on 06-03-2012 03:23 PM
Many of the EEM applet actions set some built-in variable to indicate their success status or store some result data. Unfortunately, these variables are not well documented...until now. Below is a list of actions and the variables that they instantiate (along with a brief description of what each variable contains).
EEM Action | Variable Name | Description | |||
---|---|---|---|---|---|
action add | $_result | Stores the sum of the previous addition operation | |||
action cli | $_cli_result | Contains the output from the lastCLI command executed. It will be overwritten each time "action cli" is invoked | |||
action counter | $_counter_value_remain | Stores the current value of a counter after the inc, dec, set, or nop operation has been performed | |||
action divide | $_result, $_remainder | Stores the quotient and remainder respectively of the previous division operation | |||
action handle-error | $_error | If the handle-error action is "ignore" then any error will be stored in the $_error variable. This error will be a string value. A healthy result is always "FH_EOK". | |||
action info type cli frequency | $_info_cli_freq_num_entries, $_info_cli_freq_pattern_[1 - N], $_info_cli_freq_time_sec_[1 - N], $_info_cli_freq_time_msec_[1 - N], $_info_cli_freq_match_count_[1 - N], $_info_cli_freq_raise_count_[1 - N], $_info_cli_freq_sync_[1 - N], $_info_cli_freq_skip_[1 - N], $_info_cli_freq_occurs_[1 - N], $_info_cli_freq_period_sec_[1 - N], $_info_cli_freq_period_msec_[1 - N] | Display frequency information about the last N number of CLI commands executed | |||
action info type cli history | $_info_cli_hist_num_entries, $_info_cli_hist_cmd_[1 - N], $_info_cli_hist_time_sec_[1 - N], $_info_cli_hist_time_msec_[1 - N] | Display details about the last N number of CLI commands executed | |||
action info type event | Sets the event detector specific variables | See "show event manager detector DETECTOR detail" depending on the event tag passed to "info type event". | |||
action info type interface-names | $_info_interface_names | The list of interfaces on the device corresponding to any filters passed to the action | |||
action info type routername | $_info_routername | This action retrieves the hostname of the current device. | |||
action info type snmp getid | $_info_snmp_sysdescr_oid, $_info_snmp_sysdescr_value, $_info_snmp_sysobjectid_oid, $_info_snmp_sysobjectid_value, $_info_snmp_sysuptime_oid, $_info_snmp_sysuptime_value, $_info_snmp_syscontact_oid, $_info_snmp_syscontact_value, $_info_snmp_sysname_oid, $_info_snmp_sysname_value, $_info_snmp_syslocation_oid, $_info_snmp_syslocation_value | This action sets a number of variables that provide an equivalent to the SNMP system branch of the SNMP MIB. | |||
action info type snmp oid | $_info_snmp_oid, $_info_snmp_value | The OID and the value of the result of an SNMP GET, GETNEXT, or SET operation. | |||
action info type syslog frequency | $_info_syslog_freq_num_entries, $_info_syslog_freq_pattern_[1 - N], $_info_syslog_freq_time_sec_[1 - N], $_info_syslog_freq_time_msec_[1 - N], $_info_syslog_freq_match_count_[1 - N], $_info_syslog_freq_raise_count_[1 - N], $_info_syslog_freq_occurs_[1 - N], $_info_syslog_freq_period_sec_[1 - N], $_info_syslog_freq_period_msec_[1 - N] | Display frequency information about the last N number of syslog messages generated | |||
action info type syslog history | $_info_syslog_hist_num_entries, $_info_syslog_hist_msg_[1 - N], $_info_syslog_hist_time_sec_[1 - N], $_info_syslog_hist_time_msec_[1 - N] | Display details about the last N number of syslog messages generated | |||
action multiply | $_result | The product of the last multiplication operation | |||
| $_regexp_result | A boolean value that indicates whether the regular expression matched. It the match was successful, the value will be '1', else it will be '0'. | |||
action string | $_string_result | For the string command "match" the result will be '1' if the string matches the substring or '0' otherwise. For all other string commands, $_string_result will hold the result of the string operation | |||
action subtract | $_result | The difference of the last subtraction operation | |||
action track | $_track_state | The state of the tracked object being set or read |
Fantastic information....thanks!!
Mike
Wonderfull thanks
Its make my life easy
I add two variable and find where it store the result
Thanks once again
Great page, any idea what the "action variable" for 'action decrement' is?
The increment, decrement, set, and append actions do not actually use a built-in result variable. You pass the variable name to the actions, and the variable is mutated. For example:
action 1.0 set var 1
action 2.0 decrement var
action 3.0 puts $var
The value of 0 will be printed.
Great info. I've been looking for this data for a couple of hours and finally found it in a very nice way here. Thanks!
Adrian
Is there same document for NX-OS EEM? There are variables too, but use another syntax.
For NX-OS 7.x with the new programmatic applet support, these variables are the same where the same actions exist. For example, _cli_result is the same.
In order to find the per-event detector variables for NX-OS, use the "show event manager event-types" command. The field marked "Event Parameters" lists the variables. For example, for the CLI event, the $command variable will give you the command that was run.
Our version is 7.0(5)N1(1), but _cli_result variable does not work:
SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $_cli_result
^
% Invalid command at '^' marker.
Also I tried to view which variables are supported:
show event manager event-types
Name : cli
Description : EEM CLI command filter
Event Parameters : command
Publisher : CLI events publisher
Default Action :
Well, $command should work, but it does not:
SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $command
^
% Invalid command at '^' marker.
I've found on some examples that variable format should be $(VARIABLE), but the only thing that works, and works strange is a timestamp:
SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $(TIMESTAMP)
SD2-5-7-20-L3SW-160(config-applet)# sh run eem
event manager applet EMA-CLI-cmds
action 1.0 syslog msg 2017-08-03-16.36.20
So it translates to real value immediately after entering action command.
This works in 7.3. I believe in 7.0 you couldn't begin the message with a variable. Try:
action 1.0 syslog msg Command : $_cli_result
Now command is accepted, but not syslogged, even more, without variable also does not work:
event manager applet EMA-CLI-cmds
event cli match "*"
action 1.0 event-default
action 2.0 syslog msg AKHTUNG
Produces only this in log:
2017 Aug 4 08:51:22 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29366
2017 Aug 4 08:51:23 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29398
2017 Aug 4 08:51:23 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29377
2017 Aug 4 08:51:24 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29396
2017 Aug 4 08:51:24 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29379
Seems like cosmetic bug :(
We opened a case in TAC and th response is as follows:
We had a discussion with our engineering regarding this behaviour of EEM. Using EEM on the Nexus, we can only execute commands that are not “session dependent / interactive ssh”. The “show cli history” that we want to run using the EEM will always return an empty string because the event manager initiates a new vsh session and the output of this command for a new session is always null.
The only feasible option we have right now is to configure a scheduler at the beginning of the day and capture the “show accounting log” for the previous day, then push it to the syslog using the EEM. There are multiple filters we can have to achieve a clean result –
“show accounting log” – All the configuration changes done by any user.
“show accounting log all” – All the CLI executed by any user including show commands
“show accounting log all | in update” – Clears all clutter and shows up only relevant things
This output can be filtered by the day and sent to syslog. And this seems to be the only feasible option at this point on the Nexus platform. Let me know how you would like to proceed further.
So, currently there is no way to make NX-OS replicate entered commands to syslog in real-time, only on sheduled basis. And I think this is still a bug, since "..the event manager initiates a new vsh session and the output of this command for a new session is always null"and actually after applying configs of EEM from previous messages we got 100% CPU load on our Nexus box and hundreds of VSH pocesses that lived forever until we killed them using debug plugin via Linux shell.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: