I am looking at configuring event manager applets to automatically shut down interfaces due to no port activity over an extended time while having the timer restart should the interface come back into an up state before the timer expiration.
The trigger to shut the interface is utilizing syslog messaging but not sure how to incorporate the if and else statements to prevent the shut down from happening if the next syslog message for that interface is an up state.
I know I can create another apple to remove the original event but I do not want it to be deleted and added again after each time a particular interface comes back online.
event manager applet shut
event syslog pattern "Interface .*, changed state to" facility "LINEPROTO" mnemonic "UPDOWN" maxrun 3600
action 1.0 wait 30
action 2.0 regexp "Interface (.*), changed state to down" "$_syslog_msg" ignore intf
action 2.5 regexp "Interface (.*), changed state to up" "$_syslog_msg" ignore intf
action 3.0 syslog msg "The interface is $intf"
action 4.0 if $_syslog_msg eq "Interface (.*), changed state to up"
action 4.1 syslog msg "Abort if 'Interface (.*), changed state to up' before 14 days"
action 4.2 exit abort
action 4.5 elseif $_syslog_msg eq "Interface (.*), changed state to down"
action 4.6 syslog msg "Shutting down $intf"
action 5.0 cli command "enable"
action 6.0 cli command "conf t"
action 7.0 cli command "interface $intf"
action 8.0 cli command "shut"
action 9.0 cli command "end"
Any assistance in restructuring this applet or providing insight on different parameters would be appreciated.
