Saving results of event-triggered traceroute

[jerold_swan]

I'm trying  to troubleshoot a situation where a router frequently  loses the path to  both its DMVPN headends, and I want to figure out  where on the path to  the headends the problem is happening.

I'd  like to fire off two traceroutes (one to each headend) every time I  lose   an EIGRP neighbor, and save the results in a way that I can view  later,   even if the router's uplink to the rest of the world is down.

Is there a way to do this? From a  brief skim of the documentation, it doesn't look like I can write the  result to flash?

Edited to add:

I'm trying to do this with an EEM TCL script that detects the EIGRP neighbor change, then starts a traceroute.

[Joe Clarke]

This should be fine.  I'm kind of confused as to what you're having trouble with.  It sounds like you may already have the beginnings of an EEM Tcl policy but you may need help writing out the output?  If so, you can absolutely save data to files on flash.  For example:

set fd [open "flash:dmvpn_results.txt" a]
puts $fd $traceroute_output1
puts $fd $traceroute_output2
close $fd

This will append the results of the traceroutes (stored in the traceroute_output1 and traceroute_output2 variables) to the file "flash:dmvpn_results.txt".

[jerold_swan]

Thanks Joe. So far I've written an EEM applet that sends the traceroute results to syslog, which works perfectly (albeit making for weird looking syslog messages).

I then ran that through the applet-to-tcl converter on your webpage, and I've gotten stuck after adding in the code to try writing the results to a file. Bear in mind that I'm learning tcl as I go along... this is what I have (I changed the "a" to "w" from your example, since I want to overwrite the file):

::cisco::eem::event_register_syslog pattern "DUAL-5-NBRCHANGE.*down"

namespace import ::cisco::eem::*

namespace import ::cisco::lib::*

if { [catch {cli_open} result] } {

    error $result $errorInfo

} else {

    array set cli1 $result

    }

if { [catch {cli_exec $cli(fd) "enable"} _cli_result] } {

    error $_cli_result $errorInfo

}

set f [open "flash:dmvpn_results.txt" "w"]

if { [catch {cli_exec $cli1(fd) "show clock"} _cli_result] } {

    error $_cli_result $errorInfo

}

puts $f $_cli_result

if { [catch {cli_exec $cli1(fd) "traceroute ip 8.8.8.8 time 1 probe 1 ttl 1 15"} _cli_result] } {

    error $_cli_result $errorInfo

}

puts $f $_cli_result

if { [catch {cli_exec $cli1(fd) "traceroute ip 4.2.2.2 time 1 probe 1 ttl 1 15"} _cli_result] } {

    error $_cli_result $errorInfo

}

puts $f $_cli_result

close $f

catch {cli_close $cli(fd) $cli(tty_id)}

I then copied this into flash:/policies/dmvpn_trace.tcl and added this to the config:

event manager directory user policy "flash:/policies"

event manager policy dmvpn_trace.tcl

but I get no file in flash when I test it by bouncing an EIGRP neighbor.

Edited to Add:

I just realized I should run a "debug event manager tcl commands" and got:

can't read "cli(fd)": no such variable

so I'll go back and try to figure that out... I pasted that in from the applet-to-tcl converter but I must have missed something.

[Joe Clarke]

I'll check the converter code, but you are referencing the $cli array when it should be $cli1.

[Joe Clarke]

I checked the code, and the applet converter always spits out $cli1(...).  I don't know where the $cli(...) is coming from.

[jerold_swan]

Well, that seems so obvious now that I'm looking right at it!

Obviously had some fumbly fingers somewhere in there... it works now. Thanks!