Problem: setting EEM to confirm license boot level security command with a "yes"

[MartinKajan]

Hi,

I'm having trouble creating a functional EEM script for testing. The purpose of the script is to use the command "license boot level security" and confirm the action with a "yes" (or simply "y"). 

Applet:
event manager applet TEST2
event timer countdown time 10
action 1.0 cli command "config t"
action 1.1 cli command "license boot leve secu" pattern "ACCEPT"
action 1.2 cli command "y"
end

Debug output:

*Jun 29 14:30:08.509: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : CTL : cli_open called.
*Jun 29 14:30:08.510: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : S9NM01-R01#
*Jun 29 14:30:08.510: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : IN : S9NM01-R01#config t
*Jun 29 14:30:08.622: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : Enter configuration commands, one per line. End with CNTL/Z.
*Jun 29 14:30:08.622: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : S9NM01-R01(config)#
*Jun 29 14:30:08.622: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : IN : S9NM01-R01(config)#license boot leve secu
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : PLEASE READ THE FOLLOWING TERMS CAREFULLY. INSTALLING THE LICENSE OR
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : LICENSE KEY PROVIDED FOR ANY CISCO PRODUCT FEATURE OR USING SUCH
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : PRODUCT FEATURE CONSTITUTES YOUR FULL ACCEPTANCE OF THE FOLLOWING
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : TERMS. YOU MUST NOT PROCEED FURTHER IF YOU ARE NOT WILLING TO BE BOUND
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : BY ALL THE TERMS SET FORTH HEREIN.
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT :
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : Use of this product feature requires an additional license from Cisco,
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : together with an additional payment. You may use this product feature
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : on an evaluation basis, without payment to Cisco, for 60 days. Your use
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : of the product, including during the 60 day evaluation period, is
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : subject to the Cisco end user license agreement
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : If you use the product feature beyond the 60 day evaluation period, you
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : must submit the appropriate payment to Cisco for the license. After the
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : 60 day evaluation period, your use of the product feature will be
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : governed solely by the Cisco end user license agreement (link above),
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : together with any supplements relating to such product feature. The
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : above applies even if the evaluation license is not automatically
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : terminated and you do not receive any notice of the expiration of the
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : OUT : evaluation period. It is your responsibility to determine when the
*Jun 29 14:30:08.733: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : CTL : 20+ lines read from cli, debug output truncated
*Jun 29 14:30:08.734: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : IN : y

*Jun 29 14:30:28.572: %HA_EM-6-LOG: TEST2 : DEBUG(cli_lib) : : CTL : cli_close called.
*Jun 29 14:30:28.573:

I have tried numerous variations of this and nothing seems to work.

Does anybody have any suggestions? 

Thank you very much.

Best regards,

Martin

[Joe Clarke]

Looks like it's working to me.  The policy runs to completion.  What makes you think it's not working?

[MartinKajan]

Show version states the license was not activated. I was trying this on ISR4331/K9. 
I will get back to it tomorrow.

[Joe Clarke]

Maybe it wants you to actually type, "yes" instead of "y".  In these cases I always tell people to run the same commands manually to see if they achieve the desired results.

[MartinKajan]

I have tried that too. I also tried using different patterns and even without pattern, nothing seems to do the trick.

[MartinKajan]

Also, running the "y" or "yes" manually does achieve the expected results.

[Joe Clarke]

Post the full output of the command and the response.  The debug is truncating the output.

[MartinKajan · Accepted solution]

That's also something I was unable to do - it always truncated the output.
Anyway, the scrip I made required (for whatever reason) another command after the "y" so that the confirmation would apply.
..."command" pattern "..."

..."y"

..."do show version | i security"

after adding the last command, everything worked as expected. It would seem the "y" did not apply, for some reason, without it.

I'm not exactly sure as to why it works like this, but it works :)