EEM policy: Netflow Detector

Hi all!
Can anyone give full example of the use of event_register_nf detector in TCL script.
At cisco.com only the syntax commands and there is no example.
Interested in the meaning of keywords: event_type, exit_event_type, event1- event4

Here's a low TTL detection example:
flow record pingwatcher match ipv4 ttl match ipv4 source address match ipv4 destination address!flow monitor pingmon record pingwatcher
event manager applet watchLowTTL event nf monitor-name "pingmon" event-type create event1 entry-value "5" field ipv4 ttl entry-op lt action 1.0 syslog msg "TTL=$_nf_event1_value detected between $_nf_source_address and $_nf_dest_address"

Similar Messages

  • EEM - Netflow detector using application name

    Hi Guys
    I'm attempting to set up a detector that fires when an application is seen.
    I've set up the flow monitor
    2951-HQ#sho flow monitor AppWatch cache
      Cache type:                               Normal
      Cache size:                                 4096
      Current entries:                              55
      High Watermark:                               55
      Flows added:                                 586
      Flows aged:                                  531
        - Active timeout      ( 30000 secs)          8
        - Inactive timeout    (   300 secs)        523
        - Event aged                                 0
        - Watermark aged                             0
        - Emergency aged                             0
    IPV4 SRC ADDR    IPV4 DST ADDR    APP NAME                       
    ===============  ===============  ================================
    10.66.236.61     10.66.236.218    prot icmp                      
    10.66.236.243    x.x.x.x   port telnet  
    But not having a lot of luck when attempting to create the detector
    event manager applet AppWatch
    event nf monitor-name "AppWatch" event-type create event1 entry-value "port telnet"  field application name entry-op eq
    Router returns:
    %EEM: Failed to register event(s) for applet AppWatch: 'Embedded Event Manager' detected the 'warning' condition 'invalid parameters'
    I'm runnig c2951-universalk9-mz.SPA.152-3.T2.bin
    Its probably the obvious, but I'll take any tips
    cheers
    Peter
    (after I exit configuration

    Hi Peter,
    This blog may help you.  We did something similar with Flexible NetFlow Performance Monitoring. It is a two part blog and it makes use of something similar with EEM. Please vote on our posts if they help you.
    Jake Wilson
    NetFlow Knight

  • EEM policy: Syslog ED & logging Discriminator = Crash

    Hi everyone!
    I found a new bug in cisco IOS 15.1(4)M3 when running EEM script with syslog event detector.
    If system logging performed using the "logging discriminator" and run concurrently EEM script with syslog event detector, then Cisco router crash and goes to reboot.
    Cisco ISR G2 3925E.

    Hi Joseph!
    SHOW VERSION
    =============
    i3925E-0-(offline)#sho ver
    Cisco IOS Software, C3900e Software (C3900e-UNIVERSALK9_NPE-M), Version 15.1(4)M3, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2011 by Cisco Systems, Inc.
    Compiled Tue 06-Dec-11 20:22 by prod_rel_team
    ass
    ROM: System Bootstrap, Version 15.1(1r)T4, RELEASE SOFTWARE (fc1)
    i3925E-0-(offline) uptime is 20 hours, 31 minutes
    System returned to ROM by bus error at PC 0x14F40AF, address 0x14F40AF at 14:50:19 MSK Thu Mar 15 2012
    System restarted at 14:52:14 MSK Thu Mar 15 2012
    System image file is "flash0:c3900e-universalk9_npe-mz.SPA.151-4.M3.bin"
    Last reload type: Normal Reload
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Cisco CISCO3925-CHASSIS (revision 1.0) with C3900-SPE200/K9 with 1015808K bytes of memory.
    Processor board ID FCZ153920YC
    4 Gigabit Ethernet interfaces
    DRAM configuration is 72 bits wide with parity enabled.
    256K bytes of non-volatile configuration memory.
    255744K bytes of ATA System CompactFlash 0 (Read/Write)
    License Info:
    License UDI:
    Device#   PID                   SN
    *0        C3900-SPE200/K9       FOC15357xxx   
    Technology Package License Information for Module:'c3900e'
    Technology    Technology-package           Technology-package
                  Current       Type           Next reboot 
    ipbase        ipbasek9      Permanent      ipbasek9
    security      securityk9_npePermanent      securityk9_npe
    uc            None          None           None
    data          None          None           None
    Configuration register is 0x2102
    SHOW STACK & REGION
    ====================
    i3925E-0-(offline)#show region
    Region Manager:
          Start         End     Size(b)  Class  Media  Name
    0x00000000  0x000FFFFF     1048576  IText  R/W    bios
    0x00100000  0x3E0FFFFF  1040187392  Local  R/W    main
    0x0010176C  0x04FE31DF    82713204  IText  R/O    main:text
    0x04FE3200  0x096E892F    74471216  IData  R/W    main:data
    0x096E8930  0x0A2FB1DF    12658864  IBss   R/W    main:bss
    0x0A2FB1E0  0x1BFFB1DF   298844160  Iomem  R/W    main:iomem
    0x1BFFB1E0  0x3BFFFFFF   536890912  Local  R/W    main:main
    0x1BFFB1E0  0x3BFFFFFF   536890912  Local  R/W    main:heap
    Free Region Manager:
          Start         End     Size(b)  Class  Media  Name
    i3925E-0-(offline)#sho stack
    Minimum process stacks:
    Free/Size   Name
    22876/24000  MRIB IPv6 Init Process
    23044/24000  MRIB IPv4 Init Process
    10080/12000  EEM Shell Director
    42216/60000  EEM TCL Proc
    10656/12000  Inspect Init Msg
    11036/12000  SPAN Subsystem
    39432/48000  Init
    58616/60000  EEM Auto Registration Proc
    10968/12000  Auto Upgrade Startup Process
    10696/12000  DIB error message
    11052/12000  SASL MAIN
    10884/12000  LICENSE AGENT DEFAULT
    10876/12000  RADIUS INITCONFIG
    5048/6000   Rom Random Update Process
    10996/12000  URPF stats
    141636/144000  TCP Command
    9552/12000  TFTP Read Process
    10944/12000  EM Action CNS
    38368/48000  Virtual Exec
    Interrupt level stacks:
    Level    Called Unused/Size  Name
      1    74177501  16476/18000  Network devices
      2           0  18000/18000  One Shot Timer
      5           3  17872/18000  Console Uart
      7    37018943  17916/18000  Clocktick Interrupt
    System was restarted by bus error at PC 0x14F40AF, address 0x14F40AF at 14:50:19 MSK Thu Mar 15 2012
    C3900e Software (C3900e-UNIVERSALK9_NPE-M), Version 15.1(4)M3, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Compiled Tue 06-Dec-11 20:22 by prod_rel_team (current version)
    Image text-base: 0x0010176C, data-base: 0x04FE3200
    Stack trace from system failure:
    FP: 0x1E9B7170, RA: 0x4FDC574
    FP: 0x1E9B719C, RA: 0x4FDC527
    FP: 0x1E9B71B8, RA: 0x190D227
    FP: 0x1E9B7210, RA: 0x190CE69
    FP: 0x1E9B7254, RA: 0x190CC2A
    FP: 0x1E9B7270, RA: 0x190CBDB
    FP: 0x1E9B7288, RA: 0x190E05A
    FP: 0x1E9B72BC, RA: 0x285ED30
    ******* Information of Last System Crash **********
    Using flash0:crashinfo_20120315-145019-MSK.
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Mar 14 10:32:39.945: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
    Mar 14 10:32:39.945: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
    Mar 14 10:32:39.945: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to down
    Mar 14 10:32:39.945: %LINK-3-UPDOWN: Interface GigabitEthernet0/3, changed state to down
    Mar 14 10:32:41.185: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
    Mar 14 10:32:41.185: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
    Mar 14 10:32:41.185: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed state to down
    Mar 14 10:32:41.185: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/3, changed state to downCisco CISCO3925-CHASSIS (revision 1.0) with C3900-SPE200/K9 with 1015808K bytes of memory.
    Processor board ID FCZ153920YC
    4 Gigabit Ethernet interfaces
    DRAM configuration is 72 bits wide with parity enabled.
    256K bytes of non-volatile configuration memory.
    255744K bytes of ATA System CompactFlash 0 (Read/Write)
    CMD: 'version 15.1' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'service timestamps debug datetime localtime' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'service timestamps log datetime localtime' 10:32:45 UTC Wed Mar 14 2012
    CMD: PASSWORD statement not printed
    CMD: 'hostname i3925E-0-(offline)' 10:32:45 UTC Wed Mar 14 2012
    % Hostname contains one or more illegal characters.
    Mar 14 10:32:45: %CNS-3-WARNING: CNS ID not changed: bad hostname -Process= "Init", ipl= 0, pid= 3
    Mar 14 10:32:45: %CNS-3-WARNING: CNS ID not changed: bad hostname -Process= "Init", ipl= 0, pid= 3
    Mar 14 10:32:45: %CNS-3-WARNING: CNS ID not changed: bad hostname -Process= "Init", ipl= 0, pid= 3
    CMD: 'boot-start-marker' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'boot system flash0 c3900e-universalk9_npe-mz.SPA.151-4.M3.bin' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'boot-end-marker' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'logging discriminator DROP mnemonics drops CFGLOG ' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'logging buffered 1024000' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'no logging console' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'logging monitor discriminator DROP' 10:32:45 UTC Wed Mar 14 2012
    CMD: PASSWORD statement not printed
    CMD: 'no aaa new-model' 10:32:45 UTC Wed Mar 14 2012
    CMD: 'clock timezone MSK 4 0' 10:32:45 UTC Wed Mar 14 2012
    Mar 14 14:32:45: %SYS-6-CLOCKUPDATE: System clock has been updated from 10:32:45 UTC Wed Mar 14 2012 to 14:32:45 MSK Wed Mar 14 2012, configured from console by console.
    CMD: 'no ipv6 cef' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'no ip source-route' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'ip cef' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'no ip domain lookup' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'ip name-server 8.8.8.8' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'multilink bundle-name authenticated' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'crypto pki token default removal timeout 0' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'license udi pid C3900-SPE200/K9 sn xxxxxxxxxxxx' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'archive' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' log config' 14:32:45 MSK Wed Mar 14 2012
    CMD: '  logging enable' 14:32:45 MSK Wed Mar 14 2012
    CMD: '  notify syslog contenttype plaintext' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' path flash:/CFG/config' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' write-memory' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'redundancy' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'ip rcmd remote-host user x.x.x.x user enable' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'interface GigabitEthernet0/0' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' description if-to-Customers' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' bandwidth 1000000' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' no ip address' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' load-interval 30' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' duplex auto' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' speed auto' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' media-type rj45' 14:32:45 MSK Wed Mar 14 2012
    CMD: 'interface GigabitEthernet0/0.98' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' encapsulation dot1Q 98' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' ip address x.x.x.x 255.255.255.0' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' ip nat outside' 14:32:45 MSK Wed Mar 14 2012
    CMD: ' no ip virtual-reassembly in' 14:32:46 MSK Wed Mar 14 2012
    Mar 14 14:32:46: %IP_VFR-7-FEATURE_DISABLE_IN: VFR(in) is manually disabled through CLI; VFR support for features that have internally enabled, will be made available only when VFR is enabled manually on interface GigabitEthernet0/0.98
    CMD: ' arp timeout 180' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'interface GigabitEthernet0/1' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' bandwidth 1000000' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' no ip address' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' no ip unreachables' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' load-interval 30' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' shutdown' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' duplex auto' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' speed auto' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' media-type rj45' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'interface GigabitEthernet0/2' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' no ip address' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' shutdown' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' duplex auto' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' speed auto' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'interface GigabitEthernet0/3' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' no ip address' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' duplex auto' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' speed auto' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'ip forward-protocol nd' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'no ip http server' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'no ip http secure-server' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'ip flow-export version 5' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'ip flow-export destination x.x.x.x xxxx 14:32:46 MSK Wed Mar 14 2012
    CMD: 'ip flow-top-talkers' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' top 50' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' sort-by bytes' 14:32:46 MSK Wed Mar 14 201
    CMD: 'ip route 0.0.0.0 0.0.0.0 x.x.x.x' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'logging source-interface GigabitEthernet0/0.98' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'logging host x.x.x.x discriminator DROP' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'logging host x.x.x.x discriminator DROP' 14:32:46 MSK Wed Mar 14 2012
    CMD: PASSWORD statement not printed
    CMD: 'snmp-server host x.x.x.x public ' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'snmp-server manager' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'control-plane' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'line con 0' 14:32:46 MSK Wed Mar 14 2012
    CMD: PASSWORD statement not printed
    CMD: ' logging synchronous' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' login' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'line aux 0' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' login' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' no exec' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'line vty 0 5' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' exec-timeout 30 0' 14:32:46 MSK Wed Mar 14 2012
    CMD: PASSWORD statement not printed
    CMD: ' logging synchronous' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' login' 14:32:46 MSK Wed Mar 14 2012
    CMD: ' transport input all' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'scheduler allocate 20000 1000' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'ntp server x.x.x.x' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'event manager environment _syslog_test Configured' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'event manager directory user policy "flash0:/USER/"' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'event manager directory user repository flash0:/USER/' 14:32:46 MSK Wed Mar 14 2012
    CMD: 'event manager policy Multiple-test.tcl' 14:32:46 MSK Wed Mar 14 2012
    Mar 14 14:32:46: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up
    CMD: 'end' 14:32:46 MSK Wed Mar 14 2012
    Mar 14 14:32:46: %SYS-5-CONFIG_I: Configured from memory by console
    SETUP: new interface NVI0 placed in "shutdown" state
    Mar 14 14:32:48: %LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to reset
    Mar 14 14:32:48: %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively down
    Mar 14 14:32:48: %LINK-5-CHANGED: Interface GigabitEthernet0/2, changed state to administratively down
    Mar 14 14:32:49: %LINK-5-CHANGED: Interface NVI0, changed state to administratively down
    Mar 14 14:32:49: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
    Mar 14 14:32:50: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to down
    Mar 14 14:32:52: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down
    Mar 14 14:32:55: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
    Mar 14 14:32:56: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
    Mar 14 14:32:56: %SYS-5-RESTART: System restarted --
    Cisco IOS Software, C3900e Software (C3900e-UNIVERSALK9_NPE-M), Version 15.1(4)M3, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2011 by Cisco Systems, Inc.
    Compiled Tue 06-Dec-11 20:22 by prod_rel_team
    Mar 14 14:32:56: %SNMP-5-COLDSTART: SNMP agent on host i3925E-0-(offline) is undergoing a cold start
    Mar 14 14:32:58: %SYS-6-BOOTTIME: Time taken to reboot after reload =  121 seconds
    Mar 14 14:32:59: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host xx.x..xx port 514 started - CLI initiated
    CMD: 'enable' 14:36:05 MSK Thu Mar 15 2012
    CMD: 'sho event manager policy registered ' 14:36:12 MSK Thu Mar 15 2012
    CMD: 'sho logg' 14:36:26 MSK Thu Mar 15 2012
    CMD: 'sho run | inc logg' 14:37:34 MSK Thu Mar 15 2012
    CMD: 'sho run | sec DROP' 14:38:35 MSK Thu Mar 15 2012
    CMD: 'sho run | sec CFGLOG' 14:39:09 MSK Thu Mar 15 2012
    CMD: 'conf t' 14:39:42 MSK Thu Mar 15 2012
    CMD: 'no logging discriminator DROP mnemonics drops CFGLOG ' 14:39:45 MSK Thu Mar 15 2012
    Mar 15 14:39:45: %PARSER-5-CFGLOG_LOGGEDCMD: User:vty0  logged command:no logging discriminator DROP
    CMD: 'conf t' 14:39:51 MSK Thu Mar 15 2012
    CMD: 'logging monitor ' 14:40:16 MSK Thu Mar 15 2012
    Mar 15 14:40:16: %PARSER-5-CFGLOG_LOGGEDCMD: User:vty0  logged command:logging monitor
    CMD: 'do sho logg' 14:40:24 MSK Thu Mar 15 2012
    CMD: 'sho logg' 14:40:24 MSK Thu Mar 15 2012
    CMD: 'logging buffered ' 14:40:41 MSK Thu Mar 15 2012
    Mar 15 14:40:41: %PARSER-5-CFGLOG_LOGGEDCMD: User:vty0  logged command:logging buffered
    CMD: 'logg x.x.x.x 14:41:04 MSK Thu Mar 15 2012
    Mar 15 14:41:04: %PARSER-5-CFGLOG_LOGGEDCMD: User:vty0  logged command:logging x.x.x.x
    CMD: 'do sho logg' 14:41:12 MSK Thu Mar 15 2012
    CMD: 'sho logg' 14:41:12 MSK Thu Mar 15 2012
    CMD: 'do sho logg | inc DROP' 14:41:44 MSK Thu Mar 15 2012
    CMD: 'sho logg | inc DROP' 14:41:44 MSK Thu Mar 15 2012
    CMD: 'do sho logg ' 14:41:55 MSK Thu Mar 15 2012
    CMD: 'sho logg' 14:41:55 MSK Thu Mar 15 2012
    CMD: 'do term mon' 14:42:13 MSK Thu Mar 15 2012
    CMD: 'term mon' 14:42:13 MSK Thu Mar 15 2012
    CMD: 'exi' 14:42:20 MSK Thu Mar 15 2012
    Mar 15 14:42:20: %SYS-5-CONFIG_I: Configured from console by vty0 (x.x.x.x)
    Mar 15 14:42:20: %HA_EM-6-LOG: Multiple-test.tcl: START polycy #1...
    Mar 15 14:42:20: %HA_EM-6-LOG: Multiple-test.tcl: ENTRY status not exist...
    CMD: 'conf t' 14:47:16 MSK Thu Mar 15 2012
    Mar 15 14:47:17: %SYS-5-CONFIG_I: Configured from console by vty0 ()
    Mar 15 14:47:17: %HA_EM-6-LOG: Multiple-test.tcl: START polycy #1...
    Mar 15 14:47:17: %HA_EM-6-LOG: Multiple-test.tcl: ENTRY status not exist...
    CMD: 'sho run | inc logg' 14:48:27 MSK Thu Mar 15 2012
    CMD: 'conf t' 14:48:40 MSK Thu Mar 15 2012
    CMD: 'logging discriminator DROP1 mnemonics drops HA_EM ' 14:48:59 MSK Thu Mar 15 2012
    Mar 15 14:48:59: %PARSER-5-CFGLOG_LOGGEDCMD: User:vty0  logged command:logging discriminator DROP1 mnemonics drops HA_EM
    CMD: 'logging discriminator DROP1 mnemonics drops LOG ' 14:49:17 MSK Thu Mar 15 2012
    Mar 15 14:49:17: %PARSER-5-CFGLOG_LOGGEDCMD: User:vty0  logged command:logging discriminator DROP1 mnemonics drops LOG
    Mar 15 14:49:19: %SYS-5-CONFIG_I: Configured from console by vty0 ()
    Mar 15 14:49:19: %HA_EM-6-LOG: Multiple-test.tcl: START polycy #1...
    Mar 15 14:49:19: %HA_EM-6-LOG: Multiple-test.tcl: ENTRY status not exist...
    CMD: 'conf t' 14:49:27 MSK Thu Mar 15 2012
    CMD: 'logging monitor discriminator DROP1' 14:50:19 MSK Thu Mar 15 2012
    Mar 15 14:50:19: %PARSER-5-CFGLOG_LOGGEDCMD: User:vty0  logged command:logging monitor discriminator DROP1
    Mar 15 14:50:19: %SYS-5-CONFIG_I: Configured from console by vty0 ()
    14:50:19 MSK Thu Mar 15 2012: Unexpected exception to CPU: vector D, PC = 0x14F40AF
    -Traceback= 14F40AF 85A 4FDC574 4FDC527 190D227 190CE69 190CC2A 190CBDB
    CPU Register Context:
    EAX = 0x1E9B71D4  ECX  = 0x014F408B  EDX = 0x1E9B71D0  EBX  = 0x000000D3
    ESP = 0x1E9B70C8  EBP  = 0x1E9B7170  ESI = 0x0000085A  EDI  = 0x00000001
    EIP = 0x014F40AF  PS   = 0x00010206  CS  = 0x00000008  SS   = 0x00000010
    DS  = 0x00000010  ES   = 0x00000010  FS  = 0x00000010  GS   = 0x00000010
    ========= Start of Crashinfo Collection (14:50:19 MSK Thu Mar 15 2012) =========
    For image:
    Cisco IOS Software, C3900e Software (C3900e-UNIVERSALK9_NPE-M), Version 15.1(4)M3, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2011 by Cisco Systems, Inc.
    Compiled Tue 06-Dec-11 20:22 by prod_rel_team
    ========= Malloc and Free Traces ===============================================
    MallocFree Trace: ixmallocfree=0xD  ptr=0x9DD3C48
    9DD3BE0: 1F421B68  4E5DD21 1F4223A0 600003B2 1F6F1E40 4000061C 1F6F1E40  4E4B0D3
    9DD3C00: 1F6F1E40  4E4BC70 1F6F2AA8 60000398 1FB0DA8C  15677BC 1FB0E678 600003C6
    9DD3C20: 1F1DB08C 40000060 1F1DB08C  153FBB1 1D9E48E4 40000204 1D9E48E4  190D088
    9DD3C40: 1F40912C 40000546 1F40912C  190D133 1FB0E678 400002CA 1FB0E678  4E4B0D3
    9DD3C60: 1FB0E678  4E6187F 1FB0EC3C 600000E4 1F4223A0 400002CA 1F4223A0  4E4B0D3
    9DD3C80: 1F4223A0  4E6187F 1F422964 600000D0 1D9E48E4 400002CA 1D9E48E4  4E4B0D3
    9DD3CA0: 1D9E48E4  4E6187F 1D9E4EA8 60000096 1FB0E678 400002CA 1FB0E678  4E4B0D3
    9DD3CC0: 1FB0E678  4E6187F 1FB0EC3C 600000E4 1F4223A0 400002CA 1F4223A0  4E4B0D3
    9DD3CE0: 1F4223A0  4E6187F 1F422964 600000D0 1D9E48E4 400002CA 1D9E48E4  4E4B0D3
    9DD3D00: 1D9E48E4  4E6187F 1D9E4EA8 60000096 1FB0E678 400002CA 1FB0E678  4E4B0D3
    9DD3D20: 1FB0E678  4E6187F 1FB0EC3C 600000E4 1F4223A0 400002CA 1F4223A0  4E4B0D3
    9DD3D40: 1F4223A0  4E6187F 1F422964 600000D0 1D9E48E4 400002CA 1D9E48E4  4E4B0D3
    9DD3D60: 1D9E48E4  4E6187F 1D9E4EA8 60000096 1FB0E678 400002CA 1FB0E678  4E4B0D3
    9DD3D80: 1FB0E678  4E6187F 1FB0EC3C 600000E4 1F4223A0 400002CA 1F4223A0  4E4B0D3
    9DD3DA0: 1F4223A0  4E6187F 1F422964 600000D0 1D9E48E4 400002CA 1D9E48E4  4E4B0D3
    9DD3DC0: 1D9E48E4  4E6187F 1D9E4EA8 60000096 1F1DB834  4E62135 1F1DBE04 600000E2
    ChunkMallocFree Trace: ixchunkmallocfree=0x9 ptr=0x9DEF16C
    9DEF100:  285CF44  28617F9 1EB10BE4   318BF3   307732 1C18ED7C   318C3F   305775
    9DEF120: 1D4F63F0   318C3F   3057C6 1D4F63F0   318C3F   3057C6 1D4F63A0   318BF3
    9DEF140:   3058E1 1C18ED7C  285CF44  285B561 1EB10BE4  285CEA5  285B561 1F6982FC
    9DEF160:   318BA3   30E02B 1D4F5754  1B16955  1B161B1 1C5644BC  285CF44  28617F9
    9DEF180: 1EB10BE4   318BF3   307732 1C18ED7C   318C3F   305775 1D4F63F0   318B53
    9DEF1A0:   3118A0 1D4F4804   318B53   3118A0 1D4F4828   318B53   3118A0 1D4F484C
    9DEF1C0:   318C3F   3057C6 1D4F63F0   318BF3   3058E1 1C18ED7C  285CF44  285B561
    9DEF1E0: 1EB10BE4  285CEA5  285B561 1F6982FC  285CEA5  285B35F 1F6982FC  285CF44
    9DEF200:  28617F9 1EB10BE4   318BF3   307732 1C18ED7C   318C3F   305775 1D4F63F0
    9DEF220:   318C3F   3057C6 1D4F63F0   318BF3   3058E1 1C18ED7C  285CF44  285B561
    9DEF240: 1EB10BE4  285CEA5  285B561 1F6982FC  285CEA5  285B35F 1F6982FC  285CF44
    9DEF260:  28617F9 1EB10BE4   318BF3   307732 1C18ED7C   318C3F   305775 1D4F63F0
    9DEF280:   318C3F   3057C6 1D4F63F0   318BF3   3058E1 1C18ED7C  285CF44  285B561
    9DEF2A0: 1EB10BE4  285CEA5  285B561 1F6982FC  285CEA5  285B35F 1F6982FC  285CF44
    9DEF2C0:  28617F9 1EB10BE4   318BF3   307732 1C18ED7C   318C3F   305775 1D4F63F0
    9DEF2E0:   318B53   311807 1D4F4804   318B53   311807 1D4F4828   318B53   311807
    9DEF300: 1D4F484C   318C3F   3057C6 1D4F63F0   318BF3   3058E1 1C18ED7C  285CF44
    9DEF320:  285B561 1EB10BE4  285CEA5  285B561 1F6982FC  285CEA5  285B35F 1F6982FC
    9DEF340:  285CF44  28617F9 1EB10BE4   318BF3   307732 1C18ED7C   318C3F   305775
    9DEF360: 1D4F63F0   318C3F   3057C6 1D4F63F0   318BF3   3058E1 1C18ED7C  285CF44
    9DEF380:  285B561 1EB10BE4  285CEA5  285B561 1F6982FC  285CEA5  285B35F 1F6982FC
    9DEF3A0:  285CF44  28617F9 1EB10BE4   318BF3   307732 1C18ED7C   318C3F   305775
    9DEF3C0: 1D4F63F0   318C3F   3057C6 1D4F63F0   318BF3   3058E1 1C18ED7C  285CF44
    9DEF3E0:  285B561 1EB10BE4  285CEA5  285B561 1F6982FC  285CEA5  285B35F 1F6982FC
    ========= Stack Trace ==========================================================
    -Traceback= 14F40AF 85A 4FDC574 4FDC527 190D227 190CE69 190CC2A 190CBDB
    ========= Context ==============================================================
    C3900e Software (C3900e-UNIVERSALK9_NPE-M), Version 15.1(4)M3, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Compiled Tue 06-Dec-11 20:22 by prod_rel_team
    CPU Register Context:
    EAX = 0x1E9B71D4  ECX  = 0x014F408B  EDX = 0x1E9B71D0  EBX  = 0x000000D3
    ESP = 0x1E9B70C8  EBP  = 0x1E9B7170  ESI = 0x0000085A  EDI  = 0x00000001
    EIP = 0x014F40AF  PS   = 0x00010206  CS  = 0x00000008  SS   = 0x00000010
    DS  = 0x00000010  ES   = 0x00000010  FS  = 0x00000010  GS   = 0x00000010
    Signal = 10 Vector = 0xD
    ========= Stack Dump ===========================================================
    Stack Frame Pointer in Context is 0x1E9B70C8, at process level
    1E9B6CC8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6CE8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6D08: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6D28: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6D48: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6D68: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6D88: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6DA8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6DC8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6DE8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6E08: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6E28: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6E48: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6E68: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6E88: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6EA8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6EC8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6EE8: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6F08: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6F28: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6F48: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6F68: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    1E9B6F88: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 1C1F0AC0
    1E9B6FA8:      4B0 60381F1C 1C1F0AC0      328 1E63B504      438 4C4BD51D 1E63B504
    1E9B6FC8:      ABC 4C4BD51D E46F9B1E 8D9DFC04 1DD54B4C 1E9B6FF8        0 84709B1E
    1E9B6FE8: C45A8802 1D88C6B8 1E9B6FF8  288CB4A        0 804E3F1F        0 6D6A2500
    1E9B7008: 8A1A0000        0  10000F1        0        0  10000F1  1000000  2000000
    1E9B7028:        0        0        0 F80C0000        0 58709B1E  9700520  404AD28
    1E9B7048:        0  9700520  404B7E4        0  9700520        3 B0709B1E 335D8402
    1E9B7068: 1C1ED564        0        0  9700520        3  404B7E4        1        0
    1E9B7088:  CD41E1C 1C1ED40C        0 36010000  6000000 30000000 1E9B716C 8A080000
    1E9B70A8: D3000000 1E9B7178 5A080000 70719B1E        0 AF404F01 470E1000  D000000
    1E9B70C8: E4709B1E FCF98202  9700520        0 7AF78202 31340000        0 33B5631E
    1E9B70E8: C0D15B1E        1 3490401F        0  6000000 73000000  3000000  1000000
    1E9B7108: 1E9B70DC  4000000  1000000        0        0 1E9B70F0        0 5A080000
    1E9B7128:      85A 1F409357        1 7C080000 1E9B7134 1E9B7180 87070000 5A080000
    1E9B7148: FFFFFFFF        0        0 D3000000        0 20000000        0 FFFFFFFF
    1E9B7168: FFFFFFFF 1E9B7178 9C719B1E 74C5FD04 1F40942A FFFFFFFF  54BED16 D4719B1E
    1E9B7188:        0      85A 986FF51E 7454F51E  9C62CC0 B8719B1E 27C5FD04 1F409357
    1E9B71A8:      85A  54BEC40 CC719B1E CC719B1E 10729B1E 27D29001 1F409357      85A
    1E9B71C8:  54BEC40        4        1 1D9E48E4 1F4091F1      9C0       29        1
    1E9B71E8:        0        3  9C64024  9C62CC0 7454F51E  9C62CFC 1D9E48E4 7454F51E
    1E9B7208: 78AEA71E 986FF51E 54729B1E 69CE9001  C737F1E 64E6EC1D        1   1572B8
    1E9B7228:        1        0  9C62CC0 78AEA71E 1EA7AE78  9C62CC0  A000000   150000
    1E9B7248: C02CC609        0 15000000 70729B1E 2ACC9001 D9BE8502 1DECE6C4 1E9B72B8
    1E9B7268:  9C62CC0  A000000 88729B1E DBCB9001 1E9B72B0 90729B1E 1E9B72B0  9C62CC0
    1E9B7288: BC729B1E 5AE09001  9C62CC0 1DECE664        0        1        0        0
    1E9B72A8:        0        0        2 1E865DD0        2        0 30ED8502        0
    1E9B72C8: FD0110DF AB1234CD FFFE0000        0  515505C  18DA0DD 1E9B732C 1E9B342C
    1E9B72E8: 80000018        1        0  1000001 1C1F0F70 1E7FD4FC 1E7FD460  6ADF740
    1E9B7308:        C  4000000        0     1D22 FFFFFFFF FFFFFFFF FFFFFFFF        0
    1E9B7328: FD0110DF AB1234CD FFFE0000        0  515505C  18DA0DD 1E9B738C 1E9B72E0
    1E9B7348: 80000018        1        0  1000001 1C1F0F70 1E3CD1D8 1E7FD4B0  6AE25A0
    1E9B7368:        E  4000000        0     204F FFFFFFFF FFFFFFFF FFFFFFFF        0
    1E9B7388: FD0110DF AB1234CD FFFE0000        0  515505C  18DA101 1E9B73D8 1E9B7340
    1E9B73A8: 8000000E        1        0  1000001 1C1F0F70 746D5F66 7379735F 75736167
    1E9B73C8: 652E7463 6C000000        0 FD0110DF AB1234CD FFFE0000        0  515505C
    1E9B73E8:  18DA0DD 1E9B7438 1E9B73A0 80000018        1        0  1000001 1C1F0F70
    1E9B7408: 1E7FD5A8 1E7FD55C        0       11  6000000        0        0 FFFFFFFF
    1E9B7428: FFFFFFFF FFFFFFFF        0 FD0110DF AB1234CD FFFE0000        0  515505C
    1E9B7448:  18DA101 1E9B7484 1E9B73EC 8000000E        1        0  1000001 1C1F0F70
    1E9B7468: 65656D5F 706E745F 30000000        0        0        0 FD0110DF AB1234CD
    1E9B7488: FFFE0000        0  515505C  18DA0DD 1E9B74E4 1E9B744C 80000018        1
    1E9B74A8:        0  1000001 1C1F0F70 1E9B78BC 1E7FD608        0       14  6000000
    ========= Process Level Info ===================================================
    ---- Current Process Stack (0x324 bytes used, out of 0x3E80 available) ----
    Current SP = 0x1E9B70C8, saved SP = 0x1C1D2628
    1E9B6FA4: 1C1F0AC0      4B0 60381F1C 1C1F0AC0      328 1E63B504      438 4C4BD51D
    1E9B6FC4: 1E63B504      ABC 4C4BD51D E46F9B1E 8D9DFC04 1DD54B4C 1E9B6FF8        0
    1E9B6FE4: 84709B1E C45A8802 1D88C6B8 1E9B6FF8  288CB4A        0 804E3F1F        0
    1E9B7004: 6D6A2500 8A1A0000        0  10000F1        0        0  10000F1  1000000
    1E9B7024:  2000000        0        0        0 F80C0000        0 58709B1E  9700520
    1E9B7044:  404AD28        0  9700520  404B7E4        0  9700520        3 B0709B1E
    1E9B7064: 335D8402 1C1ED564        0        0  9700520        3  404B7E4        1
    1E9B7084:        0  CD41E1C 1C1ED40C        0 36010000  6000000 30000000 1E9B716C
    1E9B70A4: 8A080000 D3000000 1E9B7178 5A080000 70719B1E        0 AF404F01 470E1000
    1E9B70C4:  D000000 E4709B1E FCF98202  9700520        0 7AF78202 31340000        0
    1E9B70E4: 33B5631E C0D15B1E        1 3490401F        0  6000000 73000000  3000000
    1E9B7104:  1000000 1E9B70DC  4000000  1000000        0        0 1E9B70F0        0
    1E9B7124: 5A080000      85A 1F409357        1 7C080000 1E9B7134 1E9B7180 87070000
    1E9B7144: 5A080000 FFFFFFFF        0        0 D3000000        0 20000000        0
    1E9B7164: FFFFFFFF FFFFFFFF 1E9B7178 9C719B1E 74C5FD04 1F40942A FFFFFFFF  54BED16
    1E9B7184: D4719B1E        0      85A 986FF51E 7454F51E  9C62CC0 B8719B1E 27C5FD04
    1E9B71A4: 1F409357      85A  54BEC40 CC719B1E CC719B1E 10729B1E 27D29001 1F409357
    1E9B71C4:      85A  54BEC40        4        1 1D9E48E4 1F4091F1      9C0       29
    1E9B71E4:        1        0        3  9C64024  9C62CC0 7454F51E  9C62CFC 1D9E48E4
    1E9B7204: 7454F51E 78AEA71E 986FF51E 54729B1E 69CE9001  C737F1E 64E6EC1D        1
    1E9B7224:   1572B8        1        0  9C62CC0 78AEA71E 1EA7AE78  9C62CC0  A000000
    1E9B7244:   150000 C02CC609        0 15000000 70729B1E 2ACC9001 D9BE8502 1DECE6C4
    1E9B7264: 1E9B72B8  9C62CC0  A000000 88729B1E DBCB9001 1E9B72B0 90729B1E 1E9B72B0
    1E9B7284:  9C62CC0 BC729B1E 5AE09001  9C62CC0 1DECE664        0        1        0
    1E9B72A4:        0        0        0        2 1E865DD0        2        0 30ED8502
    1E9B72C4:        0
    ========= Interrupt Level Stack Dump ===========================================
    ========= Interrupt Stack ======================================================
    ---- Level 1 Interrupt stack (0x618 bytes used, out of 0x4650 available) ----
    intstacks[1]: base 0x1D48ED84 stack 0x1D4933D0 routine 0x1F41F6
                  size 0x4650     low   0x4650     desc    Network devices
    1D492DBC: E02D491D E02D491D E82D491D E82D491D B7222000  7000000  8000000 78000000
    1D492DDC: 1CA7DAA0 C0000000  1000000 302E491D 102E491D 102E491D B7222000  7000000
    1D492DFC: 28000000 28000000        0 C0000000  1000000 682E491D 521E2000 882E491D
    1D492E1C: 582F491D        0 582F491D 782E491D 938FDB01 802E491D 938FDB01 5C2E491D
    1D492E3C:        1        0        0 882E491D  42F491D 1D492E88  42F491D FC31491D
    1D492E5C:  A0103FB 1CA7DAA0 A0DAA71C        0        0        0  A0103FB 802F491D
    1D492E7C: 778BDD01 1CA7DAA0  A0103FB 1D492F58        0        0        0        1
    1D492E9C:        1        0        0        0        0 40010000 1D492F04        0
    1D492EBC:  42F491D E02E491D 15B2DD01 E030491D  9CD4EEC 282F491D 982F491D 7431491D
    1D492EDC: 1CA7DAA0 FC2E491D 1D44DD01 1D492F04 7431491D 982F491D 1CA7DAA0  B12D612
    1D492EFC: E831491D E5722E00 1CA7DAA0  B12D612  B12D626        0        0        0
    1D492F1C:  A0002FB FFFFFFFF        0        0        0       17    60000        0
    1D492F3C:        0        0        0        0 1C1F0E44 70461F1C 682F491D 8D9DFC04
    1D492F5C: 1C1F4670 1D492F7C E065351C  830491D C45A8802 1D88C598 1D492F7C  288CB4A
    1D492F7C: 8A7A2E00  6000000        0 1CA7DAA0        6 FFFFFFFE 1CA7DAA0 FFFFFFFE
    1D492F9C:        0  1000004 8D9DFC04 1C1F4670 1D492FC8 6014341C 5430491D 1CA7DAA0
    1D492FBC: 1D88C598 1CA7DAA0  288CB4A EC2F491D EC2F491D B7222000  7000000 1D5C9D44
    1D492FDC: 1430491D 37478502        6 1030491D AD324C00        0  6000000 F027981D
    1D492FFC: 1D982800 1D9827F0  2020000 C7188502      206 1D9826A0 1D98279C  97B785C
    1D49301C: 3830491D 446B9000  97B785C 1D98279C        2 A026981D        1 6030491D
    1D49303C: 57958502        1 46020000 88929000      206        0 5C30491D  8929000
    1D49305C: 8C30491D 2B938502        1 8430491D 8430491D 21EB8402  1000000 1C179EC8
    1D49307C: C89E171C 1C3565E0        6 A026981D A030491D D3C18502        0 1C3565E0
    1D49309C: 1C3565E0 BC30491D 4BFC4A00 1C179EC8 C430491D ED24BB01 1C179EC8 FB02000A
    1D4930BC: FB02000A        6 D030491D 8F52B701 5862340A 2031491D 9E49B701 1C3565E0
    1D4930DC: 57F85000 1CA7DAA0  B12D612 2418541C 1CA7DAA0 E065351C  9195000  1040000
    1D4930FC:  A0002FB  56142C4 767CCA09        6 1D60B6C0 3031491D E065351C        7
    1D49311C: 1C3565E0 3431491D CAB98602 1C3565E0  A34624A 1C3565E0 A831491D 12488B02
    1D49313C:        7 1C3565E0        0        0        0        1        0 1D4931B0
    1D49315C:        0        1        0 757CCA09        1 8061631E E065351C A0DAA71C
    1D49317C:        0 4A62340A    80000        4        1 E065351C E065351C 1D60B6C0
    1D49319C: E065351C  A34624A 1C541824 C831491D 62378B02 94E38402  6D31268        0
    1D4931BC: 1C3565E0       63 E065351C DC31491D CAB98602 1C3565E0       63 1C3565E0
    1D4931DC:  C32491D 91504900       63 A0DAA71C  9000000        9  C32491D 34A38202
    1D4931FC: 1E1000DC 1E107EAC  28AA52D  28AA52D 3432491D 2DA58A02 1E1000DC 1E107EAC
    1D49321C:        1        0 1E107EAC 1CA7DAA0  9000000 A0DAA71C 8832491D 25121F00
    1D49323C:        9 1CA7DAA0 12000000   D6120B A0DAA71C 1C3565E0 A0DAA71C E04E4900
    1D49325C: 1D630C4C 1D653C00   D6120B 1CA7DAA0 4662340A 1D60B6C0 A0DAA71C    10000
    1D49327C:   2834FA 1D60B6C0 18DBA71C A032491D 11251F00  6A86E44 A0DAA71C    10000
    1D49329C:  B12D60C  C33491D 627A2800 1D60B6C0 1CA7DAA0   2834FA  B12D60C 8C5A8802
    1D4932BC:  7000000        0 C0B6601D A0DAA71C 7EAF8802 38D4601D        0 F832491D
    1D4932DC:  B12D600   620000 1D60B6C0 1C541824 1C541824        0 1CA7DAA0 1D60C348
    1D4932FC: A0DAA71C 60CACB0A 1D60B6C0 F8A0D306 8833491D 519E2800 8833491D 5C33491D
    1D49331C: 5C33491D 5AD94700 1D60B6C0 38D4601D 60E90106  5D6FE9C      600 6033491D
    1D49333C: 57958502 18DBA71C 1CA7DAA0        0 1CA7DAA0 1D60D438 F8050000 F0CFCB0A
    1D49335C: 38D4601D 60CACB0A        0 C0B6601D C0B6601D 1D60B6C0 B4E8621D 1D662380
    1D49337C:        0       20 1CA7DAA0 AC33491D 1AA62800 1D60B6C0        0        0
    1D49339C:        1 1D60B6C0 1D60B6C0 80060000 C433491D 73A62800 C433491D 85A82500
    1D4933BC: 80060000 14983206 8C709B1E 1E212000 1D60B6C0 FFFFFFFF
    ---- Level 2 Interrupt stack (0x0 bytes used, out of 0x4650 available) ----
    intstacks[2]: base 0x1D48A734 stack 0x1D48ED80 routine 0x25650A
                  size 0x4650     low   0x4650     desc    One Shot Timer
    ---- Level 5 Interrupt stack (0x80 bytes used, out of 0x4650 available) ----
    intstacks[5]: base 0x1D4860E4 stack 0x1D48A730 routine 0x20C4F6
                  size 0x4650     low   0x4650     desc    Console Uart
    1D48A6B4: C4A6481D 17BF2000  3F90000  D000000 DCA6481D E1BA2000 FFFFFFFF E0A6481D
    1D48A6D4: 17BF2000 1C17676F  8A7481D 24C42000 1C174618 FFFFFFFF FFFFFFFF FFFFFFFF
    1D48A6F4: 1C174618        0  8A7481D CCBE2000  2FA0000 28A7481D 6CC52000 FFFFFFFF
    1D48A714: FFFFFFFF FFFFFFFF 30A7481D F6C42000  4983206 B0E3781D C6222000 FFFFFFFF
    ---- Level 7 Interrupt stack (0x54 bytes used, out of 0x4650 available) ----
    intstacks[7]: base 0x1D481A94 stack 0x1D4860E0 routine 0x91D8F0
                  size 0x4650     low   0x4650     desc    Clocktick Interrupt
    1D486090:        0  536CFF2        0  536CFF6 1D78E474 46020000 D22B8502      202
    1D4860B0: EDBF9000 FFFFFFFF C860481D 6B872200 D060481D 67938202 D060481D 25DA9100
    1D4860D0: D860481D BFD99100 20261D1C C6222000 FFFFFFFF
    ========= Register Memory Dump =================================================
    Reg00(EAX): 1E9B71D4
    Reg01(EBX):       D3
    Reg02(ECX):  14F408B
    Reg03(EDX): 1E9B71D0
    Reg04(ESP): 1E9B70C8
    Reg05(EBP): 1E9B7170
    Reg06(ESI):      85A
    Reg07(EDI):        1
    Reg08(EIP):  14F40AF
    Reg09(PS ):    10206
    Reg10(CS ):        8
    Reg11(SS ):       10
    Reg12(DS ):       10
    Reg13(ES ):       10
    Reg14(FS ):       10
    Reg15(GS ):       10
    buffer check=0 sched_hc=0x0
    ---- block0  ptr=1E9B7068  is_malloc=0  length=0x260 ----
    1E9B7028:        0        0        0 F80C0000        0 58709B1E  9700520  404AD28
    1E9B7048:        0  9700520  404B7E4        0  9700520        3 B0709B1E 335D8402
    1E9B7068: 1C1ED564        0        0  9700520        3  404B7E4        1        0
    1E9B7088:  CD41E1C 1C1ED40C        0 36010000  6000000 30000000 1E9B716C 8A080000
    1E9B70A8: D3000000 1E9B7178 5A080000 70719B1E        0 AF404F01 470E1000  D000000
    1E9B70C8: E4709B1E FCF98202  9700520        0 7AF78202 31340000        0 33B5631E
    1E9B70E8: C0D15B1E        1 3490401F        0  6000000 73000000  3000000  1000000
    1E9B7108: 1E9B70DC  4000000  1000000        0        0 1E9B70F0        0 5A080000
    1E9B7128:      85A 1F409357        1 7C080000 1E9B7134 1E9B7180 87070000 5A080000
    1E9B7148: FFFFFFFF        0        0 D3000000        0 20000000        0 FFFFFFFF
    1E9B7168: FFFFFFFF 1E9B7178 9C719B1E 74C5FD04 1F40942A FFFFFFFF  54BED16 D4719B1E
    1E9B7188:        0      85A 986FF51E 7454F51E  9C62CC0 B8719B1E 27C5FD04 1F409357
    1E9B71A8:      85A  54BEC40 CC719B1E CC719B1E 10729B1E 27D29001 1F409357      85A
    1E9B71C8:  54BEC40        4        1 1D9E48E4 1F4091F1      9C0       29        1
    1E9B71E8:        0        3  9C64024  9C62CC0 7454F51E  9C62CFC 1D9E48E4 7454F51E
    1E9B7208: 78AEA71E 986FF51E 54729B1E 69CE9001  C737F1E 64E6EC1D        1   1572B8
    1E9B7228:        1        0  9C62CC0 78AEA71E 1EA7AE78  9C62CC0  A000000   150000
    1E9B7248: C02CC609        0 15000000 70729B1E 2ACC9001 D9BE8502 1DECE6C4 1E9B72B8
    1E9B7268:  9C62CC0  A000000 88729B1E DBCB9001 1E9B72B0 90729B1E 1E9B72B0  9C62CC0
    1E9B7288: BC729B1E 5AE09001  9C62CC0 1DECE664        0        1        0        0
    1E9B72A8:        0        0        2 1E865DD0        2        0 30ED8502        0
    ---- block1  ptr=1C1ED488  is_malloc=1  length=0x1AC ----
    1C1ED448:        0        0 1C1ED4FC 1C1ED4C0 1C1ED448  6D31580       69    D0000
    1C1ED468:        0        0  5781DD4  2851E0A  2851E14  6D31568        0 FD0110DF
    1C1ED488: AB1234CD FFFE0000        0  515505C  2846FA7 1C1ED534 1C1ED3F0 8000003E
    1C1ED4A8:        1        0  1000001 1C1F0F70        0        0 1C1ED450 1C1ED414
    1C1ED4C8: 1C1ED4B8  6D31580       68    D0000        0        0  5781DE8  2851E0A
    1C1ED4E8:  2851E14  6D31568        0        0        0 1C1EC668 1C1ED450 1C1ED4F4
    1C1ED508:  6D31580       6A    D0000        0        0  5781DE8  2851E0A  2851E14
    1C1ED528:  6D31568        0 FD0110DF AB1234CD FFFE0000        0  515505C  2847042
    1C1ED548: 1C1ED610 1C1ED49C 80000056        1        0  1000001 1C1F0F70        0
    1C1ED568:        0        0        0        0        0        0        0        0
    1C1ED588:        0        0        0        0        0        0        0        0
    1C1ED5A8:        0        0        0        0        0        0        0        0
    1C1ED5C8:        0        0        0        0        0        0        0        0
    1C1ED5E8:        0        0        0        0        0        0        0        0
    1C1ED608:        0 FD0110DF AB1234CD FFFE0000        0  5781DC0  28470FE 1C1ED6B8
    1C1ED628: 1C1ED548 8000003C        1
    ---- block2  ptr=9700520  is_malloc=0  length=0x100 ----
    97004E0: FFA42200 46020000  8000000 10000000 10000000 10000000 10000000 10000000
    9700500:        0   22735A        0        1        0        0        0        0
    9700520:  5010EDC        1  6005190  6005190  97B9A6C  97014F8  9700528  6D31580
    9700540:        7    10000        1        0  5010EDC  2851E0A  2851E14  6D31568
    9700560:        0  DFDCB1E   570000  DF04B36 1FEB7948 20004E20        0       EF
    9700580:   5C6802        0        0 1BFFB1E0        0        0    18000     8000
    97005A0:        0        0        0        0        0        0        0        0
    97005C0:  9700950  9700C98       1E        E        0        E        0       27
    97005E0: 1E7C2A28        0        0        0        0        0 1F1DB18C        0
    9700600:        0        0       28        F       28       28       33  9700620
    ---- block3  ptr=CD41E1C  is_malloc=0  length=0x100 ----
    CD41DDC:      D9B        0      D9B        0      D9B        0      D9B        0
    CD41DFC:      D9B        0      E1C        0      E1C        0      E1C        0
    CD41E1C:      E1C        0      E1C        0      E1C        0      E1C        0
    CD41E3C:      E1C        0      E1C        0      E1C        0      E1C        0
    CD41E5C:      E1C        0      E1C        0      E1C        0      E1C        0
    CD41E7C:      E1C        0      E9D        0      E9D        0      E9D        0
    CD41E9C:      E9D        0      E9D        0      E9D        0      E9D        0
    CD41EBC:      E9D        0      E9D        0      E9D        0      E9D        0
    CD41EDC:      E9D        0      E9D        0      E9D        0      E9D        0
    CD41EFC:      E9D        0      F1E        0      F1E        0      F1E        0
    ---- block4  ptr=1C1ED38C  is_malloc=1  length=0x150 ----
    1C1ED34C:      100 1C1ECDAC        0 1C1ED8D8 1C1EC624      100 1C1ECDAC        0
    1C1ED36C: 1C1ED3C4 1C1EC754      100        0        0        0        0 FD0110DF
    1C1ED38C: AB1234CD FFFE0000        0  53D85F8  28866DC 1C1ED3DC 1C1ECD90 80000010
    1C1ED3AC:        1        0  1000001 1C1F0F70 6D656D6F 72790000        0 5BAF9596
    1C1ED3CC: 1C1ED368        0  6000008 FD0110DF AB1234CD FFFE0000        0  515505C
    1C1ED3EC:  2846F91 1C1ED488 1C1ED3A0 8000003E        1        0  1000001 1C1F0F70
    1C1ED40C:        0        0 1C1ED4C0 1C1EC81C 1C1ED40C  6D31580       67    D0000
    1C1ED42C:        0        0  5781DD4  2851E0A  2851E14  6D31568        0        0
    1C1ED44C:        0 1C1ED4FC 1C1ED4C0 1C1ED448  6D31580       69    D0000        0
    1C1ED46C:        0  5781DD4  2851E0A  2851E14  6D31568        0 FD0110DF AB1234CD
    1C1ED48C: FFFE0000        0  515505C  2846FA7 1C1ED534 1C1ED3F0 8000003E        1
    1C1ED4AC:        0  1000001 1C1F0F70        0        0 1C1ED450 1C1ED414 1C1ED4B8
    1C1ED4CC:  6D31580       68    D0000        0
    ---- block5  ptr=36010000  is_malloc=0  length=0x100 ----
    3600FFC0:        0        0        0        0        0        0        0        0
    3600FFE0:        0        0        0        0        0        0        0        0
    36010000:        0        0        0        0        0        0        0        0
    36010020:        0        0        0        0        0        0        0        0
    36010040:        0        0        0        0        0        0        0        0
    36010060:        0        0        0        0        0        0        0        0
    36010080:        0        0        0        0        0        0        0        0
    360100A0:        0        0        0        0        0        0        0        0
    360100C0:        0        0        0        0        0        0        0        0
    360100E0:        0        0        0        0        0        0        0        0
    ---- block6  ptr=6000000  is_malloc=0  length=0x100 ----
    5FFFFC0: 3CF63C89 E4AA954C E121426E 52D198F9 4106CC9E 889F1365 E75A7785 3FA3E8A8
    5FFFFE0: AFE382E1 35B3B2F7 86F711F7 723E31F2 62DAB426 9B1B499E 35932DAC 239EE27E
    6000000: B386527C E8CAC680 6AA06340 8E041CEC   E51836 FBA90814 5FFF6A22 2B469481
    6000020: 542CB93A 262EFF02 ED38D3D2 9933F6EB 8D9E84C6 C79AE572 700CCB69 2097F464
    6000040: 63C0AD83 503D7B00 70E1CF9B 62FA2E30 5E5E7771 E5D9EE14 B8C56714 2011CE7A
    6000060: 7E5DC339 5BB9732E 1223BFA3 5844B5CD 3AA38B2D 3117E51D 35D53CF2 26759487
    6000080: 18AABB89 9C800C78 4548DD96 E6A8833D 12C4CC64 E4567430 596306BD E3B3C21A
    60000A0: F94FD83B B4F04005 2550E677 31529D9C  5EE83FD A5DAFEB2 568B58CB 380F2902
    60000C0: 8468D893 CDBC40FE  EFD658A ED416E94 25041C27 A1FDEC4C A92E2AC9 4AA45A37
    60000E0: BBA463B1 64B8D1C2 B17727E1 54998746 9E2FD10F 4ACD721B C15B0F10 8F877B0A
    ---- block7  ptr=30000000  is_malloc=0  length=0x100 ----
    2FFFFFC0: 2AB01448  6E60026 40078400 938031C0 506000D0 1B7812E8  4B4049A  20D80DB
    2FFFFFE0: 250E540D 9C074E01 154029B0  BC0E720 EA10B42F E065A00F D01EE0BE 1E20E78D
    30000000: 8909C373 E4F136FE E08FDBFE FE228CC7 8070E025 A0C3459A 1EFFF8BA 3D5C84BA
    30000020: 78402EEC BFA59B88 7F2A9F7F AAEC5CFD 756E5D84 AEB72A42 C5C04AA0 3F70A465
    30000040: 119A0F84  2169306 46D00693 65A0458B 2FA65A9D 596BE88E A7C07627 EFF13CE9
    30000060: 1DF7338E 2C429381 11402FA0 15E033B2 48D03FCE 64F0859B 4930EA4C E40194CB
    30000080: CF44E62D BBF6CD4C 2CF476C2 7826F014 EC33B171 9010EFFD 293F4C6B 3085CD30
    300000A0: 19E2F023 82B03013 67C70B3A 18F24930  C01268C 1B218863 81AE5AEC 87B7C47E
    300000C0: 78F6A946 4B2DC0F1 FDA33509 D81C5CBC C6841F9A B9FC67E9 346EB2C4 CF64D224
    300000E0: F2D3151D 1F8CA869 349E5F9C 4937C3A2  917F891 2F379CC7 C89685BD 7AD0AFA6
    ---- block8  ptr=D000000  is_malloc=0  length=0x100 ----
    CFFFFC0:        0        0        0        0        0        0        0        0
    CFFFFE0:        0        0        0        0        0        0        0        0
    D000000:        0        0        0        0        0        0        0        0
    D000020:        0        0        0        0        0        0        0        0
    D000040:        0        0        0        0        0        0        0        0
    D000060:        0        0        0        0        0        0        0        0
    D000080:        0        0        0        0        0        0        0        0
    D0000A0:        0        0        0        0        0        0        0        0
    D0000C0:        0        0        0        0        0        0        0        0
    D0000E0:        0        0        0        0        0        0        0        0
    ---- block9  ptr=31340000  is_malloc=0  length=0x100 ----
    3133FFC0:        0        0        0        0        0        0        0        0
    3133FFE0:        0        0        0        0        0        0        0        0
    31340000:        0        0        0        0        0        0        0        0
    31340020:        0        0        0        0        0        0        0        0
    31340040:        0        0        0        0        0        0        0        0
    31340060:        0        0        0        0        0        0        0        0
    31340080:        0        0        0        0        0        0        0        0
    313400A0:        0        0        0        0        0        0        0        0
    313400C0:        0        0        0        0        0        0        0        0
    313400E0:        0        0        0        0        0        0        0        0
    ---- block10  ptr=33B5631C  is_malloc=0  length=0x100 ----
    33B562DC:        0        0        0        0        0        0        0        0
    33B562FC:        0        0        0        0        0        0        0        0
    33B5631C:        0        0        0        0        0        0        0        0
    33B5633C:        0        0        0        0        0        0        0        0
    33B5635C:        0        0        0        0        0        0        0        0
    33B5637C:        0        0        0        0        0        0        0        0
    33B5639C:        0        0        0        0        0        0        0        0
    33B563BC:        0        0        0        0        0        0        0        0
    33B563DC:        0        0        0        0        0        0        0        0
    33B563FC:        0        0        0        0        0        0        0        0
    ---- block11  ptr=3490401C  is_malloc=0  length=0x100 ----
    34903FDC:        0        0        0        0        0        0        0        0
    34903FFC:        0        0        0        0        0        0        0        0
    3490401C:        0        0        0        0        0        0        0        0
    3490403C:        0        0        0        0        0        0        0        0
    3490405C:        0        0        0        0        0        0        0        0
    3490407C:        0        0        0        0        0        0        0        0
    3490409C:        0        0        0        0        0        0        0        0
    349040BC:        0        0        0        0        0        0        0        0
    349040DC:        0        0        0        0        0        0        0        0
    349040FC:        0        0        0        0        0        0        0        0
    ---- block12  ptr=515505C  is_malloc=0  length=0x100 ----
    515501C: 6E202564 20737461 7475733D 4558545F 4E45575F 564C414E        0  A446561
    515503C: 6C6C6F63 61746520 65787420 766C616E 20256400 45787420 566C616E 20444220
    515505C: 496E6974        0 6578745F 766C616E 5F676574 5F766C61 6E5F696E 666F0000
    515507C: 564C414E 25303475        0        0        0        0        0        0
    515509C:        0  A767470 5F676574 5F747275 6E6B5F69 6E666F20 6174746D 65707465
    51550BC: 64206F6E 20747275 6E6B2030 7825782C 206E6F74 20666F75 6E642069 6E207472
    51550DC: 756E6B20 6C697374        0        0        0        0        0        0
    51550FC:        0  A767470 5F766C61 6E5F6368 616E6765 5F6E6F74 69666963 6174696F
    515511C: 6E3A204D 4F444946 49454420 564C414E 20282564 2920444F 45534E27 54204558
    515513C: 49535421 21210000        0        0        0        0        0        0
    ---- block13  ptr=1C1F0F70  is_malloc=0  length=0x100 ----
    1C1F0F30: 1C1F0F0C 1C1EE5E0        0        0        0        0        0        0
    1C1F0F50:        0        0        0        0 15A3C78B        1  288C988 1C1EE8B8
    1C1F0F70:        0  1000001 1C1F25ED      301  2861A94        0  1000000        0
    1C1F0F90: 1C1F0F28 1C1F0F70 1C1EE5E0        0        0        0        0        0
    1C1F0FB0:        0        0        0        0        0        0 FD0110DF AB1234CD
    1C1F0FD0: FFFE0000       

  • EEM event_register_interface detector issue

    hi,
    Im working on a EEM policy for some of my routers using TCL, this policy checks for the txload value of an interface and reports the value with a syslog message, this policy is already in the eem scriptiong community so as least im sure that im in the right direction.
    This is my policy right now for testing, as you can see its pretty simple:
    ::cisco::eem::event_register_interface name serial1/0 parameter txload poll_interval 5 entry_op ge entry_val 192 entry_val_is_increment FALSE entry_type value
    action_syslog msg "event triggered"
    However it doesn't works, i have tried this code on 2811 and 7200 routerswith 12.4 ios image and i cant get it working, i have been using other kind of detectors (counters, timers, cli, etc) and they are working fine.
    thanks all for your replies.

    Thanks joseph for your reply,
    I applied the policy as you said, however it didn't work, I tested the policy on a 2801 router in a lab enviroment. I have included some output from the router. I have implemented another policy with a timer detector as a workaround, meanwhile I get some other IOS image for testing and production enviroment.
    R1#sh event manager policy registered
    No.  Class   Type    Event Type          Trap  Time Registered           Name
    1    script  user    interface           Off   Sun Apr 17 11:54:26 2011  ifreporter.tcl
    name {serial0/2/0} parameter {txload} entry_op ge entry_val 192 entry_val_is_increment FALSE poll_interval 70.000
    nice 0 queue-priority normal maxrun 20.000
    R1#sh ver
    Cisco IOS Software, 2801 Software (C2801-ADVIPSERVICESK9-M), Version 12.4(19), RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2008 by Cisco Systems, Inc.
    Compiled Fri 29-Feb-08 20:54 by prod_rel_team
    ROM: System Bootstrap, Version 12.3(8r)T9, RELEASE SOFTWARE (fc1)
    R1 uptime is 48 minutes
    System returned to ROM by reload at 11:48:07 cst Sun Apr 17 2011
    System image file is "flash:c2801-advipservicesk9-mz.124-19.bin"

  • Multiple EEM consecutive policy of processing a single event

    Hi!
    Please help me understand.
    I do not quite understand the algorithm of MULTIPLE CONSECUTIVE policies are processed the SAME event.
    As happens so that a policy ends and the other is called?
    As ONE policy is activated understandable.  It ends with some "exit status" which affects the execution of "default action".
    But as a start for the first second policy and what is the relationship between "exit status" and "entry status"?
    This is the same and "exit status" stored in _entry_status system variable, after execution first policy,
    and then verified by a second policy the of "entry status"?

    Exactly Joseph!
    I agree with you and checked.
    But here is what is written in the documentation:
    "sync (Mandatory)
    A “yes” means that the policy (the event publish) will
    run synchronously with the CLI command; a “no” means that the
    event publish will be performed asynchronously with the CLI
    command. The event detector will be notified when the policy
    completes running. The exit status of the policy indicates whether
    or not the CLI command should be executed: if the exit status is
    zero, which means that the policy is executed successfully, the CLI
    command will not be executed; otherwise, the CLI command will be
    executed."
    "Exit status" no effect in async mode, policies and cli command are executed independently.
    It would be correct to replace the words synchronously and asynchronously,
    replaced by an regardless and independly of the EEM policy.
    Thanks!

  • Cat 3750 and EEM

    HI,
    I have a 3750 as below and it doesnt seem to have eem commands on it.
    I thought EEM was supported for this platform,IOS version and Package level?
    Any Ideas?
    Cisco IOS Software, C3750 Software (C3750-IPBASEK9-M), Version 12.2(53)SE2, RELEASE SOFTWARE (fc3)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2010 by Cisco Systems, Inc.
    System image file is "flash:c3750-ipbasek9-mz.122-53.SE2.bin"

    Is this definitely not a defect that the CLI commands are disabled?
    I have the same issue and when i look at the processes i get this:
    #show process | inc EEM
       9 Mwe  1CF14D8          49       971      50  7708/9000    0 EEM ED Syslog
      57 Mwe  1CD7DB0      286447   1855661     154  7700/9000    0 EEM ED ND
      58 Mwe  1CC7330           0       187       0  7676/9000    0 EEM ED Identity
      59 Mwe  1CC7330           0       333       0  7668/9000    0 EEM ED MAT
    282 Mwe  1CDE97C           0         2       0  7852/9000    0 EEM ED Routing
    288 Mwe  1C82058           9        53     169  4556/6000    0 EEM Server
    289 Mwe  1CA2888           0         2       0  5100/6000    0 EEM Policy Direc
    291 Mwe  1CC7330           0         2       0  7820/9000    0 EEM ED CLI
    292 Mwe  1CC7330           0         3       0  7824/9000    0 EEM ED Counter
    293 Mwe  1CC7330           0         3       0  7820/9000    0 EEM ED Interface
    294 Mwe  1CC7330           0         3       0  7824/9000    0 EEM ED IOSWD
    295 Mwe  1CC7330           0         3       0  7820/9000    0 EEM ED None
    296 Mwe  1CC7330           0         3       0  7824/9000    0 EEM ED OIR
    298 Mwe  1CC7330           0         3       0  7824/9000    0 EEM ED SNMP
    299 Mwe  1CC7330           0         3       0  7824/9000    0 EEM ED SNMP Obje
    300 Mwe  1CC7330           0         3       0  7824/9000    0 EEM ED Ipsla
    301 Mwe  1CEE868           0         2       0  7856/9000    0 EEM ED SNMP Noti
    302 Mwe  1CC7330       11653    150780      77  7624/9000    0 EEM ED Timer
    Looks like all the event detector processes are running and getting invoked. The syslog one has been invoked 971 times for example.
    Does the auto smart ports feature use all of these? Also the policies are for eem 3.2 not eem 2.4 which is what is in the feature navigator. Would be really nice to be able to have cli access to these processes seeing as they are running.

  • Save File on Flash without delete last one with EEM

    Hi.
    I trying to configure an EEM for save the "ip cache flow" on Flash memory, but when the threshold is reached repeatedly the last file saved is "overwrite"... I need save a copy for every event.
    Somebody could help me please, its a little urgent   :P
    Thanks..

    Here is some Tcl code that you can add to your EEM policy to do file rotation.  This assumes all files will be written to flash:flows and all files are named respective to date so that when you sort, the oldest file is last:
    set files [lsort [glob flash:flows/*]]
    set size 0
    foreach file in $files {
        set size [expr $size + [file size $file]]
    if { $size > $threshold } {
        file delete -force [lindex $files end]

  • EEM Scripting for error and drop counters

    Hi,
    We want to check the following counters for drops every 5 minutes and generate an alarm if a certain threshold of errors (example: increment of 100 in the error/drop counters in the last 5 minutes) is overcome:
    My sample script is inline, i'm missing how to parse and generate the alarm if the threshold is surpassed:
    Example command:
    SPLAB_7600_3#remote command module 4 show platform hardware drops | include Selene|drp                
    ------ Selene 0 Channel 0 ------
    Selene Ingress Drop Counters Ch[0]
    Selene Egress Drop Counters Ch[0]
        egr_tot_fifo_drp_ctr                          25
    Selene Drop Counters
    ------ Selene 1 Channel 0 ------
    Selene Ingress Drop Counters Ch[0]
    Selene Egress Drop Counters Ch[0]
    Selene Drop Counters
    Best Regards,
    Afonso
    ::cisco::eem::event_register_timer watchdog time $check_interval nice 1
    # EEM policy to monitor a internal counters
    # August 2012, Cisco Systems
    # Copyright (c) 2012 by cisco Systems, Inc.
    # All rights reserved.
    namespace import ::cisco::eem::*
    namespace import ::cisco::lib::*
    # 2. Execute the counter show commands
    if [catch {cli_open} result] {
        error $result $errorInfo
    } else {
        array set cli1 $result
    if [catch {cli_exec $cli1(fd) "enable"} result] {
        error $result $errorInfo
    if [catch {cli_exec $cli1(fd) "cisco"} result] {
        error $result $errorInfo
    # - - - - - -  Interface error counters
    if [catch {cli_exec $cli1(fd) "remote command module x show platform hardware selene np-idx 0 counters | include drop"} result] {
            error $result $errorInfo
    set egr_drp_ctr $result
    #- Parsing and conditional programming for the generation of traps based on the drop value extracted from the show command
    action_syslog priority info msg "Counter Alarm"
    #Exit
    if [catch {cli_exec $cli1(fd) "end"} result] {
        error $result $errorInfo

    I believe this is what you are looking for:
    set egr_drp_ctr $result
    expr {$egr_drp_ctr + 100} sumof
    if {$egr_drp_ctr >= $sumof}
        puts "Alarm"
    It may need correction on the syntax , but thats the logic.

  • 28xx/12.4(25b) - Not able to append EEM CLI output to flash

    Hi,
    I am trying to use EEM on a 2800 running 12.4(25b) Adv IP,  to capture some output, when a particular syslog message is seen. When the syslog is seen, EEM runs but bails out, since it cannot write to flash.
    router#sh ver | i IOS
    Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(25b), RELEASE SOFTWARE (fc1)
    router#
    My EEM policy:
    event manager applet EEM-TEST
    event syslog pattern "TRACKING-5-STATE: 1 rtr 999999 state Up->Down"
    action 1.0 cli command "enable"
    action 2.0 cli command "ping 4.2.2.2 source Loopback0 | append flash:EEM"
    action 3.0 cli command "traceroute 4.2.2.2 source Loopback0 | append flash:EEM"
    action 4.0 cli command "ping 4.2.2.2 | append flash:EEM"
    action 5.0 cli command "traceroute 4.2.2.2 | append flash:EEM"
    action 6.0 cli command "more flash:EEM.txt"
    When the event occurs, I see the event in below command, which confirms EEM runs:
    router#sh event manager history events detailed
    Load for five secs: 7%/1%; one minute: 8%; five minutes: 9%
    Time source is NTP, 14:54:44.748 PDST Mon Aug 29 2011
    No.  Time of Event             Event Type          Name
    1    Sun Aug28  22:07:08 2011  syslog              applet: EEM-TEST
    msg {Aug 28 22:07:08.063: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
    2    Sun Aug28  22:09:38 2011  syslog              applet: EEM-TEST
    msg {Aug 28 22:09:38.067: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
    3    Mon Aug29  04:06:39 2011  syslog              applet: EEM-TEST
    msg {Aug 29 04:06:39.943: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
    4    Mon Aug29  09:36:41 2011  syslog              applet: EEM-TEST
    msg {Aug 29 09:36:41.057: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
    5    Mon Aug29  12:24:11 2011  syslog              applet: EEM-TEST
    msg {Aug 29 12:24:11.675: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
    6    Mon Aug29  14:26:37 2011  syslog              applet: EEM-TEST
    msg {Aug 29 14:26:37.162: %TRACKING-5-STATE: 1 rtr 999999 state Down->Up}
    7    Mon Aug29  14:30:12 2011  syslog              applet: EEM-TEST
    msg {Aug 29 14:30:12.167: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
    8    Mon Aug29  14:37:12 2011  syslog              applet: EEM-TEST
    msg {Aug 29 14:37:12.176: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
    9    Mon Aug29  14:44:12 2011  syslog              applet: EEM-TEST
    msg {Aug 29 14:44:12.186: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
    10   Mon Aug29  14:48:42 2011  syslog              applet: EEM-TEST
    msg {Aug 29 14:48:42.192: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down}
    router#
    I did a "debug event manager action cli" and see below, which explains why flash does not have a 'EEM' file created:
    Aug 29 14:48:42.192: %TRACKING-5-STATE: 1 rtr 999999 state Up->Down
    Aug 29 14:48:42.196: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : CTL : cli_open called.
    Aug 29 14:48:42.196: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  :
    Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
    Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
    Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
    Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router>
    Aug 29 14:48:42.208: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  : >enable
    Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
    Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
    Aug 29 14:48:42.220: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  : #ping 4.2.2.2 source Loopback0 | append flash:EEM
    Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :                                                                                       ^
    Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
    Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
    Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
    Aug 29 14:48:42.232: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  : #traceroute 4.2.2.2 source Loopback0 | append flash:EEM
    Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :                                                                                                 ^
    Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
    Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
    Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
    Aug 29 14:48:42.244: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  : #ping 4.2.2.2 | append flash:EEM
    Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :                                                       ^
    Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
    Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
    Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
    Aug 29 14:48:42.260: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  : #traceroute 4.2.2.2 | append flash:EEM
    Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :                                                                ^
    Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
    Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
    Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
    Aug 29 14:48:42.272: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  : #more flash:EEM.txt
    Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT :
    Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : %Error opening flash:EEM.txt (File not found)
    Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : OUT : router#
    Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : IN  : #exit
    Aug 29 14:48:42.288: %HA_EM-6-LOG: EEM-TEST : DEBUG(cli_lib) : : CTL : cli_close called.
    router#
    Looks like parser does not like the flash:EEM part. I don't know why.
    Some information on the file system and flash:
    router#sh file systems
    Load for five secs: 5%/1%; one minute: 7%; five minutes: 8%
    Time source is NTP, 14:39:27.976 PDST Mon Aug 29 2011
    File Systems:
         Size(b)     Free(b)      Type  Flags  Prefixes
               -           -    opaque     rw   archive:
               -           -    opaque     rw   system:
               -           -    opaque     rw   null:
               -           -   network     rw   tftp:
    *   64016384    16502784      disk     rw   flash:#
          245752      143748     nvram     rw   nvram:
               -           -    opaque     wo   syslog:
               -           -    opaque     rw   xmodem:
               -           -    opaque     rw   ymodem:
               -           -   network     rw   rcp:
               -           -   network     rw   pram:
               -           -   network     rw   ftp:
               -           -   network     rw   http:
               -           -   network     rw   scp:
               -           -   network     rw   https:
               -           -    opaque     ro   cns:
    router#show flash: all    
    Load for five secs: 6%/1%; one minute: 8%; five minutes: 9%
    Time source is NTP, 14:54:13.851 PDST Mon Aug 29 2011
    -#- --length-- -----date/time------ path
    1     38187152 Jan 27 2010 17:17:40 -08:00 c2800nm-advipservicesk9-mz.124-25b.bin
    2         1826 Aug 22 2006 12:55:44 -07:00 sdmconfig-28xx.cfg
    3      4734464 Aug 22 2006 12:56:10 -07:00 sdm.tar
    4       833024 Aug 22 2006 12:56:26 -07:00 es.tar
    5      1052160 Aug 22 2006 12:56:44 -07:00 common.tar
    6         1038 Aug 22 2006 12:57:00 -07:00 home.shtml
    7       102400 Aug 22 2006 12:57:16 -07:00 home.tar
    8       491213 Aug 22 2006 12:57:34 -07:00 128MB.sdf
    9      1684577 Aug 22 2006 12:58:02 -07:00 securedesktop-ios-3.1.1.27-k9.pkg
    10      398305 Aug 22 2006 12:58:22 -07:00 sslclient-win-1.1.0.154.pkg
    11        4039 Sep 18 2006 14:03:12 -07:00 running-config
    12         660 Jan 14 2009 16:46:34 -08:00 vlan.dat
    16502784 bytes available (47513600 bytes used)
    ******** ATA Flash Card Geometry/Format Info ********
    ATA CARD GEOMETRY
       Number of Heads:       8    
       Number of Cylinders    490  
       Sectors per Cylinder   32   
       Sector Size            512  
       Total Sectors          125440
    ATA CARD FORMAT
       Number of FAT Sectors  62   
       Sectors Per Cluster    8    
       Number of Clusters     15629
       Number of Data Sectors 125301
       Base Root Sector       231  
       Base FAT Sector        107  
       Base Data Sector       263  
    ATA MONLIB INFO
       Image Monlib size = 61400
       Disk monlib size = 54784
       Name = piptom-atafslib-m
       Monlib Start sector = 2
       Monlib End sector = 100
       Monlib updated by = C2800NM-IPBASE-M12.3(8)T8
       Monlib version = 1
    router#
    Thanks
    Shimol

    Hi,
    Is there an EEM file present on flash?
    I'm just guessing but it seems as though you would need to do something along the lines of:
    Original
    action 2.0 cli command "ping 4.2.2.2 source Loopback0 | append flash:EEM"
    Proposed
    action 1.9 cli command "delete /force flash:EEM"
    action 2.0 cli command "ping 4.2.2.2 source Loopback0"
    action 2.1 cli command "more $_cli_result | append flash:EEM"
    Again, just a guess.
    Thanks!
    Addendum:
    It is not possible to "more" a variable nor can you pipe ping.  So to achieve the desired result you will need to use Tcl.  When EEM 4.0 is released there may be some additional file manipulation abilities.

  • Unknown traps from EEM - parsing in Spectrum

    I have a Cat6509 device sending EEM traps to our CA Spectrum monitoring system.
    I've downloaded, compiled, and loaded the EEM MIB from Cisco, but some of the traps coming in aren't being parsed, as their OIDs don't map to the EEM MIB.
    This is the "Unknown trap" that Spectrum sees:
    Unknown alert received from device uwb485as0101.us.net.intra of type SwCiscoIOS. Device Time 288+16:21:43. (Trap type 1.3.6.1.4.1.9.10.91.6.2)
    Trap var bind data:
    OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.2.397  Value:  71
    OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.3.397  Value:  0
    OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.4.397  Value:  0
    OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.5.397  Value:  0
    OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.7.397  Value:  EEM Policy Director
    OID:  1.3.6.1.4.1.9.10.91.1.2.3.1.11.397  Value:  Output packet Drops on GigabitEthernet2/21 are incrementing by more than 10
    (The text in the last line is just for testing, and isn't necessarily the actual message.)
    The EEM MIB only goes up to 1.3.6.1.4.1.9.10.91.3, so Spectrum isn't handling this trap as we would like.
    Thank you for any guidance you can provide.
    Joe

    This looks like a potential problem with your NMS.  It looks like maybe it's building the trap OID incorrectly.  The 6.2 looks like the generic trap number and specific trap number (i.e. cEventMgrPolicyEvent).  Post a sniffer trace of the raw trap to confirm if the device is sending the wrong trap.

  • Stopping EEM/TCL script

    How can I stop a pending EEM/TCL script?  I have a Catalyst 4506 version 12.2(40)SG.  The command 'event manager scheduler clear' isn't available.  The output of 'show event manager policy pending' shows:
    No.  Time of Event             Event Type          Name
    1    Wed Mar 3  09:39:31 2010  none                script: test_err.tcl
    2    Wed Mar 3  10:56:42 2010  timer watchdog      script: free_mem.tcl
    3    Wed Mar 3  11:43:19 2010  syslog              applet: Login-Fail
    So the policies coming after the stuck policy won't run.  I've tried to un-register/re-register the policy, but it didn't help.

    If your device does not support "event manager scheduler clear" the only way to terminate a stuck, or long-running EEM policy is to reboot.

  • EEM TCL Policies

    All,
    I am attempting to write a TCL based EEM policy to force users that entering config mode on the router to enter a ticket number from my company's service management platform, since any changes they make to a production system should be tied to either an incident or approved change.  I've got this working based on a TCL script I found on Cisco Beyond.  I utilize a product from Solarwinds (Network Configuration Manager or NCM) to make mass changes across my router install base.  I don't want the credentials that the NCM product uses to have to enter a ticket number as it complicates programming responses on that platform.  I can do it if necessary, but I was hoping there might be a way to make it so that if user "x" is entering config mode the TCL script could bypass the other actions and not prompt for a ticket number.  If this were not an EEM TCL policy I could simply perform an exec command to show users and parse the active line to get the username, then do a regexp match and if it were the NCM user set a flag and use if statements to bypass the other code.  But because it's an EEM TCL policy, exec is available to me, only cli_open, cli_exec, cli_close, which actually opens a new session to the router which negates my previous idea since it's not the actual session of the user that's trying to enter config mode that the show users command would be executing against.  If anyone has any other ideas on how I might do this I'd appreciate the feedback.  Thanks.
    Mike

    Joe,
    Thanks for the response.  I've added your example to the script (modifying for the NCM Username of course), but I'm getting an error I'm not sure how to handle.  The following is what I'm getting:
    invalid command name "*"
        while executing
        invoked from within
    "$slave eval $Contents"
        (procedure "eval_script" line 7)
        invoked from within
    "eval_script slave $scriptname"
        invoked from within
    "if {$security_level == 1} {       #untrusted script
         interp create -safe slave
         interp share {} stdin slave
         interp share {} stdout slave
        (file "system:/lib/tcl/base.tcl" line 50)
    Tcl policy execute failed: invalid command name "*"
    It seems to be trying the execute the wild card in the regular expression used in the cli_exec command.  I'm not familiar enough with TCL to debug this and figure out how to fix it.  If you have any ideas on the matter I'd appreciate it.  Your guidance would be most welcome.  Thanks.
    Mike

  • EEM Script (TCL) to run 3 times in a day

    HI All,
    Need your kind help..
    I am just new to EEM. I want run a script through which router automatically sends formated outputs thrice in a day ( 00:00 hrs,08:00 hrs and 16:00 hrs)
    Can anyone help me out how to register the script so that i will get desred output.
    i just modified the script downloaded from cisco [PFA]
    after running the script mannually am getting the below log on console
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl: no such file or directory
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:     invoked from within
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl: "source [file join $dir tclIndex]"
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:     invoked from within
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl: "$slave eval $Contents"
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:     (procedure "eval_script" line 7)
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:     invoked from within
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl: "eval_script slave $scriptname"
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:     invoked from within
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl: "if {$security_level == 1} {       #untrusted script
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:      interp create -safe slave
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:      interp share {} stdin slave
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:      interp share {} stdout slave
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl: ..."
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl:     (file "tmpsys:/lib/tcl/base.tcl" line 50)
    *Mar 13 05:05:00.259: %HA_EM-6-LOG: cpu-test.tcl: Tcl policy execute failed: EEM Policy Error: Variable Execution-time has not been defined

    HI Joseph,
    I am getting below msg on console.
    IST: %HA_EM-6-LOG: cpu-test.tcl: invalid command name "else"
    IST: %HA_EM-6-LOG: cpu-test.tcl:     while executing
    IST: %HA_EM-6-LOG: cpu-test.tcl: "else "
    IST: %HA_EM-6-LOG: cpu-test.tcl:     invoked from within
    IST: %HA_EM-6-LOG: cpu-test.tcl: "$slave eval $Contents"
    IST: %HA_EM-6-LOG: cpu-test.tcl:     (procedure "eval_script" line 7)
    IST: %HA_EM-6-LOG: cpu-test.tcl:     invoked from within
    IST: %HA_EM-6-LOG: cpu-test.tcl: "eval_script slave $scriptname"
    IST: %HA_EM-6-LOG: cpu-test.tcl:     invoked from within
    IST: %HA_EM-6-LOG: cpu-test.tcl: "if {$security_level == 1} {       #untrusted script
    IST: %HA_EM-6-LOG: cpu-test.tcl:      interp create -safe slave
    IST: %HA_EM-6-LOG: cpu-test.tcl:      interp share {} stdin slave
    IST: %HA_EM-6-LOG: cpu-test.tcl:      interp share {} stdout slave
    IST: %HA_EM-6-LOG: cpu-test.tcl: ..."
    IST: %HA_EM-6-LOG: cpu-test.tcl:     (file "tmpsys:/lib/tcl/base.tcl" line 50)
    IST: %HA_EM-6-LOG: cpu-test.tcl: Tcl policy execute failed: invalid command name "else"
    Below is the configuration on Switch
    ============================
    XXXXXXXXXX#sh run | in event
    event manager environment email_server x.x.x.x
    event manager environment email_from [email protected]
    event manager environment email_to [email protected]
    event manager directory user policy "bootflash:/"
    event manager policy cpu-test.tcl type user
    thanks and regards.
    DBN

  • EEM to save configuration

    hi all,
    I'm trying to make an EEM script to backup my ISR conf .
    It's ok but I need a bit more : I would like to keep history of my conf files so I need to have a different filename each time I save it
    I'm ok if it's possible with date or an increment value
    I know I can do that with "archive" but I need to do it also with EEM if possible because I need to save in different locations each time.
    Thanks
    Niko
    PS : I use ISR 3825 IOS 12.4(24)T

    you can have a look at the
    http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=1103
    Archive Config EEM policy,
    I hope this will help you,
    Marisol

  • HELP Using EEM

    Im trying to use EEM to check the output of "show interface description | include TEST" to shutdown all ports with the description TEST. Was wondering if anyone had any ideas

    Here is a .tcl EEM policy which should help.  It does some extra checking to narrow by interface type.  You can
    remove that if needed.
    Thanks.
    ::cisco::eem::event_register_none maxrun 120 default 120
    namespace import ::cisco::eem::*
    namespace import ::cisco::lib::*
    # 1. execute cli commands to gather data
    if [catch {cli_open} result] {
        error $result $errorInfo
    } else {
        array set cli1 $result
    if [catch {cli_exec $cli1(fd) "enable"} result] {
        error $result $errorInfo
    if [catch {cli_exec $cli1(fd) "show int desc | in TEST"} cli_show_int] {
        error $cli_show_int $errorInfo
    foreach line [split $cli_show_int \n] {
        set match1 [regexp {^[F|G|T][a|i|e][0-9|/]+} $line match]
        if {$match1 == 1} {
            if [catch {cli_exec $cli1(fd) "conf t"} result] {
                error $result $errorInfo
            if [catch {cli_exec $cli1(fd) "interface $match"} result] {
                error $result $errorInfo
            if [catch {cli_exec $cli1(fd) "shutdown"} result] {
                error $result $errorInfo
            if [catch {cli_exec $cli1(fd) "end"} result] {
                error $result $errorInfo
            puts "shutting interface $match"
        } else {
            puts "skipping interface $line"

Maybe you are looking for

  • Non-working find/search feature

    Neither the Find nor the Search feature works in Adobe reader (the relevant document was downloaded from an online database -- perhaps Academic Search Premier or Ebscot -- I do not recall). A message is returned that word is not found even for a word

  • Changing file Name

    Hello, I need to change the file name for images I am using in a website I am building with iWeb. The file names for the images cannot include any special characters. I have tried to change the file name as suggested through iPhoto Help. It seems to

  • Save parameters for the session

    Hello, I  am using WDP CE 7.2 and wants to store parameters in the memory for the session: In Wdp 7.0 we used: IMaintainScope maint = Utils.getScopeMaintainer(WDScopeType.SERVERSESSION_SCOPE); maint.getScope().put(<  Some object >); I cant find this

  • Airport extreme and HDD and windows 7 file sharing, Airport extreme and HDD and windows 7 file sharing

    Hi there I simply could not launch files sharing at home using airport extreme.

  • Programming assistance reqd

    student trying to write java tic tac toe game, computer is "o" player ix "x". Computer overwrites "x" placed by player. Anythoughts to cure problem