Showing results for 
Search instead for 
Did you mean: 

Syslog event pattern as array

Level 1
Level 1

Hi All,

I was hoping there might be a trick to doing this. I'm trying to set up EEM to send an email trap when OSPF fails whilst keeping track of the neighbor the event was triggered by. Basically we have an edge router with multiple subinterfaces with OSPF neighbors off each.

When I get a syslog entry like %OSPF-5-ADJCHG: Process xxxx, Nbr etc I'd like to save that as an array I can reference in the policy I use as an action..


event manager applet OSPFmon

event syslog pattern ".*OSPF-5-ADJCHG.*Neighbor Down.*"

action 1.0 policy OSPFalert.tcl


Is there a smart way of referencing that same syslog message in the .tcl without having to sort through the syslog with cli_exec and regular expressions.

I'd like to get to the point of having:

array $syslogmessage

so I can retrieve individual parts with lindex.


Any help would be great, I can't seem to find what I'm looking for in the Cisco EEM and TCL reference materials or an equivalent example in these forums.


1 Reply 1

Level 1
Level 1

Found the answer in another discussion...

I can grab the same syslog msg to play with by using $_syslog_msg

i.e. action 1.0 syslog msg "$_syslog_msg" gives me the same syslog message that the earlier event statement tripped on.