EEM event manager applet problem

I'm trying to create an EEM applet to log the output of a command to file every 5 minutes. The idea is to get a traffic baseline for implementing control plane policing but I want statistics from at least a whole week (not just while I'm at work). I have a 6506-E running 12.2(18)SXF17a for WLSM (WS-SVC-WLAN-1-K9) support. Initially I was trying to save the file to tftp but it turns out one cannot "| append" to a file on a tftp server. I thought about trying to increment the file name with a counter but instead I opted for this:
event manager applet controlplanelog
event timer cron name controlplanelog cron-entry "0/5 * * * *"
action 1.0 cli command "enable"
action 1.1 cli command "show policy-map control-plane | append disk1:log.txt"
This didn't seem to work because the contents of the file "disk1:log.txt" didn't change over the course of my lunch time. I thought I had the timer messed up so I changed the entry "0/5 * * * *" to "0,5,10,15,20,25,30,35,40,45,50,55 * * * *". That didn't work either so I changed the event to none and ran it manually using "event manager run" and still, the file "disk1:log.txt" contents did not change.
Am I trying to execute an unsupported command or is this an error or am I just doing it wrong? Any help would be appreciated.

That is wierd. I must have typed it in wrong somewhere....
I had already removed all eem commands since I used the numbers from the other 6500 log file. When I added them back in with the command changed to "show version" the text file was modified as expected. Even before checking the file, I noticed a difference because I had debugging on per your previous suggestion and these lines showed up in addition to the lines which previously showed up.
545685: Sep 10 15:41:24.674 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :
545686: Sep 10 15:41:24.674 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT : 6506#
545687: Sep 10 15:41:24.674 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : IN  : 6506#exit
545688: Sep 10 15:41:24.674 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : CTL : cli_close called.
At this point I reverted to the original command and it now works as expected.
For the sake of progeny, here is the debugging when not appending to a file.
545990: Sep 10 15:50:27.016 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : CTL : cli_open called.
545991: Sep 10 15:50:27.120 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :
545992: Sep 10 15:50:27.120 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT : 6506>
545993: Sep 10 15:50:27.120 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : IN  : 6506>enable
545994: Sep 10 15:50:27.132 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :
545995: Sep 10 15:50:27.132 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT : 6506#
545996: Sep 10 15:50:27.132 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : IN  : 6506#show policy-map control-plane
545997: Sep 10 15:50:27.144 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :
545998: Sep 10 15:50:27.144 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :  Control Plane Interface
545999: Sep 10 15:50:27.144 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :
546000: Sep 10 15:50:27.144 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :   Service-policy input: copp-policy
546001: Sep 10 15:50:27.144 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :
546002: Sep 10 15:50:27.144 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : OUT :   Hardware Counters:(ouput omitted)546017: Sep 10 15:50:27.148 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : CTL : 20+ lines read from cli, debug output truncated
546018: Sep 10 15:50:27.148 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : IN  : 6506#exit
546019: Sep 10 15:50:27.148 KST: %HA_EM-6-LOG: controlplanelog : DEBUG(cli_lib) : : CTL : cli_close called.
On a side note I have been pondering something unrelated to my original question but maybe you know the answer to that too. If I have NTP restricted by an access list using the "ntp access-group peer" and "ntp access-group serve" commands as well as through control plane policing, which list is processed first: Do the "ntp access-group" commands keep packets from entering the control plane that don't match the list or do they hit the control plane before being dropped by the access-list?

Similar Messages

  • Cisco embedded event manager applet

    Hi everyone,
    Can someone please confirm me if we can use cisco eem applet in ASA firewall. I know its for sure used in IOS but whta bout firewall? if yes then please help me out.
    Thanks in advance.

    i want to log-off a vpn tunnel if the VPN tunnel gets stuck. Can it be done on ASA firewall?

  • Problem with Embedded Event Manager and Object Tracking

    Hi,
    I have a 2801 running c2801-advipservicesk9-mz.124-24.T2.bin. It has the following configuration:
    track 300 list boolean or
    object 10
    object 11
    object 12
    object 13
    event manager applet clear_ipsec_tunnel
    event track 300 state down
    action 1.0 cli command "enable"
    action 2.0 cli command "clear crypto session"
    action 3.0 syslog msg "IPSec tunnel has been cleared by clear_ipsec_tunnel applet"
    My problem is that after the tracked object number 300 transitions from an up state to a down state, nothing happens. It seems like the applet doesn't work with object tracking. Here's what I see in logs:
    Dec  7 21:52:32.236 MCK: %TRACKING-5-STATE: 12 ip sla 12 reachability Up->Down
    Dec  7 21:52:37.236 MCK: %TRACKING-5-STATE: 13 ip sla 13 reachability Up->Down
    Dec  7 21:52:57.236 MCK: %TRACKING-5-STATE: 10 ip sla 10 reachability Up->Down
    Dec  7 21:53:07.236 MCK: %TRACKING-5-STATE: 11 ip sla 11 reachability Up->Down
    Dec  7 21:53:07.996 MCK: %TRACKING-5-STATE: 300 list boolean or Up->Down
    That's it. For some reason, the applet won't execute the CLI commands when the EEM applet is triggered. Am I doing something wrong or I have encountered some bug? Thanks.

    jclarke,
    Today I added the router into the tacacs server database and the applet started working just fine by using my login name. So the working configuration looks like this:
    event manager session cli username "my login name"
    event manager applet clear_ipsec_tunnel
    event track 300 state down maxrun 30
    action 1.0 cli command "enable"
    action 2.0 cli command "clear crypto session"
    action 3.0 syslog msg "IPSec tunnel has been cleared by clear_ipsec_tunnel applet"
    Then I tried to use a login name from the local database that has "privelege 15" access and of course the debug output showed me this:
    Dec  8 18:12:58.203 MCK: %TRACKING-5-STATE: 300 list boolean or Up->Down
    Dec  8 18:12:58.203 MCK: fh_track_object_changed: Track notification 300 state down
    Dec  8 18:12:58.203 MCK: fh_fd_track_event_match: track ED pubinfo enqueue rc = 0
    Dec  8 18:12:58.215 MCK: fh_send_track_fd_msg: msg_type=64
    Dec  8 18:12:58.215 MCK: fh_send_track_fd_msg: sval=0
    Dec  8 18:12:58.219 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : CTL : cli_open called.
    Dec  8 18:12:58.227 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT : Router>
    Dec  8 18:12:58.227 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : IN  : Router>enable
    Dec  8 18:12:58.747 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT : Command authorization failed.
    Dec  8 18:12:58.747 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT :
    Dec  8 18:12:58.747 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT : Router>
    Dec  8 18:12:58.747 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : IN  : Router>clear crypto session
    Dec  8 18:12:58.771 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT :                                  ^
    Dec  8 18:12:58.771 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
    Dec  8 18:12:58.771 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT :
    Dec  8 18:12:58.771 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : OUT : Router>
    Dec  8 18:12:58.775 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel: IPSec tunnel has been cleared by clear_ipsec_tunnel  applet
    Dec  8 18:12:58.775 MCK: %HA_EM-6-LOG: clear_ipsec_tunnel : DEBUG(cli_lib) : : CTL : cli_close called.
    So I guess this problem arises when you have command authorization enabled and the tacacs server is not reachable or something like that. I have tried to find a way to use the local database instead of using the aaa server but didn't succeed. Although I have found an interesting workaround. Here it is:
    Link: http://blog.ioshints.info/2007/05/command-authorization-fails-with-eem.html
    Workaround found after reading the "Executing IOS commands from Tcl shell" from the "Tclsh on Cisco IOS tutorial".
    On the above article it is mentionned that the ios_config command is executed inside the context of another VTY line (also found with the AAA debug). The workaround is to define the FIRST VTY line with "transport input none" to prevent ssh or telnet to grab it and to configure the aaa authorization without any command authorization for this line.
    Kind regards
    Christian Chautems
    Looks great, but I am not quite sure how to "configure the aaa authorization without any command authorization for this line".
    Anyway, jclarke thank you so much for taking your time to look into my problem and for your help.

  • EEM event track is not supported (version 3.2)

    Hello,
    I'm replacing a router 2911 by IE3010 (with IP service) and trying to transfer configurations across. I have noticed that on the IE3010 EEM , I can't trigger an event based on Object Tracking. 
    IE3010(config-applet)#event ?
      application         Application specific event
      cli                       CLI event
      config                Configuration policy event
      counter             Counter event
      env                 Environmental event
      gold                GOLD event
      identity            Identity event
      interface           Interface event
      ioswdsysmon         IOS WDSysMon event
      ipsla               IPSLA Event
      mat                 MAC address table event
      neighbor-discovery  Neighbor Discovery event
      nf                  NF Event
      none                Manually run policy event
      oir                 OIR event
      routing             Routing event
      rpc                 Remote Procedure Call event
      snmp                SNMP event
      snmp-notification   SNMP Notification Event
      snmp-object         SNMP object event
      syslog              Syslog event
      tag                 event tag identifier
      timer               Timer event
    I do have a track that monitors (ICMP-echo) of two IP addresses and I want to do some action when the track is down and this has been working quite well on the 2911.  I have found  in the IE3010 event detector that tracking event is not available while the same is available in the 2911
    Any advise how can I solve this problem and how can I do action based on the status of the tracked object in the IE3010 ?
    The software version of the IE3010 is as follows 
    IE3010 Software (IE3010-IPSERVICESK9-M), Version 15.0(2)SE6, RELEASE SOFTWARE (fc2). 
    Embedded Event Manager Version 3.20
    Component Versions:
    eem: (320_rel3)1.0.0
    eem-gold: (v320_rel1)1.0.0
    eem-call-home: (v320_rel1)1.0.2
    Event Detectors:
    Name                Version   Node        Type    
    application         01.00     node0/0     RP      
    identity            01.00     node0/0     RP      
    neighbor-discovery  01.00     node0/0     RP      
    mat                 01.00     node0/0     RP      
    syslog              01.00     node0/0     RP      
    routing             03.00     node0/0     RP      
    cli                 01.00     node0/0     RP      
    counter             01.00     node0/0     RP      
    interface           01.00     node0/0     RP      
    ioswdsysmon         01.00     node0/0     RP      
    none                01.00     node0/0     RP      
    oir                 01.00     node0/0     RP      
    snmp                01.00     node0/0     RP      
    timer               01.00     node0/0     RP      
    snmp-object         01.00     node0/0     RP      
    snmp-notification   01.00     node0/0     RP      
    ipsla               01.00     node0/0     RP      
    nf                  01.00     node0/0     RP      
    test                01.00     node0/0     RP      
    config              01.00     node0/0     RP      
    env                 01.00     node0/0     RP      
    gold                01.00     node0/0     RP      
    rpc                 01.00     node0/0     RP     

    I need to track if an IP is up with ICMP,  Source IP: 192.168.249.1 Dest IP: 192.168.249.2 on port FastEthernet fa0/19
    I do not understand how the weights work here with the UP or Down Status can you please explain. I modified your commands a bit and this is what I got, can you let me know if I am on the right path:
    track 10 ip sla 10
     delay down 10
    track 19 list threshold weight
     object 10 weight 70
     threshold weight down 30 up 70
    authentication mac-move permit
    ip sla 10
     icmp-echo 10.13.249.2 source-ip 10.13.249.1
     timeout 300
     frequency 5
    ip sla schedule 10 life forever start-time now
    ip sla enable reaction-alerts
    event manager applet Remote_Site_Up
     event syslog pattern "TRACKING-5-STATE: 19 list threshold weight Down->Up"
     action 1.0 cli command "enable"
     action 2.0 cli command "config t"
     action 3.0 cli command "interface FastEthernet0/19"
     action 4.0 cli command "no shut"
     action 5.0 cli command "end"
    event manager applet Remote_Site_Down
     event syslog pattern "TRACKING-5-STATE: 19 list threshold weight Up->Down"
     action 1.0 cli command "enable"
     action 2.0 cli command "config t"
     action 3.0 cli command "interface FastEthernet0/19"
     action 4.0 cli command "shut"
     action 5.0 cli command "end"
    This is the status with the show track command:
    Track 10
      IP SLA 10 state
      State is Up
        1 change, last change 00:29:35
      Delay down 10 secs
      Latest operation return code: OK
      Latest RTT (millisecs) 1
    Track 19
      List threshold weight
      Threshold Weight is Up (70/70)
        2 changes, last change 00:29:34
        object 10 weight 70 Up (70/70)
      Threshold weight down 30 up 70

  • Cisco Embedded Event Manager Issue

    Hello Experts,
    I have taken the following sample EEM from
    https://learningnetwork.cisco.com/blogs/network-sheriff/2009/06/19/writing-your-first-eem-applet
    The intention is to send a notification to an email address about a network problem. I have modified it bit for illustrative purposes. You will see that there are various show commands.
    Can someone please show me how to email the show commands instead just appending them to the directory called "server_unreachable"?
    TechWiseTV4506(config)#eve
    nt manager environment _email_server 172.16.1.44 (<-my Post Cast server)
    TechWiseTV4506(config)#event manager environment _email_to [email protected]
    TechWiseTV4506(config)#event manager environment _email_from [email protected]
    event manager applet email_server_unreachable
    event track 10 state down
    action 1.0 syslog msg "Houston we have a problem. Ping failed, server unreachable!"
    action 1.1 cli command "enable"
    action 1.2 cli command "del /force flash:server_unreachable"
    action 1.3 cli command "show clock | append server_unreachable"
    action 1.4 cli command "show ip arp 172.16.1.55 | append server_unreachable"
    action 1.5 cli command "show ip route 172.16.1.55 | append server_unreachable"
    action 1.6 cli command "show interface FastEthernet0/1/1 | append server_unreachable"
    action 1.7 cli command "more flash:server_unreachable"
    action 1.8 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Server Unreachable: ICMP-Echos Failed" body "$_cli_result
    action 1.9 syslog msg "Server unreachable alert has been sent to email server!"
    Cheers
    Carlton

    This applet will actually email the results.  However, in order to get all of the output together, it uses the server_unreachable file as an accumulator buffer.  That file could be deleted as action 2.0:
    action 2.0 cli command "delete /force flash:server_unreachable"
    But that is already there in action 1.2, so it's not really needed.
    What will happen is the applet will more the file to collect all of the output.  That aggregated output will be stored in the $_cli_result variable.  The result is that the body of your email will contain the consolidated command output.

  • Embeded Event Manager on cisco 3560 switch

    Can someone help me please? I have EEM configured on cisco 3560 switch. The configuration is below. I want that switch inform me through email when device with particilular IP address become unavailable. For some reason this configuration is not good and I can't tell why. I already try to debug this with debug event manager action mail but didn't see any output .
    ip sla 11
    icmp-echo ip address
    frequency 20
    ip sla schedule 11 life forever start-time now
    event manager applet device-TEST
    event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.11 get-type exact entry-op lt entry-val "2" poll-interval 20
    trigger occurs 5 period 120
    action 02.0 mail server "ip address" to "[email protected]" from "[email protected]" subject "device is down"

    The mail part looks good, I'm not sure you are hitting the trigger right.
    Why not do a track on the ip sla instead of the snmp stuff?
    Here's a good example of that.
    https://learningnetwork.cisco.com/blogs/network-sheriff/2009/06/19/writing-your-first-eem-applet

  • Event manager script not working as expected

    On a Cisco 4900M running Version 12.2(53)SG1, trying to capture certain information requested by Cisco TAC to troubleshoot periodic high cpu usage on the device causing it to momentarily not respond to HSRP packets from the HSRP partner.
    This is the script in place today:
    event manager applet capture_cpu_spike
    event snmp oid 1.3.6.1.4.1.9.2.1.56 get-type next entry-op ge entry-val "80" exit-time 10 poll-interval 1
    action 1.0 syslog msg "CPU Utilization is high"
    action 2.0 cli command "en"
    action 3.0 cli command "show proc cpu sort | redirect bootflash:cpuinfo1.txt"
    action 3.1 cli command "show int summ | redirect bootflash:cpuinfo2.txt"
    action 3.2 cli command "show proc cpu sort | redirect bootflash:cpuinfo3.txt"
    action 3.3 cli command "show int summ | redirect bootflash:cpuinfo4.txt"
    action 3.4 cli command "show platform cpu packet statistics | redirect bootflash:cpuinfo5.txt"
    action 3.5 cli command "show platform health | redirect bootflash:cpuinfo6.txt"
    action 4.0 cli command "end"
    Problem is, when the cpu does spike, only action 3.1 is executed.
    How do I modify this script to run all the commands listed?
    TIA
    dom

    Let me first explain why your script is not working for you.
    Basically, the problem you encounter is a result of a common misconception about copyin(). It is intended to be used to copy content of userspace memory into a scratch buffer so that it can be accessed directly from within kernel space (where the DTrace core executes). That said, it is often interpreted as somehow being equivalent to malloc() whereas in reality it actually works like alloca() instead. So, what you are seeing is basically the artefact of the scratch buffer being overwritten with other data. And unfortunately, that is perfectly legal.
    The content of the scratch buffer pointed to by self->addr in your script is only valid for as long as the specific probe enabling is executing (it is clause-local). So, your clauses to print out the actual bytes in the buffer are looking at a buffer that is for all intends and purposes no longer reserved, and therefore you are looking at it after other data was written to the scratch space.
    So... in order for this to work, you should do things a bit different. Rather than trying to get a copy of the buffer in one clause, and then read from it in following clauses, you can simply collect the buffer address in the entry read:entry clause, get the number of bytes read in the first read:return clause, and then for every clause in which you print 4 bytes do the following (example for bytes 4-7):
    syscall::read:return
    /execname == "foobar" && self->nbytes > 4/
    this->addr = (char *)copyin((uintptr_t)self->bufferaddr + 4, 4);
    printf(" 4- 7: %02x %02x %02x %02x\n", this->addr[0], this->addr[1], this->addr[2], this->addr[3]);
    So basically, for every clause that print 4 bytes you copyin those bytes, and then print them out.

  • Changing port configuration with Event Manager

    Hello,
    I'm trying to change the configuration of a port when the port goes down with EEM.
    So when an flex connect access-point is disconnected the port becomes an access-port.
    I don't want to use the MAC address.
    Does anyone has experience with this.
    Below is the applet I'm using.
    Thanks in advanced, 
    Michel
    event manager applet CONFIG-ACCESS-PORT
     event neighbor-discovery interface regexp "(FastEthernet[0-9]\/[0-9]+)" cdp delete
     action 100 regexp "(AIR-LAP)" "$_nd_cdp_platform" value
     action 110 if $_regexp_result eq "1"
     action 200 cli command "enable"
     action 210 cli command "config t"
     action 220 cli command "interface $_nd_local_intf_name"
     action 240 cli command "switchport mode access"
     action 250 cli command "switchport access vlan 20"
     action 260 cli command "no switchport trunk encapsulation dot1q"
     action 270 cli command "no switchport trunk native vlan 88"
     action 280 cli command "no switchport trunk allowed vlan 88,100"
     action 290 cli command "spanning-tree portfast"
     action 400 syslog msg "EXECUTED EEM APPLET FOR ACCESS-PORT interface $_nd_local_intf_name"
     action 500 cli command "end"
     action 510 cli command "copy run start"

    Hi Evan,
    For sure! There is a really good example on the configuration guide, and assciated caveats.
    http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/consolidated/b_cg74_CONSOLIDATED_chapter_0100011.html
    Benefits for using LAG is increased bandwidth, and redundancy - especially if you have the two (or more in the case of a 5508 WLC) ports connected to different physical switches, eg a 3750 stack.
    Best,
    Evan

  • Embedded Event Manager - SNMP - run TCL script

    I would like to run a tcl script on a router using snmp. I understand Embedded Event Manager can do this but haven't found what I need to run that.  Can someone point me in the right direction?

    Yeah, you could do this, but it depends on your version of IOS.  You will need EEM 3.1 or higher (15.0) to be able to intercept SNMP GET requests.  Then, you could do something like:
    event manager applet snmp-trigger event snmp-object oid 1.9.9.9.9 type gauge sync yes istable no action 1.0 policy my_tcl_policy.tcl action 2.0 snmp-object-value event-id _event_id gauge 0 next-oid 1.9.9.9.9.0 action 3.0 exit 1!snmp-server manager
    Then, when you query 1.9.9.9.9.0 on the device, the Tcl policy "my_tcl_policy.tcl" should execute, and the snmp-trigger applet policy will return a value of 0.
    Please support CSC Helps Haiti
    https://supportforums.cisco.com/docs/DOC-8895
    https://supportforums.cisco.com

  • EEM Event Track Question

    Hi Experts,
    I have the below EEM configured.
    No.  Class   Type    Event Type          Trap  Time Registered           Name
    1    applet  user    track               Off   Mon Sep 8 20:33:19 2014   test
     track 1 state down
     maxrun 10.000
     action 1.0 snmp-trap strdata "TRACK 1 DoWN DETECTED"
    My question is:
    - Do I need to set the applet to: event manager applet test trap?  Do I need this so the trap action would work?
    - When the tracked object goes down, will the EEM app continue to generate traps during certain intervals until the tracked object is down?  Or will it generate only one trap on the first occurrence the object goes down?
    Thanks in advance.

    1. No.  Just make sure "snmp-server enable traps event-manager" is configured.
    2. It will only generate the trap when the object first goes down.  It will not generate the trap again until the object comes back up and goes down again.

  • Monitoring PRI using Embedded Event Manager

    Hi,
    I am trying to use Embedded Event Manager to flag  when calls on a pri get above
    28 but its not working.  I found an OID which shows number of calls currently on
    the B Channels of a pri.  I dropped the threshold to two just to check it was
    functioning correctly.  Config below:
    event manager applet bchan-mon
    event snmp oid 1.3.6.1.4.1.9.10.19.1.1.11 get-type exact entry-op gt entry-val
    2 poll-interval 60
    action exceeded syslog priority critical msg "All Chanels in Use"
    I have done a debug and it says the OID is not found even though if i do a show
    snmp mib i see the OID.  Output below:
    Feb  9 08:35:58.097: fh_process_async: re=445EF694, timer_type=POLL
    Feb  9 08:35:58.097: snmp_entry_value_check: OID unavailable, value check
    skipped
    Feb  9 08:35:58.097: snmp_entry_value_check:Returning FALSE
    Feb  9 08:35:58.097: fh_process_async: update_t=0cron_tick: num_matches 0
    Has anyone successfullly used EEM to do this?
    Any help appreciated.
    Thanks
    Kev

    Hi Joe,
    I get this from an snmp walk:
    rh019654@c_nnm_u > snmpwalk lr2196 1.3.6.1.4.1.9.10.19.1.1.11
    cisco.ciscoExperiment.19.1.1.11.0 : Unsigned32: 0
    The device is a cisco 2851 and the IOS is C2800NM-SPSERVICESK9-M 12.4(18e).
    If i run a debug now after adding the 0 i dont get a OID error not found anymore but its still not flagging the message in the log when the amount of calls go above 2.  See below:
    Feb 10 09:43:17.774: fh_process_async: re=463448F0, timer_type=POLL
    Feb 10 09:43:17.774: snmp_value_uint_compare:op1=0 op2=2 ret=FALSE
    Feb 10 09:43:17.774: snmp_entry_value_check:Returning FALSE
    Feb 10 09:43:17.774: fh_process_async: update_t=0
    Thanks
    Kev

  • Event Manager question. Monitoring DNS entry.

    Hello everybody,
    I  want to use Cisco Embedded Event Manager in a router for monitoring a  DNS entry that normally resolves 1.1.1.1 but if it changes to 2.2.2.2 the  router has to change some access list automatically in order to permit different  routes.
    I  know how to configure de "action" sentences for change the ACLs but I  dont know how to configure a track or a SLA in order to check the DNS  entry and react if it changes.
    Someone knows how to do that?
    event manager applet ChangeRoutesWhenDNSEntryChanges
    event track 21 state ??????????????????????????????????????????????????<----------
    action 1.0 cli command "enable"
    action 2.0 cli command "configure terminal"
    action 3.0 cli command "ip access...
    Thank you in advance!!
    Marcos.

    Indeed, I just provided the above example to demonstrate how we can force a DNS lookup and parse the IP address...
    I was actually thinking about using the IP SLA DNS probe, but I could not find a way to get the IP address from the results... It just shows the response time.
    In order to make the script work, we would most likely need to use some timer to trigger it periodically.
    This is an adaptation of my previous example to actually accomplish a periodic check:
    event manager applet CHECK-DNS
    event timer watchdog time 60
    action 1.0 cli command "ena"
    action 1.1 cli command "ping host1 repeat 1 timeout 0"
    action 2.0 regexp "ICMP Echos to (.*), timeout is 0 seconds:" "$_cli_result" _match _ip
    action 3.0 if $_ip ne 1.1.1.1
    action 4.0  syslog msg "host1 is now $_ip"
    action 5.0 end
    If you want to do something as a reaction to detecting the change, that would have to go into the "4.0" block (you can use 4.1, 4.2 etc)
    Another thing to consider is that this script would run every minute, so as long as the DNS query resolves to anything but 1.1.1.1 we would re-apply the config changes, which is not that good...
    A way to solve this can be seen in the next example:
    event manager applet HOST1-NOT-1.1.1.1
    event timer watchdog time 60
    action 1.0 cli command "ena"
    action 1.1 cli command "ping host1 repeat 1 timeout 0"
    action 2.0 regexp "ICMP Echos to (.*), timeout is 0 seconds:" "$_cli_result" _match _ip
    action 2.1 track read 100
    action 3.0 if $_ip eq 1.1.1.1
    action 4.0  if $_track_state eq down
    action 4.1   track set 100 state up
    action 4.2   syslog msg "host1 is now 1.1.1.1 again"
    action 4.9  end
    action 5.0 else
    action 6.1  if $_track_state eq up
    action 6.2   track set 100 state down
    action 6.3   syslog msg "host1 is not 1.1.1.1, new ip is $_ip"
    action 6.9  end
    action 7.0 end
    Basically we are using a stub tracking object to maintain state. Track object 100 would be up if we know host1=1.1.1.1, but if we detect it is something else we change it to down. Only after we detect that host1=1.1.1.1 again we change the track object back to up, which would enabled detecting another change...
    Any actions you want to take should go into section "6" and any clean up (when host1=1.1.1.1 again) has to go into section "4".
    It is possible to make this detect any change and not just have a static 1.1.1.1 value by assigning the newly detected value to a variable and basically look for a change... Not sure what is your requirement.
    The output below shows how this works...
    Router#show run | inc ip host
    ip host host1 1.1.1.1
    Router#conf t
    Enter configuration commands, one per line.  End with CNTL/Z.
    Router(config)#ip hos
    Router(config)#ip host host1 2.2.2.2
    Router(config)#^Z
    Router#
    *Nov  9 18:23:18.009: %TRACKING-5-STATE: 100 stub   Up->Down
    *Nov  9 18:23:18.021: %HA_EM-6-LOG: HOST1-NOT-1.1.1.1: host1 is not 1.1.1.1, new ip is 2.2.2.2
    Router#
    *Nov  9 18:23:18.065: %SYS-5-CONFIG_I: Configured from console by console
    Router#
    Router#
    Router#conf t
    Enter configuration commands, one per line.  End with CNTL/Z.
    Router(config)#ip host host1 1.1.1.1
    Router(config)#^Z
    Router#
    *Nov  9 18:23:42.805: %SYS-5-CONFIG_I: Configured from console by console
    Router#
    *Nov  9 18:24:18.025: %TRACKING-5-STATE: 100 stub   Down->Up
    Router#
    *Nov  9 18:24:18.033: %HA_EM-6-LOG: HOST1-NOT-1.1.1.1: host1 is now 1.1.1.1 again

  • EEM - Event help after executio cli in the global prompt

    Router#cellular 0/0/0 cdma activate otasp *228
    Beginning OTASP activation
    OTASP number is *228.
    After execution of "cellular 0/0/0 cdma activate otasp *228" on the global prompt of the router...
    will  see output “OTASP number is *228.” Log on the console,
    Would it be possible to trigger the event after execution  cli and by seeing “OTASP number is *228” logs?.
    Also upon event execution, I want to put some delay between action cli commands, how to do this?.
    event manager applet OTAF
    event ???.
    action 2.0  syslog msg "dailing modem"
    action 2.1  cli command "enable"
    action 2.10 syslog msg "sending dtmf digit 2"
    action 2.2  cli command "start-chat script 3"
    action 2.3  syslog msg " After 30 seconds delay"
    action 2.4  cli command "start-chat tata1 3"
    action 2.5  syslog msg "sending dtmf digit 1"
    action 2.6  cli command "start-chat script1 3"
    action 2.7  syslog msg " After 6 seconds delay"
    action 2.9  cli command "start-chat tata2 3"
    Appreciate your support here..

    Hi Joseph,
              Now i am not seeing any syntax in regexp but event triggering immediately without seeing this message "
    OTASP number is *228"  after entering the cli.
    Reliance-otasp#cellular 0/0/0 cdma activate otasp *228
    *Oct 29 04:22:03.818: %HA_EM-6-LOG: OTAF: dailing modem
    *Oct 29 04:22:03.838: CHAT0/0/0: Matched chat script script to string script
    *Oct 29 04:22:03.838: CHAT0/0/0: Asserting DTR
    *Oct 29 04:22:03.838: CHAT0/0/0: Chat script script started
    *Oct 29 04:22:03.838: CHAT0/0/0: Sending string: AT!AVTONEPLAY=1,31
    *Oct 29 04:22:03.838: CHAT0/0/0: Expecting string: OK
    *Oct 29 04:22:03.886: CHAT0/0/0: Completed match for expect: OK
    *Oct 29 04:22:03.886: CHAT0/0/0: Chat script script finished, status = Success
    *Oct 29 04:22:03.946: %HA_EM-6-LOG: OTAF:  After 30 seconds delay

  • Embedded Event manager scripting help

    Hello,
    I'm looking into a way to do the following:
    If pinging of BGP peer detects packet loss, or circuit flapping, lets say 5 flaps in 60 secs, then I'd like the bgp peering to go into admin down state.
    Would be nice if it also recovered on its own when 1hour or X of stability was detected.
    Thank you

    I found a good doc and think i'll be going with this:
    IP SLA 3
       icmp-echo X.X.X.X  source-interface GIGXXXX
    IP SLA schedule  3 life forever  start-time now
    track 3 ip sla 3  reachability
    delay up XX
    event manager applet  WAN_DOWN
    event track 3 state  down
    action 1.0 syslog msg "Packet loss  or Primary WAN cct loss detected"
    action 2.0 cli command  "enable"
    action 3.0 cli command "config  t"
    action 4.0 cli command "router bgp XXXXX"
    action 5.0 cli command "neighbor X.X.X.X shut"
    action 6.0 cli command  "end"
    action 7.0 syslog msg "BGP neighbor  placed in Admin Down because of packet loss to  Peer"
    event managet applet  wan_up
    event track 3 state  up
    action 1.0 syslog msg "WAN network  restored"
    action 2.0 cli command  "enable"
    action 3.0 cli command "config  t"
    action 4.0 cli command "router bgp XXXXX"
    action 5.0 cli command "no neighbor  x.x.x.x shut"
    action 6.0 cli command  "end"
    action 7.0 syslog msg "BGP neighbor  was brought up due to sustained comm with Peer"

  • Appraisals & training and event management problem

    Hi gurus.
    I'm trying to configured the integration between Appraisal and Training & Event management (Appraising a Business Event and Attendee Appraisal
    I set an attribute HAP00 REPLA = A .
    But two problems occurred.
    1.
    The definition of Appraisal catalog for employees is no problem. But I have a problem with definition of Appraisal catalog for Business event and for Attendees.
    Through the definition of Appraisal catalog via SPRO (Training and Event Management/Recurring Activities/Appraisals/Edit Appraisals Catalog) its possible to create an appraisal templates only for employees (it looks like that, because there is only Category group Personnel Appraisals and it’s not possible to add new category for example Attendee Appraisal).
    Can somebody help me where I can define appraisal templates for Event management or how can I get the Appraisal catalog category groups - Appraising a Business Event and Attendee Appraisal?
    2.
    I set the attributes SEMIN EVAEV/EVAPA to the values 2/3 in connection with table T77BF.
    When I run tcode PV33 or PV34 the matchcode of appraisal templates contains the list of all object type VA. The problem is that when I run tcode PV33 I don’t want to see all appraisal templates, but only for appraising a Business Event.
    It is possible to configure that so? If yes, how.
    Thanks in advance.
    Regards

    Hi,
    1. transaction LSO_CATALOG
    Regards and Groetjes,
    Maurice Hagen

Maybe you are looking for

  • How to rearrange key figures for every row in a report

    Hi gurus, I need help in rearranging the key figures values( product sales for A, B, and C ) in the columns for each sales division row D1,D2,D3 displaying keyfigures in the order of descending sales volume for each division. The order of key figures

  • How to include jar file ??

    Hi, I want to use some classes from a .jar file in my application. In NT I have placed the .jar file in ....iplanet/ias6/ias/lib/java and included the path in CLASSPATH variable in .../iplanet/ias6/ias60/lib/IAB . I am facing problem in doing the sam

  • Mail - Deletion of Mail e-mails

    Trying to delete a number of e-mails using delete icon; the e-mails initally clear but on re-use find that the deleted e-mails are still present on the system. Any ideas on how to delete deleted e-mails!!!

  • Page navigation using adf-config not working

    Hi, JDeveloper : 11.1.1.17 I created a WebCenter Framework Portal application. 1. Created a new page under "oracle\webcenter\portalapp\pages" by name Page1. 2. Dragged both "home" and the new page "Page1" and dropped into the adf-config. 3. Created a

  • HT3310 Connecting new iPhone 5 to sound system.

    I just got new iphone 5's.  i also have several "computer sound systems" throughout our home we connect our phones and iPads to.  The new 5's wont play when connected.  Is there an adapter now required for this?