07-10-2011 03:05 AM - edited 02-21-2020 04:24 AM
Does anyone have a working sample of an applet using action msg $_syslog_msg in an EEM Applet, where the syslog message produced comes out in a single line?
I'm running IOS 12.4(24)T5 on an 1841 using the applet shown below and it produces 2 lines of output instead of the desired 1.
event manager applet Quiet-Mode-Console
event syslog occurs 1 pattern "LOGIN-3-TOOMANY_AUTHFAILS"
action 1.0 syslog msg "CIPD-CL - Console Login Failures: $_syslog_msg"
The above produces the following
*Jun 29 21:11:53 edt: %HA_EM-6-LOG: Quiet-Mode-Console: CIPD-CL - Console Login Failures:
*Jun 29 21:11:53 edt: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: stamandk] [Source: 0.0.0.0] [localport: 0] [Reason: Login Authentication Failed] at 21:11:53 edt Wed Jun 29 2011
07-21-2011 06:30 AM
It is probability a \n causing that. If you use TCL you can remove those. Not sure if it's possible to do that with an applet. Are you trying to replace the original message? If so that may be better suited to ESM. My understanding that EEM 4.0 will be able to replace ESM but I don't believe it's out yet.
Sent from Cisco Technical Support iPad App
08-12-2011 01:59 PM
Problem solved - the syslog message only appears on a single line if I APPEND the string as opposed to PREFIX.
action 1.0 syslog msg "Console Login Failures: $_syslog_msg - CIPD-CL"
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide