cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1960
Views
0
Helpful
1
Replies

How to correlate two events into 1 action

jacksona2
Level 1
Level 1

I am trying to build at eem trigger that takes two events and only runs the action once if the either one of them is true,   but I can't seem to figure out the syntax

my simple script for testing,  produces two syslog message if both events are true.    I would like it to just run the "action" once for each occurs

no event manager applet check_wireless_stats

event manager applet check_wireless_stats

event tag n1 snmp oid 1.3.6.1.4.1.9.9.661.1.3.4.1.1.1.18  get-type exact entry-op le entry-val 0 poll-interval 30 maxrun 1000

event tag n2 snmp  oid 1.3.6.1.4.1.9.9.661.1.3.4.1.1.2.18 get-type exact entry-op le entry-val 0 poll-interval 30

trigger occurs 1

correlate event n1 or event n2

action 002 syslog msg "the event occurred"

I need to be able to run the script once if any of these events occurs or both events occur and not have it trigger the actions twice.

i.e. something like

  correlate [event n1 andnot event n2] or [event n2 andnot event n1] or [event n1 and event n2]

1 Reply 1

Joe Clarke
Cisco Employee
Cisco Employee

Try adding this to your applet to emulate a mutex:

action 1.0 cli command "enable"

action 2.0 cli command "show event manager scheduler thread queue-type applet detailed | incl check_wireless_stats"

action 2.1 set instances 0

action 3.0 foreach line $_cli_result "\n"

action 3.1  regexp "name: check_wireless_stats" $line match

action 4.0  if "$_regexp_result" eq 1

action 5.0   increment instances

action 6.0  end

action 7.0 end

action 8.0 if "$instances" ge 2

action 9.0  exit 0

action 9.1 end

action 9.2 syslog msg "the event occurred"

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco