UTC Mon Aug 5 2013

CMD: 'end' 09:05:48 UTC Mon Aug 5 2013

*Aug  5 09:05:48.311: %SYS-5-CONFIG_I: Configured from console by console

CMD: 'show hist' 09:05:50 UTC Mon Aug 5 2013

CMD: 'show history all' 09:05:51 UTC Mon Aug 5 2013

I thought that running the script 'event manager run xxxxxx.tcl the above five commands would be displayed.

Is that correct?

Cheers mate.

Carlton

[Carlton Patterson]

Hi Joseph,

I got it to work. Thanks

Sent from Cisco Technical Support iPad App

[Carlton Patterson]

Hi Joseph,

I started playing around with 'event manager applet last-five-commands'. After completing five commands nothing happened. I this something that I'm missing?

Cheers

Carlton

[Carlton Patterson]

Hello Joseph,

I tried to convert your EEM to tcl, but I got the following error message when I tried to run it:

R3#tclsh objectv4.tcl

invalid command name "::cisco::eem::event_register_none"

    while executing

"::cisco::eem::event_register_none "

    (file "convert.tcl" line 1)

Any thoughts?

Cheers

[Joe Clarke]

That tool produces EEM Tcl scripts.  You have to treat it like you've been treating every other EEM Tcl script and register it.