Simple syslog EEM script issue

[KeithGebhardt]

Hello everyone - 

I was hoping someone can provide some insight on to what is going on here. 

I have a simple EEM script to log a syslog message once every monday. 

event manager applet SECURITY_SYSLOG
event timer cron cron-entry "0 8 * * 1"
action 1.0 syslog msg "This message is for Security Reporting"
end

I have tested the above script on a cisco switch in our lab environment and it works without any issue.
I go to implement the script on an access switch which is in production, and it will not log. 

I went back to try having the message log once every second -

event manager applet TEST
event timer cron cron-entry "*/1 * * * *"
action 1.0 syslog msg "This message is a TEST"
end

and again, it only works in our lab environment and no on the switch in production.

If i try to manually push a syslog- 

event manager applet TEST
event none
action 1.0 syslog msg "This is a manual test"
end
event manager run TEST

It works on the production switch, and I am able to view the syslog in "sh log"

Am i missing someting? Please help.

Thanks,
Keith

[GreatBeach]

Not an expert at all... but I can tell you that I have had similar issues when going from a 3750 to a 3850.   It *should* be the same but it is not.    Are both switches the same and running the same level IOS code?

[KeithGebhardt]

my production switch having the issue is a Cisco C3560X-48P | SW Version 12.2(55)SE3 | SW Image C3560E-UNIVERSALK9-M

My lab switch that it works on is a Cisco C-3560G-48P | SW Version 12.2(46)SE | SW Image C3560-ADVIPSERVICESK9-M

Id be willing to take any suggestions for other alternatives. I understand this can be achieved using a tcl script, but im having less luck getting that to work than i was the eem applet.

Thanks

[Joe Clarke]

EEM uses the buginf mechanism to send syslogs.  This means you need to be trapping debug level messages:

logging trap debug

Also, a cron entry of "*/1 * * * *" will log every minute, not every second.