temporary admin shutdown of interface on link loss

[jerold_swan]

I have a situation where a 3rd party embedded device has trouble booting correctly if it detects link during the beginning of its boot cycle. I'd like to write an EEM script so that the router interface to which it is connected will be administratively shut for 2 minutes after it detects link failure on the port to which the third party device is connected.

Superficially, this seems easy:

event manager applet MYHACK
 event syslog pattern "%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down" maxrun 180
 action 1.0 cli command "enable"
 action 2.0 cli command "conf t"
 action 3.0 cli command "interface Gi0/0"
 action 4.0 cli command "shutdown"
 action 5.0 wait 120
 action 6.0 cli command "no shutdown"
 action 7.0 cli command "end"

However, the problem is that an administrative "no shut" also triggers the same syslog message when the interface comes up, which puts the script into a permanent loop. The same thing happens if I use an interface tracking object as the trigger event.

How can I make this work correctly?

[Joe Clarke]

Have this applet configure another timer countdown applet to countdown the 120 seconds.  Then, have this applet set its event detector to none.  That will prevent it from executing.

At the end of the countdown applet execution, have it pause five seconds, then reset the first applet's ED to syslog (as you have it now).  That should prevent the loop.

[jerold_swan]

Thanks Joe. I'm having trouble figuring out how to manage two EEM scripts at the same time. I know it's going to be something like this, but it's not right yet. Can you help?

event manager applet HACK
 event syslog pattern "%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down" maxrun 300
 action 1.0 cli command "enable"
 action 2.0 cli command "conf t"
 action 3.0 cli command "interface Gi0/0"
 action 4.0 cli command "shutdown"
 action 4.5 event none
 action 5.0 cli command "event manager applet WAIT_120"
 action 6.0 cli command "event timer countdown time 120"
 action 6.1 cli command "event manager applet HACK"
 action 6.2 cli command "event syslog pattern "%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down" maxrun 300"

 action 6.3 cli command "interface Gi0/0"
 action 6.4 cli command "no shutdown"
 action 7.0 cli command "end"

[Joe Clarke]

Something like this:

event manager environment q "

!

event manager applet HACK
 event syslog pattern "%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down" maxrun 300
 action 1.0 cli command "enable"
 action 2.0 cli command "conf t"
 action 3.0 cli command "interface Gi0/0"
 action 4.0 cli command "shutdown"

 action 4.1 cli command "event manager applet WAIT_120"

 action 4.2 cli command "event timer countdown time 120 maxrun 45"

 action 4.2 cli command "action 1.0 cli command enable"

  action 4.3 cli command "action 2.0 cli command $q config t$q"

 action 4.4 cli command "action 3.0 cli command $q int gi0/0$q"

 action 4.5 cli command "action 4.0 cli command $q no shut$q"

 action 4.6 cli command "action 5.0 wait 10"

 action 4.7 cli command "action 6.0 cli command $q event manager applet HACK$q"

 action 4.8 cli command "action 7.0 cli command $q event syslog pattern $q *%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down$q"

 action 4.9 cli command "action 8.0 cli command $q no event manager applet WAIT_120$q"

 action 5.0 cli command "action 9.0 cli command end"

 action 5.1 cli command "event manager applet HACK"

 action 5.2 cli command "event none"

 action 5.3 cli command "end"

[jerold_swan]

This is really close but "action 4.8" shows a syntax error being thrown in the debug that I can't figure out. Here's my script (I tried it both with and without the '*' in your example):

event manager environment q "

event manager applet HACK
 event syslog pattern "%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down" maxrun 300
 action 1.0 cli command "enable"
 action 2.0 cli command "conf t"
 action 3.0 cli command "interface Gi0/0"
 action 4.0 cli command "shutdown"
 action 4.1 cli command "event manager applet WAIT_120"
 action 4.2 cli command "event timer countdown time 120 maxrun 180"
 action 4.25 cli command "action 1.0 cli command enable"
 action 4.3 cli command "action 2.0 cli command $q config t$q"
 action 4.4 cli command "action 3.0 cli command $q int gi0/0$q"
 action 4.5 cli command "action 4.0 cli command $q no shut$q"
 action 4.6 cli command "action 5.0 wait 10"
 action 4.7 cli command "action 6.0 cli command $q event manager applet HACK$q"
 action 4.8 cli command "action 7.0 cli command $q event syslog pattern $q*%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down$q maxrun 300$q"
 action 4.9 cli command "action 8.0 cli command $q no event manager applet WAIT_120$q"
 action 5.0 cli command "action 9.0 cli command $q end$q"
 action 5.1 cli command "event manager applet HACK"
 action 5.2 cli command "event none"
 action 5.3 cli command "end"

and here's the problem output from the debug:

Oct 10 20:33:05.560: %HA_EM-6-LOG: HACK : DEBUG(cli_lib) : : IN  : Lab2911(config-applet)#action 7.0 cli command " event syslog pattern "*%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down" maxrun 300"
Oct 10 20:33:05.584: %HA_EM-6-LOG: HACK : DEBUG(cli_lib) : : OUT : action 7.0 cli command " event syslog pattern "*%LINK-3-UPDOWN: Interface Gigabi                                               ^tEthernet0/0, changed state to down" maxrun 300"
Oct 10 20:33:05.584: %HA_EM-6-LOG: HACK : DEBUG(cli_lib) : : OUT :
Oct 10 20:33:05.584: %HA_EM-6-LOG: HACK : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Oct 10 20:33:05.584: %HA_EM-6-LOG: HACK : DEBUG(cli_lib) : : OUT :

I've triple-checked that I don't have any tabs or other special characters in the applet, but that big space in the middle of the word "Gigabit" still appears in the debug output just before the Invalid input warning.

Ideas?

[Joe Clarke · Accepted solution]

You're missing a space after $q and before *.  But the spacing will cause a problem.  Try:

action 4.8 cli command "action 7.0 cli command $q event syslog pattern .*%LINK-3-UPDOWN:.Interface.GigabitEthernet0/0,.changed.state.to.down$q"

[jerold_swan]

That works perfectly. Thanks a bunch!