Event Manager Event syslog rules

[russell.sage]

Hi is there are document covering the rules for pattern matching syslog messages.

I have a script to shut a port if an IPSLA times out.

I put this together to automatically recover the interface when the following syslog entry is made

%RTT-4-OPER_TIMEOUT: condition cleared, entry number = 1

event manager applet recover
event syslog pattern "%RTT-4-OPER_TIMEOUT:.*condition cleared.*"
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "interface fa1/0/1"
action 1.3 cli command "no shut"
action 1.4 syslog msg "EEM Script recover activated"
action 1.5 end

Doesn't trigger.

[balaji.bandi]

Instead of Log message, why not use IP SLA track and shutdown and unshut the port : (Look at the below thread)

https://community.cisco.com/t5/network-management/eem-script-with-ipsla/td-p/3764218

or you looking to do different way ?

[Georg Pauwen]

Hello,

the syntax of your syslog pattern match does not look right. Make sure you use the exact same syntax as below:

event manager applet recover
event syslog pattern "%RTT-4-OPER_TIMEOUT: condition cleared"
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "interface fa1/0/1"
action 1.3 cli command "no shut"
action 1.4 syslog msg "EEM Script recover activated"
action 1.5 end

[russell.sage]

Hi

I checked the syntax and changed to below and still it doesn't execute. So I changed to an alternative

Syslog message

000391: Mar 1 01:17:23 GMT: %TRACKING-5-STATE: 1 ip sla 1 state Down->Up

event manager applet recover
event syslog pattern "%TRACKING-5-STATE: 1 ip sla 1 state Down->Up"
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "interface fa1/0/1"
action 1.3 cli command "no shut"
action 1.4 syslog msg "EEM Script recover activated"
action 1.5 end

still doesn't execute

[balaji.bandi]

000391: Mar 1 01:17:23 GMT: %TRACKING-5-STATE: 1 ip sla 1 state Down->Up

If you have this log then EEM script suggested should work.

Enable debug and show command help you :

show event manager history events

debug event manager action cli

[russell.sage]

I ran debug

000447: Mar 1 01:37:20 GMT: %TRACKING-5-STATE: 1 ip sla 1 state Down->Up
000448: Mar 1 01:37:20.372: fh_fd_syslog_event_match: num_matches = 0
000449: Mar 1 01:37:20.372: fh_fd_data_syslog: num_matches = 0

[russell.sage]

Hi

event manager applet recover
event syslog pattern "%TRACKING-5-STATE: 1 ip sla 1 state Down->Up"
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "interface fa1/0/1"
action 1.3 cli command "no shut"
action 1.4 syslog msg "EEM Script recover activated"
action 1.5 end

I did debug debug event manager detector syslog

000447: Mar 1 01:37:20 GMT: %TRACKING-5-STATE: 1 ip sla 1 state Down->Up
000448: Mar 1 01:37:20.372: fh_fd_syslog_event_match: num_matches = 0
000449: Mar 1 01:37:20.372: fh_fd_data_syslog: num_matches = 0

[balaji.bandi]

Looks odd, what device model,. what IOS code running on it ?

[russell.sage]

Hi

It's a 3750v2 running 15.0(2)SE11 - its old but is only used in a lab. I will try and get hold of a 9200 and test with that

[balaji.bandi]

i do not have in hand 3750 since they are gone now....may be try Cat 9200,

also look at other option i have suggested - see is that works ?

https://community.cisco.com/t5/network-management/eem-script-with-ipsla/td-p/3764218

[Georg Pauwen]

Hello,

your syslog pattern is not matched. Try the syntax below:

event syslog pattern ".*TRACKING-5-STATE: 1 ip sla 1 state Down->Up"