EEM Set Syslog message to variables

[TobiasF]

Hey everyone, 

I need to get the IP Address and The Hostname into 2 different variables. 
I've got something like this: 

event manager applet AddHostnameToIPHost
event syslog pattern "DHCPD: Updating 'PTR' RR (.*) -> '(.*).tobi.local.'"
action 1.0 syslog msg "Match1 is $match1"
action 1.1 syslog msg "Match2 is $match2"
etc(...)

The Message i've taken it from is: 
DHCPD: Updating 'PTR' RR 10.0.0.151 -> 'WINTOBIASTEST.tobi.local.'

The IP-Address and Hostname is what i need.. But without any sucess.
Can you maybe help me?

[Dan Frey · Accepted solution]

EEM should look like this example.  When the data is parsed out what do you want to do with it?

event manager applet AddHostnameToIPHost
 event syslog pattern "DHCPD: Updating 'PTR' RR (.*) -> '(.*).tobi.local.'"
 action 010 regexp "DHCPD: Updating 'PTR' RR ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+) -> '([A-Z]+)" "$_syslog_msg" match IP HOST
 action 020 syslog msg "ip = $IP and host = $HOST"

 test

INTERNET#send log DHCPD: Updating 'PTR' RR 10.0.0.151 -> 'WINTOBIASTEST.tobi.local.'
INTERNET#
*May  6 19:36:46.405: %SYS-7-USERLOG_DEBUG: Message from tty0(user id: dafrey): DHCPD: Updating 'PTR' RR 10.0.0.151 -> 'WINTOBIASTEST.tobi.local.'
INTERNET#
*May  6 19:36:46.425: %HA_EM-6-LOG: AddHostnameToIPHost: ip = 10.0.0.151 and host = WINTOBIASTEST
INTERNET#

[alex.f.]

Hi Dan,

Hi Tobias,

my regex skills are a little bit rusty, but could it do this to find the IP address as well?

\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}

 and to get all kind of Hostname I would do this

-> ([A-Za-z0-9\-_]+)

[TobiasF]

Hey Dan, 

thanks for your response. I am looking foward to take those variables and put them into a static iphost entry, everytime a new Device gets an IP over DHCP, and delete an entry when a device is releasing an IP.
We dont have a DNS Server in this Network, and are not looking to implement one. The client devices need to communicate over hostnames with each other. I will try your idea a share the answer as soon as i get to it. Thanks.