cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Use eem scripts to monitor all commands entered at cisco routers and switches

1009
Views
0
Helpful
0
Comments
Beginner

#################################################
### Wujun Li ( liw@njit.edu )

# This script will trap all the commands entered on cisco routers and switches after you register this tcl script on the router.

# when cisco technical support login to your device for troubleshooting, you can record all the commands the tech has been entered.
###################################################

::cisco::eem::event_register_cli pattern ".*" enter maxrun 30

namespace import ::cisco::eem::*
namespace import ::cisco::lib::*

array set arr_einfo [event_reqinfo]
set myhostname [info hostname]
set timestamp [clock format [clock seconds] -format {%Y-%m-%d %H:%M:%S}]
set path ""
set clist [list {conf t} {file prompt quiet} {end} {dir | inc Directory}]
catch {cli_run $clist } result

regexp -nocase { ([A-Z,a-z,0-9])*:/} $result path
set path [ string trim $path ]

set footprintfn "footprints_$myhostname"
set fd [open $path$footprintfn "a"]
puts $fd "\[$timestamp\] $arr_einfo(line)"
close $fd
if { [regexp -inline {reload} $arr_einfo(line)] != "" } {
puts "You need to deregister eem script footprints.tcl to execute reload command"
exit 0
} elseif { [regexp -inline {exit} $arr_einfo(line)] != "" } {
set timestamp [clock format [clock seconds] -format {%Y-%m-%d-%H-%M-%S}]
set copytftp "copy $path$footprintfn tftp://yourtftpIP/"
append copytftp "${footprintfn}_$timestamp"
set clist [list {conf t} {file prompt quiet} {end} "$copytftp"]
catch {cli_run $clist } result
exit 1
} else {

exit 1
}
exit 1

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards