I am looking at configuring event manager applets to automatically shut down interfaces due to no port activity over an extended time while having the timer restart should the interface come back into an up state before the timer expiration.
The trigger to shut the interface is utilizing syslog messaging but not sure how to incorporate the if and else statements to prevent the shut down from happening if the next syslog message for that interface is an up state.
I know I can create another apple to remove the original event but I do not want it to be deleted and added again after each time a particular interface comes back online.
event manager applet shut event syslog pattern "Interface .*, changed state to" facility "LINEPROTO" mnemonic "UPDOWN" maxrun 3600 action 1.0 wait 30 action 2.0 regexp "Interface (.*), changed state to down" "$_syslog_msg" ignore intf action 2.5 regexp "Interface (.*), changed state to up" "$_syslog_msg" ignore intf action 3.0 syslog msg "The interface is $intf" action 4.0 if $_syslog_msg eq "Interface (.*), changed state to up" action 4.1 syslog msg "Abort if 'Interface (.*), changed state to up' before 14 days" action 4.2 exit abort action 4.5 elseif $_syslog_msg eq "Interface (.*), changed state to down" action 4.6 syslog msg "Shutting down $intf" action 5.0 cli command "enable" action 6.0 cli command "conf t" action 7.0 cli command "interface $intf" action 8.0 cli command "shut"
action 9.0 cli command "end"
Any assistance in restructuring this applet or providing insight on different parameters would be appreciated.
I have been looking at your issue and I think the main 'problem' is that what you probably want is to reset the timer for each individual port, but for that, you would need one EEM script for each port, and that is most likely not what you want.
How about a script that shuts an interface based on the 'last input' output of the 'show interfaces' command ?