Nexus 7k EEM Script

[Gabriel Hill]

I had plans to configure a EEM script to send a email when an OSPF adjacency drops. I have an odd spanning-tree issue that I believe the drops are related to and I want to see if my suspicions are correct. This doesn't happen very often, and it's normaly late at night.

I originally planned something like this:

event manager environment _email_server 192.168.x.x
event manager environment _email_to NetworkEngineers-Dist@company.com
event manager environment _email_from InternetMonitor@company.com
event manager session cli username "user"

event manager applet OSPF
event syslog pattern "%OSPF-"
action 1.0 cli command "enable"
action 1.1 cli command "show spanning-tree vlan 192"
action 1.2 cli command "show spanning-tree vlan 192 detail"
action 1.3 wait 10
action 1.4 cli command "show spanning-tree vlan 192"
action 1.5 cli command "show spanning-tree vlan 192 detail"
action 1.6 wait 20
action 1.7 cli command "show spanning-tree vlan 192"
action 1.8 cli command "show spanning-tree vlan 192 detail"
action 1.9 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Spanning-tree results" body "$_cli_result"

After trying this, it doesn't seem that NXOS support the email function.

My questions:

1. What alternative do I have? Is there a way to send the CLI output via SNMP or syslog?
2. Will this even run EVERY time the syslog pattern matches? Meaning if I get four %OSPF syslog messages, it will run four times repeatedly? \

Thank you,

[avayner · Accepted solution]

Yes, the script would run every time the event happens.

You should most likely optimize your syslog event to catch a more specific event.

Also, check out the "occurs" and "period" keywords on the event statement. It can make the script trigger only if a certain event repeats a couple of times within a time window.

The usual way people implement what you want to do is to append the show command results into a local file.

You can just publish a syslog event to notify that the event got triggered, but keep the output in the file.

Would be good to add a "show clock" to have a time stamp.

[Gabriel Hill]

Hello Arie,

Thank you for answering my questions.

This is what I've got now. I think it will work well.

event manager applet OSPF

event syslog pattern "%OSPF-4-NEIGH_ERR"

action 1.0 cli command "enable"

action 1.1 cli command "show clock >> bootflash:ospf"

action 1.2 cli command "show spanning-tree vlan 192 >> bootflash:ospf"

action 1.3 cli command "show spanning-tree vlan 192 detail >> bootflash:ospf"

action 1.4 wait 10

action 1.5 cli command "show clock >> bootflash:ospf"

action 1.6 cli command "show spanning-tree vlan 192 >> bootflash:ospf"

action 1.7 cli command "show spanning-tree vlan 192 detail >> bootflash:ospf"

action 1.8 wait 10

action 1.9 cli command "show clock >> bootflash:ospf"

action 2.0 cli command "show spanning-tree vlan 192 >> bootflash:ospf"

action 2.1 cli command "show spanning-tree vlan 192 detail >> bootflash:ospf"

action 2.2 cli command "end"

action 2.3 cli command "exit"

--- Turns out "wait" isn't a option in NXOS either. I just put "show logging info" in its place, and didn't append it to the output file. That command takes about 10-15 seconds to run for some reason, so it should give me the pause I want.