Syslog event pattern as array

[davidl8888]

Hi All,

I was hoping there might be a trick to doing this. I'm trying to set up EEM to send an email trap when OSPF fails whilst keeping track of the neighbor the event was triggered by. Basically we have an edge router with multiple subinterfaces with OSPF neighbors off each.

When I get a syslog entry like %OSPF-5-ADJCHG: Process xxxx, Nbr 10.60.0.1 etc I'd like to save that as an array I can reference in the policy I use as an action..

e.g.

event manager applet OSPFmon

event syslog pattern ".*OSPF-5-ADJCHG.*Neighbor Down.*"

action 1.0 policy OSPFalert.tcl

Is there a smart way of referencing that same syslog message in the .tcl without having to sort through the syslog with cli_exec and regular expressions.

I'd like to get to the point of having:

array $syslogmessage

so I can retrieve individual parts with lindex.

Any help would be great, I can't seem to find what I'm looking for in the Cisco EEM and TCL reference materials or an equivalent example in these forums.

[davidl8888]

Found the answer in another discussion...

I can grab the same syslog msg to play with by using $_syslog_msg

i.e. action 1.0 syslog msg "$_syslog_msg" gives me the same syslog message that the earlier event statement tripped on.