One Applet with Multiple Event Combinations

[Jason Kopacko]

I am working on an applet that monitors my route table. I would like to have something like this:

event tag E1 routing network 0.0.0.0/0 le 1
 event tag E2 routing network 10.0.0.0/8 ge 16
 event tag E3 routing network 10.1.0.0/16 ge 16
 event tag E4 routing network 10.1.90.0/24 ge 24
 event tag E5 routing network 10.1.91.0/24 ge 24

trigger
 correlate event E1 or event E2
 correlate event E3 andnot event E4 andnot event E5

I really don't want to run multiple applets to do the same basic function. Is there a way to tag each event and then use an "if" to group my actions?

[Dan Frey]

show event manager detector routing details shows the variable data included for the event.   Two of the variables are $_routing_network  and $_routing_mask  so you could use these in the "if" actions.  
 

[Jason Kopacko]

Yea that is how I am doing it now, but it doesn't seem like it is the "right" way.

That seems like a bunch of "if" statements, especially since I have almost 25 sites. Is there way to tag the event and track which event caused the EEM applet to run?

[Dan Frey]

The policy could be written in TCL and boolean logic can be applied to the "if" statements for consolidation.    I do not believe this can be done in a applet.