12-03-2015 07:33 AM
I am working on an applet that monitors my route table. I would like to have something like this:
event tag E1 routing network 0.0.0.0/0 le 1
event tag E2 routing network 10.0.0.0/8 ge 16
event tag E3 routing network 10.1.0.0/16 ge 16
event tag E4 routing network 10.1.90.0/24 ge 24
event tag E5 routing network 10.1.91.0/24 ge 24
trigger
correlate event E1 or event E2
correlate event E3 andnot event E4 andnot event E5
I really don't want to run multiple applets to do the same basic function. Is there a way to tag each event and then use an "if" to group my actions?
12-03-2015 08:17 AM
show event manager detector routing details shows the variable data included for the event. Two of the variables are $_routing_network and $_routing_mask so you could use these in the "if" actions.
12-03-2015 08:56 AM
Yea that is how I am doing it now, but it doesn't seem like it is the "right" way.
That seems like a bunch of "if" statements, especially since I have almost 25 sites. Is there way to tag the event and track which event caused the EEM applet to run?
12-05-2015 05:56 AM
The policy could be written in TCL and boolean logic can be applied to the "if" statements for consolidation. I do not believe this can be done in a applet.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide