cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
524
Views
3
Helpful
3
Replies

Build-in variable for cli events in EEM

mario.jost
Level 3
Level 3

If i create an event manager applet to capture logs, i can work with a variable called $_syslog_msg. Example:

event manager applet RUNATEVERYLOG
event syslog pattern "Configured programmatically" maxrun 4
action 1.0 cli command "enable"
action 2.0 puts "we will send the log $_syslog_msg"

 So i can work with the full log entry and not just the part that was responsible for triggering the event manager applet. I am looking for a way to do the same with cli events. So basically i have this:

event manager applet FILTERCMD
  event cli pattern "^interface GigabitEthernet1/0/[0-9]+$" sync yes
  action 001 cli command "enable"
  action 002 cli command "tclsh flash:/filtercmd.tcl $_cli_cmd"

I used a placeholder variable called $_cli_cmd. This does not actually work, but should bring out the point of what i am actually trying to achieve. So basically, i am looking for the correct variable for $_cli_cmd.

Does anyone have this? i couldnt find anything in the EEM documentation from Cisco.

1 Accepted Solution

Accepted Solutions

Dan Frey
Cisco Employee
Cisco Employee
INTERNET#show event manager detector cli detailed | b Applet
	Applet Configuration Syntax: 
	[ no ] event [tag <tag-val>] cli 
		 pattern <pattern-val> 
		 [enter] [questionmark] [tab] 
 		 sync {yes | no}
		 skip {yes | no}
		 verifyprc {yes | no}
		 [occurs <occurs-val>]
		 [period <sec.msec>]
		 [default <sec.msec>]
		 [mode <parser mode val>]
		 [maxrun <sec.msec>]
		 [ratelimit <sec.msec>]

	Applet Built-in Environment Variables: 
	$_event_id
	$_job_id
	$_event_type
	$_event_type_string
	$_event_pub_time
	$_event_pub_sec
	$_event_pub_msec
	$_event_severity
        $_cli_msg 
	$_cli_msg_count 
	$_cli_line 
	$_cli_key 
	$_cli_tty 
	$_cli_username 
	$_cli_host 
	$_cli_privilege 
	$_cli_error_code
	$_cli_mode_context

INTERNET#

View solution in original post

3 Replies 3

balaji.bandi
Hall of Fame
Hall of Fame

Not sure what is the use case here can you explain more about syslog pattern and eventually you sending logs to syslog.

why not configure syslog send logs to syslog server, rather use EEM

or am i missing the view you looking to achieve ?

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Dan Frey
Cisco Employee
Cisco Employee
INTERNET#show event manager detector cli detailed | b Applet
	Applet Configuration Syntax: 
	[ no ] event [tag <tag-val>] cli 
		 pattern <pattern-val> 
		 [enter] [questionmark] [tab] 
 		 sync {yes | no}
		 skip {yes | no}
		 verifyprc {yes | no}
		 [occurs <occurs-val>]
		 [period <sec.msec>]
		 [default <sec.msec>]
		 [mode <parser mode val>]
		 [maxrun <sec.msec>]
		 [ratelimit <sec.msec>]

	Applet Built-in Environment Variables: 
	$_event_id
	$_job_id
	$_event_type
	$_event_type_string
	$_event_pub_time
	$_event_pub_sec
	$_event_pub_msec
	$_event_severity
        $_cli_msg 
	$_cli_msg_count 
	$_cli_line 
	$_cli_key 
	$_cli_tty 
	$_cli_username 
	$_cli_host 
	$_cli_privilege 
	$_cli_error_code
	$_cli_mode_context

INTERNET#

Thank you very much Dan, you just saved my day. Not only did you post the correct name of the variable (darn i was so close) but you also showed the command with which we can get all possible variables from certain eem applets. I just tested this and it works. Great job m8.

Review Cisco Networking for a $25 gift card