Variable preservation and pulling results from multiple triggers.

[ghostinthenet]

I'm working on an EEM applet (but may migrate to a TCL script if it becomes necessary) to capture a combination of events.

event manager environment _port1 42195
event manager environment _port2 53429
event manager environment _port3 53429
!
event manager applet EEM_Ports
 event tag Tag_E1 syslog pattern ".*%CP-.-UDP.*$_port1.\$"
 event tag Tag_E2 syslog pattern ".*%CP-.-UDP.*$_port2.\$"
 event tag Tag_E3 syslog pattern ".*%CP-.-UDP.*$_port3.\$"
 trigger occurs 1 period 15
  correlate event Tag_E1 and event Tag_E2 and event Tag_E3
 action 1.0 puts "$_syslog_msg"

I'm running into two problems with this.

First, the script works, but the variables aren't preserved in the event tags. They are processed when the applet is configured, but the running configuration shows the absolute values and changes to the event manager environment variables do not get reflected in the applet. This may be a design limitation and I can live with that if this is the case, but it would be good to know.

Second, once the applet is triggered, I need to check the results of each of the events to be sure that they were triggered by the same source. Unfortunately, the $_syslog_msg variable will only report the last pattern. Is there a way to get the $_syslog_msg from all three?

Input is appreciated.

[Joe Clarke · Accepted solution]

For #1, you will need to use Tcl to preserve the variability.

For #2, use "action X info type event reqinfo tag TAG" to load the variables with the specified tag.

[ghostinthenet]

Hey Joe:

I'm using an applet for proof of concept testing for the moment, so I'll try pulling the variables in that first. My current hack is to backstep through the syslog entries, which works but is beyond messy.

Once that's successful, I'll convert the lot to a TCL script. Do you have a reference for pulling the tag information into TCL variables?

Thanks for the input!

Jody

[Joe Clarke]

Take your resulting applet to http://www.marcuscom.com/convert_applet and that should give you what you want.

[ghostinthenet]

Hey Joe:

Thanks again for your help. I finally managed to gather everything I was trying to do into the following blog post and have credited you accordingly.

https://supportforums.cisco.com/blog/13072531/you-cant-try-it-if-you-dont-knock-it

I never did get around to implementing it as a TCL script, but gave reference to your converter for those who want to pursue this.

Jody