Periodic log generation for syslog server

[Flash Bang]

Hi guys,

I' m trying to configure MDS switches to genrate log in particular period of time. I have tryed to walk throught event manager and also scheduler but no success. Any ideas how to achieve this goal ?

Regards

[Mark Elsen]

  - Would you want to generate ? Meaning in general  a  syslog server collects logs from the devices , these can be urgent or need to arrive on the syslog server when being generated , 

 M.

[MHM Cisco World]

Can i see eem you use ?

[Flash Bang]

So marce yeah, I know but in means of adiotional security we need this devices to log in specified period of time so except these warning and debugging logs we need something that will come allways ,no matter of situation in the network.

[Mark Elsen]

  - As other poster replies you may want to look in automated eem scripting :
                        https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-16/216091-best-practices-and-useful-scripts-for-ee.html

 M.

[Flash Bang]

Many thanks Marce but this guide is for IOS/ XE and we are working with NXOS, comands in here are bit different and not all works as it is in guides.
 https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide/sm_12eem.html
E.G.:Here are timers mentioned in EEM but there is no option for that on my device.

[Flash Bang]

Actualy I just find out that with scheduler i can use job to trigger interface flap. But this is a bit invasive way of generating logs.

To describe my problem best way of log generation would be scheduler->job(send syslog) but unfortunately I m not able to do this. I m trying to generate log with EEM based on this interaface state change but no success for now too. Any Ideas ?

[MHM Cisco World]

can I see EEM you use?

[Flash Bang]

Sure here are 2 versions of my attemps.

show event manager policy internal
Name : PerrLog
Policy Type : applet
Event Specification : event syslog pattern "Interface fc1/9 is down"
Action : 1,sup:syslog msg line Log from "HOSTNAME"
Event Specification active on : Active

Name : SendHello
Policy Type : applet
Event Specification : event syslog pattern "Interface fc1/9 is down"
Action : 1,sup:syslog priority informational msg line Periodical Hello msg from "HOSTNAME"
Event Specification active on : Active

[MHM Cisco World]

please I want the commend you use 
thanks 

[Flash Bang]

Here it is, exmaple 1

(config)# event manager applet PerrLog

(config-applet)# event syslog pattern "Interface fc1/9 is down"

(config-applet)# action 1 syslog msg line Log from "Hostname"

[MHM Cisco World]

(config-applet)# event syslog pattern "Interface fc1/9 is down"

event syslog pattern "Interface fastethernet1/9.* down" <<- check this 

[Flash Bang]

Hello, it has been a while. Your point was no good because it is fiber channel interface and log sounds exactly like  posted before. but I have achieved my goal by interface flap so the log is generated when it goes down.

Also I have to mention that it is best to create loopback interface for this operation.

Many thanks for your replies.

Regards Flash
SAN# sh scheduler schedule
Schedule Name : PerrLog
-----------------------------
User Name : schedulerU
Schedule Type : Run every 0 Days 23 Hrs 0 Mins
Start Time : Tue Jul 25 16:33:36 2023
Last Execution Time : Thu Aug 10 00:33:42 2023
Last Completion Time: Thu Aug 10 00:33:44 2023
Execution count : 17
-----------------------------------------------
Job Name Last Execution Status
-----------------------------------------------
IntFlap Success (0)
==============================================================================
SAN#
SAN#
SAN# sh scheduler job
Job Name: IntFlap
-----------------
configure terminal
interface fc1/9
no shutdown
sleep 1
shutdow

[fmacias.duarte]

Hello, where you able to figure this out? I'm also trying to generate a keepalive syslog message every 10 min. on a Nexus switch with no luck.

I'd really appreciate your help.

Thanks!

[Flash Bang]

Hello, yes in the end I did This is config i have applied, I elaborated a little bit and find out that:
User is needed with valid credentials for this script and that if configure terminal is applied as command log is already being generated therefore no interface flap is needed.
Also for other Nexus switches there m8 be a problem with login via TACCACS auth and you would need to some changes on the base system(if u use multiple VDC). but for MDS not applicable.
cisco MDS 9396T
system: version 9.4(1a)

This is config applied:

scheduler job name Flap
configure terminal
sleep 1

end-job

scheduler schedule name Flap_daily
job name Flap
time daily 01:00

SAN# sh scheduler schedule
Schedule Name : Flap_daily
--------------------------------
User Name : app-scheduler
Schedule Type : Run every day at 1 Hrs 0 Mins
Last Execution Time : Wed Sep 24 10:00:00 2025
Last Completion Time: Wed Sep 24 10:00:01 2025
Execution count : 667
-----------------------------------------------
Job Name Last Execution Status
-----------------------------------------------
Flap Success (0)
==============================================================================

Also you will be maybe more successful with this than me.

this should work for 10min repeated log...
event manager applet periodic-log
event timer watchdog time 600
action 1.0 syslog msg "Periodic log message from device"