EEM Applet using action msg $_syslog_msg

[kstamandk]

Does anyone have a working sample of an applet using  action msg $_syslog_msg in an EEM Applet, where the syslog message produced comes out in a single line?

I'm running IOS 12.4(24)T5 on an 1841 using the applet shown below and it produces 2 lines of output instead of the desired 1.

event manager applet Quiet-Mode-Console

event syslog occurs 1 pattern "LOGIN-3-TOOMANY_AUTHFAILS"

action 1.0 syslog msg "CIPD-CL - Console Login Failures: $_syslog_msg"

The above produces the following

*Jun 29 21:11:53 edt: %HA_EM-6-LOG: Quiet-Mode-Console: CIPD-CL - Console Login Failures:

*Jun 29 21:11:53 edt: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: stamandk] [Source: 0.0.0.0] [localport: 0] [Reason: Login Authentication Failed] at 21:11:53 edt Wed Jun 29 2011

[jepalmer]

It is probability a \n causing that. If you use TCL you can remove those. Not sure if it's possible to do that with an applet. Are you trying to replace the original message? If so that may be better suited to ESM. My understanding that EEM 4.0 will be able to replace ESM but I don't believe it's out yet.

Sent from Cisco Technical Support iPad App

[kstamandk]

Problem solved - the syslog message only appears on a single line if I APPEND the string as opposed to PREFIX.

action 1.0 syslog msg "Console Login Failures: $_syslog_msg - CIPD-CL"