EEM Log Issue

[afradalil]

I have EEM applet scripts configured to apply some commands to help with failover scenarios in the network, my concern is the logs that generated continuously informing about the actions. Based on the configuration EEM applet is monitoring the interface using the following:

"event tag 1 interface name GigabitEthernet0/0/3 parameter rxload entry-op gt entry-val 2 entry-type value poll-interval 30"

And as a result all the log show the actions applied every 30 seconds and that provide a misleading information that the actions are continuously applied to the router every 30 seconds.

Have anyone get the same issue or is it the way I have the applet configured? Please let me know if you experienced this behavior and how did you resolve it?

Additional comment, is that the EEM applet work fine except for it seems like it continues adding the configuration over and over while the trigger (threshold) is met.

[Georg Pauwen]

Hello,

post the full EEM script including the configured actions...

[afradalil]

event manager applet Interface_Intersite_No-Traffic
description event tag 1 interface name GigabitEthernet0/0/3 parameter rxload entry-op lt entry-val 2 entry-type value poll-interval 30
event tag 1 interface name GigabitEthernet0/0/3 parameter rxload entry-op lt entry-val 2 entry-type value poll-interval 30
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "ip msdp sa-filter in x.x.x.x list MSDP-Name"
action 1.3 cli command "int Gi0/0/0"
action 1.4 cli command "ip multicast boundary EEM_Deny_Multicast_IN in"
action 1.5 cli command "clear ip mroute 229.99.24.0"
action 1.6 cli command "end"
action 1.7 cli command "wr"
event manager applet Interface_Intersite-Traffic_Back
description event tag 1 interface name GigabitEthernet0/0/3 parameter rxload entry-op gt entry-val 2 entry-type value poll-interval 30
event tag 1 interface name GigabitEthernet0/0/3 parameter rxload entry-op gt entry-val 2 entry-type value poll-interval 30
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "no ip msdp sa-filter in x.x.x.x list MSDP-Name"
action 1.3 cli command "int Gi0/0/0"
action 1.4 cli command "no ip multicast boundary EEM_Deny_Multicast_IN in"
action 1.5 cli command "clear ip mroute 229.99.24.0"
action 1.6 cli command "end"
action 1.7 cli command "wr"

*************************************************

The following is sample of the log that keep recurring every 30 seconds, even after the action were applied after the trigger and when the threshold met:

828495: *Mar 27 14:31:04: %SYS-5-CONFIG_I: Configured from console by on vty1 (EEM:Interface_Intersite-Traffic_Back)
828496: *Mar 27 14:31:33: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable
828497: *Mar 27 14:31:33: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:no ip msdp sa-filter in x.x.x.x
828498: *Mar 27 14:31:34: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:interface GigabitEthernet0/0/0
828499: *Mar 27 14:31:34: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:no ip multicast boundary EEM_Deny_Multicast_IN in
828500: *Mar 27 14:31:34: %SYS-5-CONFIG_I: Configured from console by on vty1 (EEM:Interface_Intersite-Traffic_Back)

[afradalil]

Georg,
Did you get a chance to look at the configuration?

[Georg Pauwen]

Hello,

sorry for the delay, I'll have a look...

[Georg Pauwen]

Hello,

try and configure the below, and check if that stops the logging:

R3#conf t
R3(config)#archive
R3(config-archive)#log config
R3(config-archive-log-cfg)#no notify syslog

[afradalil]

Georg

Thank you so much, the commands you provided did work to make the detailed actions go away but I still see the following:

846329: *Mar 28 14:55:20: %SYS-5-CONFIG_I: Configured from console by on vty1 (EEM:Interface_Intersite-Traffic_Back)
846330: *Mar 28 14:55:50: %SYS-5-CONFIG_I: Configured from console by on vty1 (EEM:Interface_Intersite-Traffic_Back)

So my question is, does that mean it is not applying the configuration over and over or it just stopped the log information?

[Georg Pauwen]

Hello,

the action should (obviously)  execute only when the event parameters are matched...which is probably not every thirty seonds...

I'll do some more testing, also I'll try to find a way to get rid of the other lines...

[Georg Pauwen]

Hello,

the ''easy' way to get rid of the console messages is to lower the logging level:

logging buffered 4

logging trap 4

logging console 4

However, that might result in you missing other important messages as well.

There seems to be another way to restrict messages on a more granular level using the Embedded Syslog Manager. Not sure how much time you have, but if you want to research that yourself (you might be faster than me), here is the link:

Embedded Syslog Manager Configuration Guide, Cisco IOS Release 12.4T

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/12-4t/esm-12-4t-book/esm-syslog.html

[afradalil]

Georg,

Thank you for your time and effort.