04-07-2016 11:02 AM
I'm working on an EEM applet (but may migrate to a TCL script if it becomes necessary) to capture a combination of events.
event manager environment _port1 42195 event manager environment _port2 53429 event manager environment _port3 53429 ! event manager applet EEM_Ports event tag Tag_E1 syslog pattern ".*%CP-.-UDP.*$_port1.\$" event tag Tag_E2 syslog pattern ".*%CP-.-UDP.*$_port2.\$" event tag Tag_E3 syslog pattern ".*%CP-.-UDP.*$_port3.\$" trigger occurs 1 period 15 correlate event Tag_E1 and event Tag_E2 and event Tag_E3 action 1.0 puts "$_syslog_msg"
I'm running into two problems with this.
First, the script works, but the variables aren't preserved in the event tags. They are processed when the applet is configured, but the running configuration shows the absolute values and changes to the event manager environment variables do not get reflected in the applet. This may be a design limitation and I can live with that if this is the case, but it would be good to know.
Second, once the applet is triggered, I need to check the results of each of the events to be sure that they were triggered by the same source. Unfortunately, the $_syslog_msg variable will only report the last pattern. Is there a way to get the $_syslog_msg from all three?
Input is appreciated.
Solved! Go to Solution.
04-08-2016 07:13 AM
For #1, you will need to use Tcl to preserve the variability.
For #2, use "action X info type event reqinfo tag TAG" to load the variables with the specified tag.
04-08-2016 07:13 AM
For #1, you will need to use Tcl to preserve the variability.
For #2, use "action X info type event reqinfo tag TAG" to load the variables with the specified tag.
04-08-2016 07:20 AM
Hey Joe:
I'm using an applet for proof of concept testing for the moment, so I'll try pulling the variables in that first. My current hack is to backstep through the syslog entries, which works but is beyond messy.
Once that's successful, I'll convert the lot to a TCL script. Do you have a reference for pulling the tag information into TCL variables?
Thanks for the input!
Jody
04-08-2016 09:11 AM
Take your resulting applet to http://www.marcuscom.com/convert_applet and that should give you what you want.
07-16-2016 09:35 PM
Hey Joe:
Thanks again for your help. I finally managed to gather everything I was trying to do into the following blog post and have credited you accordingly.
https://supportforums.cisco.com/blog/13072531/you-cant-try-it-if-you-dont-knock-it
I never did get around to implementing it as a TCL script, but gave reference to your converter for those who want to pursue this.
Jody
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide