EEM - puts action fails in EEM applet/script when called via HTTP

I have an EEM script which produces some diagnostic output. The script is written to be initiated by "event manager run" and is running in sync mode. Script uses "puts" into stdout to produce the output. Everything is working fine, except when script is initiated via HTTP/HTTPS I get no output.
To reproduce the issue I have created the following applet:
event manager applet TEST1
event none sync yes
action 1 puts nonewline "SOMETEXT"
Here is output from command line (tested from console and telnet):
router#event manager run TEST1
SOMETEXT
router#
When applet is called via HTTP using http://router/level/15/exec/-/event/manager/run/TEST1/CR URL the output is empty. The test message goes to the console versus to HTTP reply.
So it looks like the stdout is not redirected to HTTP session successfully.
Any advice on why it is happening, or better yet how to fix it would be apprecaited.

Thank you. This is also what I was thinking. As you probably already know I have opened a TAC case on the matter.

Similar Messages

How can my applet communicate with servlet via HTTPS?

hi all,
I'm using jdk1.4.2_03. Tomcat 4.1.27/29.
My applet used to communicate to serlvet/JSP via http protocol. However, I wish to apply SSL in my tomcat standalone. Is there any implication towards my existing applet to servlet codes?
For example,
URL servletURL = new URL("http://www.myhost.com/Shopping");
// open connection between applet and servlet
URLConnection servletConnection = servletURL.openConnection();
servletConnection.setDoOutput(true); // allow connection do output
servletConnection.setDoInput(true); // allow connection do input
servletConnection.setUseCaches(false);
servletConnection.setRequestProperty("Content-Type", "application/octet-stream");
ObjectInputStream input = new ObjectInputStream(servletConnection.getInputStream());
resultset = (Vector)input.readObject(); //get Object from Servlet
input.close();

http://java.sun.com/j2se/1.4.2/docs/api/javax/net/ssl/HttpsURLConnection.html
I never used it though, you can check for some code here:
http://javaalmanac.com/cgi-bin/search/find.pl?words=HttpsURLConnection

Problem with redirect script when calling from external - UCCX

Hi,
I have a problem with external calls not being redirected when the call comes from an external that begins with a certain prefix on teh ANI.
The call path goes PSTN - VGW - UCM SUB - UCCX.
To give you info this should be redirected to a auto attendant on unity but it just hits the fourth option unsuccessful.
If i change it to match an internal ANI and test it works.
What trace and log do i look at to see the call coming in from the UCM and what is happening with it why this is failing when it trys to redirect a call coming from external?
I have also attached my script.
Thanks for the help.
Kev

Hi Martin Braun,
Go to GUI status which you set in the PBO of your screen,
and open "Function Keys" part.
You should have set function key F4 for a button on your GUI status,
delete this button and create with another function key again.
I hope it helps.

Use subflow or redirect step when calling another script

I have a main AA script and it calls another script when caller press option 6. When a caller presss 6 it is only transferring the call to the sub script. it does not return any values to the main script.
In this situation, is it better to use subflow or redirect step. i am think redirect step but just want to check with the user community.
thanks in advance.

Either will work. Here are a few thoughts to consider in no particular order:
Subflows count toward the originally triggered scripts' maximum step count. If you have a lot of steps, this may result in an exception. Redirecting the call restarts this counter since the newly triggered script will have its own counter.
NOTE: You might think that this is exactly why the Trigger Application step in Synchronous mode was created for. Alas, there is a bug which renders this useless in 7.0(1): CSCtd72562
Redirecting the call will result in the user hearing ringback. This would occur because of the recommended two-second delay step following the Accept step of a step to prevent a race condition. I find this to be irritating enough to shy away from it mid-way through an IVR if possible.
Subflows are more difficult to debug. You need to have sufficient code embedded in them such that you can trigger and reactively debug them.
Be sure that the redirect destination of an actual CCX Trigger (CTI Route Point). Do not set it to a value in UCM that is translated or forwarded back to CCX. This results in a race condition which CCX does not handle well.
If you were asking me as an individual my answer would be this: Is the code small enough and not reused elsewhere? If yes, then put it in the first script and avoid this topic all together. If it's reused in a bunch of places from multiple scripts and does not represent a large quantity of steps: use a subflow. Otherwise use Trigger Application if you're on a new enough version or Call Redirect if you're not.

Eem applet or script for sending email for syslog denies

I am wanting to have my isr's send an email when a certain number of deny's occur on an ace. So if i have a particular ace set up to log when tcp 3389 denied. Then the eem applet or script would track when that deny entry happens. When the deny hits on that entry reach three times, it will send an email alert. The thing i am wondering about is how to set a variable within an event syslog pattern statement. For instance, how do i say express a variable for the source ip/port in the below
config-applet)# event syslog pattern "SEC-6-IPACCESSLOGP: list 198 denied tcp 201.198.71.51(38531) -> 212.184.81.52(3389)" occurs 3
The source ip and port could rotate or change so i'd need to express that with some kind of variable. How could that be done?(or is there a better approach altogether).

I put the below script in and it takes fine but does not send email alert. Is there something more to do for configuring email sending?
event manager applet Intrusion-Tracking
event syslog pattern "SEC-6-IPACCESSLOGP:.*-> 208.195.174.115$3389$" occurs 3
action 1.0 mail server "173.16.7.2" to ".[email protected]" from ".eem@company1." subject ".intrusion_alert_from_c2900isr." body "Intrustion alert c2800isr"

EEM - Applet Help Appreciated

I am using the following applet to modify entries in two ACLs from a mobile device. Please see applet below with output from a test run:
3    applet    user    none                Off   Sun Mar 28 22:42:59 2010 rite1
policyname {rite1} sync {yes}
maxrun 60.000
action 1.0 puts "Set HostA:"
action 1.1 gets hosta
action 1.2 puts "Set HostB:"
action 1.3 gets hostb
action 1.4 cli command "enable"
action 1.5 cli command "config t"
action 1.6 cli command "ip access-list extended rite1_incoming"
action 1.7 cli command "no 10"
action 1.8 cli command "no 20"
action 1.9 cli command "10 permit ip host $hosta host $hostb"
action 2.0 cli command "20 permit ip host $hostb host $hosta"
action 2.1 cli command "ip access-list extended rite1_outgoing"
action 2.2 cli command "no 10"
action 2.3 cli command "no 20"
action 2.4 cli command "10 permit ip host $hosta host $hostb"
action 2.5 cli command "20 permit ip host $hostb host $hosta"
action 2.6 cli command "end"
action 2.7 cli command "show ip access-list | s rite1"
action 2.8 puts "$_cli_result"
action 2.9 puts ""
action 3.1 puts "-------------------------------------"
action 3.2 puts ""
action 3.3 puts "Use following packet_capture commands:"
action 3.4 puts " ritesh - show packet_capture"
action 3.5 puts " ritecl - clear packet_capture"
action 3.6 puts " ritestr - start packet_capture"
action 3.7 puts " ritestp - stop packet_capture"
action 3.8 puts ""
action 3.9 puts "-------------------------------------"
alias exec rite1 event manager run rite1
Router#rite1
Set HostA:
172.20.1.1
Set HostB:
20.1.1.1
Extended IP access list rite1_incoming
    10 permit ip host 172.20.1.1 host 20.1.1.1
    20 permit ip host 20.1.1.1 host 172.20.1.1
Extended IP access list rite1_outgoing
    10 permit ip host 172.20.1.1 host 20.1.1.1
    20 permit ip host 20.1.1.1 host 172.20.1.1
Use following packet_capture commands:
ritesh - show packet_capture
ritecl - clear packet_capture
ritestr - start packet_capture
ritestp - stop packet_capture
I use this for packet capturing with RITE on remote sites that do not warrant consistent samples. We get alerted when a specific top-talker is showing unusual high volumes of traffic and our techs are able to run the following script on the fly from mobile devices. The high-volume converstaion gets captured and we have another script that exports those onboard captures to centralized servers. The whole operation runs pretty great. The problem is that for some reason it eats a TON of process usage.
117852: Mar 28 23:03:54.197 DST: %SYS-1-CPURISINGTHRESHOLD: Threshold: Total CPU Utilization(Total/Intr): 72%/1%, Top 3 processes(Pid/Util): 199/71%, 49/0%, 81/0%
117865: Mar 28 23:04:09.128 DST: %SYS-1-CPUFALLINGTHRESHOLD: Threshold: Total CPU Utilization(Total/Intr) 1%/0%.
I"m assuming that process # 199 is dynamically created for this specific applet when it runs, as it does not seem to run on the routers at other times:
Router#show process cpu
....output omitted....
198           0           3          0 0.00% 0.00% 0.00%   0 EEM ED RPC
201       14371       99291        144 0.00% 0.00% 0.00%   0 DHCPD Receive
....output omitted....
For some reason, while the router is interacting with the user, waiting for input from the "action x.x get" commands, the processer is through the roof. Any ideas on how I could run this similar operation without taking up so much process overhead? I want to say that I could probably limit the resource usage of those specific processes maybe with ERM, but I'm currently not very familiar with ERM. Thanks for everyone's help.

Joe,
Thanks so much for converting our applet into a tcl script. It works great everywhere that we have deployed it. We did run into one issue deploying on a 3745 Router with 12.4(15)T9. When the policy was triggered, we received the following error:
error reading "stdin": Unknown error 134217728
    while executing
"gets stdin"
    invoked from within
"$slave eval $Contents"
    (procedure "eval_script" line 7)
    invoked from within
"eval_script slave $scriptname"
    invoked from within
"if {$security_level == 1} {       #untrusted script
     interp create -safe slave
     interp share {} stdin slave
     interp share {} stdout slave
    (file "tmpsys:/lib/tcl/base.tcl" line 50)
Tcl policy execute failed: error reading "stdin": Unknown error 134217728
Tcl policy execute failed: error reading "stdin": Unknown error 134217728
I also pulled the specific script that it's referencing the error from:
# base.tcl - Safe base script forinvoking safe-tcl on FM policies.
# August 2002, Jason Pfeifer
# Copyright (c) 2002, 2004-2006 bycisco Systems, Inc.
# All rights reserved.
# Current security levels:
# 0 - trusted script, safe mode not enabled
# 1 - untrusted script, safe modeenabled
####################   Procedures ##################
proc TraceVariable { fromInterp fromVartoInterp toVar } {
    set value [ interp eval $fromInterpset ::$fromVar]
    interp eval $toInterp [list set::$toVar $value]
proc eval_script { slave scriptname } {
    # Open script and evaluate it in slave
    set F [open $scriptname]
    set Contents [read $F]
    close $F
    $slave eval $Contents
#################### End of Procedures ##################
# main
# Process argv input:
set scriptname [lindex $argv 0]
set security_level [lindex $argv 1]
if {$security_level != 0 && $security_level != 1} {
    set security_level 1
#Set Security level specific parameters
set errorInfo ""
set FM_TCLLIBDIR [info library]
if {$security_level == 1} {      #untrusted script
     interp create -safe slave
     interp share {} stdin slave
     interp share {} stdout slave
     interp share {} stderr slave
     lappend global_vars auto_path
     lappend global_vars auto_oldpath
     lappend global_vars tcl_library
     foreach entry [info vars] {
         if [array exists $entry] {
             continue
         if {[lsearch -exact$global_vars $entry] >= 0} {
             continue;
         TraceVariable {} $entry slave$entry
     # uncomment to debug safe.tcl
     #::safe::setLogCmd puts stderr
     ::safe::interpInit slave
     # Hidden commands that are exposed to slave to ease restrictions.
     interp alias slave exit {} exit
     interp expose slave fconfigure
     interp expose slave socket
     eval_script slave $scriptname
     close stdin
     close stdout
     close stderr
     ::safe::interpDelete slave
} else {                          #trusted script
     interp create slave
     interp share {} stdin slave
     interp share {} stdout slave
     interp share {} stderr slave
     foreach entry [info vars] {
         if [array exists $entry] {
             continue
         TraceVariable {} $entry slave$entry
     if {[catch {::interp eval slave\
             {source [file join$FM_TCLLIBDIR init.tcl]}} msg]} {
         error "can't sourceinit.tcl into slave ($msg)"
     eval_script slave $scriptname
     interp delete slave
What ended up happening is the script stayed stuck in pending(no 'scheduler' commands in this early version of eem) and we eventually had to reboot the router(we waited until a regularly scheduled maintenance window, so it worked out fine). Since receiving this error, we haven't tried to run this particular script on this particular router. All other devices that we have deployed this on, including other 3745's running 12.4(15)T, have worked great. If anyone has some idea as to exactly what happened and what adjustments we need to perform to correct the problem, we would greatly appreciate it.
Thanks again for everyone's help.

Need help in executing EEM applet only once

Do we have any sample script for EEM applet counter ? We want applet to execute once after reload after matching a string . We tried couple of solutions like “ server suspend “( customer does not like server suspend) and event counter ( this does not allow syslog string matching ). Please let me know if there are any options.
At the router reload, match the string , bring down the interface and run this applet only once . I have been trying multiple messages in Bootup log for this for bringing the interface down.
The issue we are facing is that most of the bootup log messages can be triggered when the router is up as well which will result in triggering of the applet which is what we want to avoid.
event manager applet Interface_down
event syslog pattern "SPA removed from subslot 0/0"
trigger delay 10
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface gi0/0/0"
action 2.5 cli command "shutdown"
action 3.0 cli command "end"
event manager applet Interface_up
event syslog pattern "Bulk Sync succeeded"
trigger delay 100
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface gi0/0/0"
action 2.5 cli command "no shutdown"
action 3.0 cli command "end"
end

This is a bit dirty but you can create an applet to run at startup that creates the event detection applet. Then at the end of the detection applet, have it remove itself from the running config. This means that the applet running at startup will always create the event detection applet but the event detection applet will only ever run once for that router boot period as it deletes itself after first run.
The problem is that when you want to have one applet create another applet, you have issues with the inverted commas being correctly configured for the second applet which will cause it to run once, but fail after that. The way you can get around this is to write the applet to a text file on the flash and then copy the contents of the text file to the running config at boot. This preserves the structure of the applet being created and ensures that it will function correctly.
The following example builds the event detection applet at system restart (BUILDAPPLET) by copying the file "eventapplet.txt" to running config. The event detection applet (EVENTDETECT) detects a syslog pattern, in this case exiting global config, and runs the applet sending a puts command and outputting HELLO. The event detection applet then removes itself from the running config.
!# configure the router
conf t
!# turn off file prompting to let the BUILDAPPLET run when copying
file prompt quiet
!# create the applet that runs at system restart and copies the flash applet to the running config
event manager applet BUILDAPPLET
event syslog pattern "%SYS-5-RESTART"
action 10 cli command "en"
action 11 cli command "copy flash:eventapplet.txt running-config"
!# exit
end
!######## Create the flash file containing your run once applet ########
! enter the tclsh so we can write our applet to a file - put your event detection applet in here between the {} that you want to run once
tclsh
puts [open "flash:eventapplet.txt" w+] {
event manager applet EVENTDETECT
event syslog pattern "%SYS-5-CONFIG_I"
action 1.0 puts "HELLO"
action 2.0 cli command "en"
action 3.0 cli command "conf t"
action 4.0 cli command "no event manager applet EVENTDETECT"

Stopping EEM/TCL script

How can I stop a pending EEM/TCL script? I have a Catalyst 4506 version 12.2(40)SG. The command 'event manager scheduler clear' isn't available. The output of 'show event manager policy pending' shows:
No. Time of Event             Event Type          Name
1    Wed Mar 3 09:39:31 2010 none                script: test_err.tcl
2    Wed Mar 3 10:56:42 2010 timer watchdog      script: free_mem.tcl
3    Wed Mar 3 11:43:19 2010 syslog              applet: Login-Fail
So the policies coming after the stuck policy won't run. I've tried to un-register/re-register the policy, but it didn't help.

If your device does not support "event manager scheduler clear" the only way to terminate a stuck, or long-running EEM policy is to reboot.

EEM applet for IPSLA

Hi,
I have a scenario where i would like to execute a EEM applet for running an ip sla event when othe ip sla event is up. Just to summarize an IP sla event success should trigger anothe IP sla event. I have tried the two options below but was not able to find any debug logs.
ip sla 10
icmp-jitter x.x.x.x source-ip x.x.x.x num-packets 10
frequency 30
ip sla schedule 10 life forever start-time now
ip sla 20
icmp-jitter x.x.x.x source-ip x.x.x.x num-packets 10
frequency 30
event manager applet SLA
event timer cron cron-entry "5 * * * *"
event ipsla operation-id 10 reaction-type timeout
action 10   if $_ipsla_condition eq "Occurred"
action 15    cli command "enable"
action 20    cli command "configure term"
action 25    cli command "no ip sla schedule 20 life forever start-time now"
action 30    else
action 35    cli command "enable"
action 40    cli command "configure term"
action 45    cli command "ip sla schedule 20 life forever start-time now"
action 50   end
OR
ip sla 10
icmp-jitter x.x.x.x source-ip x.x.x.x num-packets 10
frequency 30
ip sla schedule 10 life forever start-time now
ip sla 20
icmp-jitter y.y.y.y source-ip y.y.y.y num-packets 10
frequency 30
track 1 ip lsa reachability
event manager applet SLA-1
event timer cron cron-entry "5 * * * *"
event track 1 state up
action 10 cli command "enable"
action 20 cli command "conf t"
action 30 cli command "ip sla schedule 20 life forever start-time now"
action 40 cli command "end"
event manager applet SLA-2
event timer cron cron-entry "5 * * * *"
event track 1 state down
action 10 cli command "enable"
action 20 cli command '' conf t"
action 30 cli command "no ip sla schedule 20 life forever start-time now"
action 40 cli command "end"
Regards,
Sathvik K V

Hi Joseph,
I would like to run the script pasted below during buisness hours(9am to 6pm). When two if conditions are used is it the first condition is checked and if that passes it will check the second condition.
event manager applet APP-1
event track 1 state up
action 001 cli command "enable"
action 002 cli command "show clock"
action 003 regexp "([0-9]+):[0-9]:[0-9]" $_cli_result match hour
action 004 if $hour ge 9
action 005 cli command "conf t"
action 006 cli command "ip sla 2"
action 007 cli command "icmp-echo x.x.x.x source-ip x.x.x.x"
action 008 cli command "frequency 30"
action 009 cli command "ip sla schedule 2 life forever start-time now"
action 010 end
action 011 if $hour le 18
action 012 cli command "ip sla 2"
action 013 cli command "icmp-echo x.x.x.x source-ip x.x.x.x"
action 014 cli command "frequency 30"
action 015 cli command "ip sla schedule 2 life forever start-time now"
action 016 end
event manager applet APP-2
event track 1 state down
action 10 cli command "enable"
action 20 cli command "conf t"
action 30 cli command "no ip sla 2"
action 40 cli command "end"
Regards,
Sathvik

EEM TCL script configuration issue

Hi Experts,
I need help with an EEM TCL script for the CRS platform that generates a SYSLOG message after the CPU reaches a threshold value and then stays over the threshold value for 15 minutes, I've already tryied several thing and the last TCL script that I tested generated the SYSLOG message when the CPU reaches the threshold but I can't seem to find any way to make it wait the 15 min over the threshold and then generate the message.
My current script looks like this:
::cisco::eem::event_register_wdsysmon timewin 900 sub1 cpu_tot op ge val 70
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
array set event_details [event_reqinfo]
action_syslog msg "sub1 is $event_details(sub1)"
action_syslog msg "High CPU threshold value over 70%"
puts ok
I've tryied using the 'period' option for the 'cpu_tot' variable but the TCL script was'nt recognized and couldn't be registered, and I'm using the 'timewin' option here but it seems to be wrong as it says it's the time it has for multiple sub-events to ocurr in order for the script to execute.
timewin
(Optional) Time window within which all of the subevents have to occur in order for an event to be generated and is specified in SSSSSSSSSS[.MMM] format. SSSSSSSSSS format must be an integer representing seconds between 0 and 4294967295 inclusive. MMM format must be an integer representing milliseconds between 0 and 999).
Also, the 'period' option I believe wouldn't have worked because I understand that it referrs to the time period that the script will take to monitor the CPU:
•1. cpu_tot [op gt|ge|eq|ne|lt|le] [val ?] [period ?]
op
(Optional) Comparison operator that is used to compare the collected total system CPU usage sample percentage with the specified percentage value. If true, an event is raised.
val
(Optional) Percentage value in which the average CPU usage during the sample period is compared.
period
(Optional) Time period for averaging the collection of samples and is specified in SSSSSSSSSS[.MMM] format. SSSSSSSSSS format must be an integer representing seconds between 0 and 4294967295, inclusive. MMM format must be an integer representing milliseconds between 0 and 999. If this argument is not specified, the most recent sample is used.
As I said, I couldn't try this because the script send an error when I tried to register using the following line:
::cisco::eem::event_register_wdsysmon sub1 cpu_tot op ge val 70 period 900
This is the error message that appeared:
RP/0/RP0/CPU0:CRS(config)#event manager policy test.tcl username cisco
RP/0/RP0/CPU0:CRS(config)#commit
Thu Aug 29 12:35:43.569 CDT
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
RP/0/RP0/CPU0:CRS(config)#sh conf fail
Thu Aug 29 12:35:52.427 CDT
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
event manager policy test.tcl username cisco persist-time 3600
!!% Embedded Event Manager configuration: failed to retrieve intermediate registration result for policy test.tcl
end
Anyway, to make this work I understand that I need nested TCL scripts that do the following:
•1. Monitor the CPU and when it reaches the threshold install another TCL policy that counts down 15 min.
•2. If the second TCL policy reaches zero then it should generate the SYSLOG message.
•3. Monitor the CPU while this is running and if it falls below the threshold it should stop the second TCL policy.
I don't know how I can acomplish this so if anyone can help me with this or show me another way to do this I would really appreciate it.
Thanks in advance for all your help!

Neither option is likely to do what you want. The timewin is for correlating multiple events, and period is the polling interval. What you want is to create a timer when the CPU is first detected as being high, countdown 15 minutes, then alert you. You can do this with a nested EEM policy. For example, you can add the following to your existing policy:
proc get_pol_dir { fd } {
    set res {}
    set output [cli_exec $fd "show event manager directory user policy"]
    set output [string trim $output]
    regsub -all "\r\n" $output "\n" result
    set lines [split $result "\n"]
    foreach line $lines {
        if { $line == "" } {
            continue
        if { ! [regexp {\s} $line] && ! [regexp {#$} $line] } {
            set res $line
            break
    if { $res == {} } {
        return -code error "The user policy directory has not been configured"
    return $res
if { [catch {cli_open} result] } {
    error $result $errorInfo
array set cli $result
set output [cli_exec $cli(fd) "show event manager policy registered | inc tm_alert_high_cpu.tcl"]
if { [regexp {tm_alert_high_cpu.tcl} $output] } {
    exit 0
set poldir [get_pol_dir $cli(fd)]
set polname "${poldir}/tm_alert_high_cpu.tcl"
set fd [open $polname "w"]
puts $fd "::cisco::eem::event_register_timer countdown time 900"
puts $fd "namespace import ::cisco::eem::*"
puts $fd "namespace import ::cisco::lib::*"
puts $fd "action_syslog msg \"CPU has been over 70% for 15 minutes\""
close $fd
cli_exec $cli(fd) "config t"
cli_exec $cli(fd) "event manager policy tm_lert_high_cpu.tcl username eem"
cli_exec $cli(fd) "commit"
cli_exec $cli(fd) "end"
catch {cli_close $cli(fd) $cli(tty_id)}
Additionally, you'll want another permanently configured policy that checks for a low CPU threshold. Something like:
::cisco::eem::event_register_wdsysmon sub1 cpu_tot op le val 10
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
if { [catch {cli_open} result] } {
    error $result $errorInfo
array set cli $result
cli_exec $cli(fd) "config t"
cli_exec $cli(fd) "no event manager policy tm_alert_high_cpu.tcl"
cli_exec $cli(fd) "commit"
cli_exec $cli(fd) "end"
catch {cli_close $cli(fd) $cli(tty_id)}

EEM applet does not support extended ping ?

Hi does anybody know if EEM applet does not support any extended Ping in a cli action ?
This works:
action 1000 cli command "ping ip 10.161.255.5"
These statements does not work ?
action 1000 cli command "ping ip 10.161.255.5 repeat 10 source Loopback0"
action 1000 cli command "ping vrf TESTVRF ip 10.161.255.5 repeat 20 source Loopback0"
I found another possibility how to achive extended ping in EEM like following
event manager applet ping
event none sync yes
action 100 cli command "enable"
action 101 cli command "ping" pattern "[ip]"
action 102 cli command "ip" pattern "address"
action 103 cli command "10.161.255.5" pattern "count"
action 104 cli command "20" pattern "size"
action 105 cli command "100" pattern "seconds"
action 106 cli command "2" pattern "commands"
action 107 cli command "y" pattern "interface"
action 108 cli command "Loopback0" pattern "service"
action 109 cli command "0" pattern "header"
action 110 cli command "no" pattern "data"
action 111 cli command "no" pattern "pattern"
action 112 cli command "0xABCD" pattern "Verbose"
action 113 cli command " " pattern "size"
action 114 cli command "n" event manager applet ping
bu there is also no way to specify the VRF ?
Any Ideas ?
Thx
Hubert

Hi found failure,
extended ping needs to be executed in priviledged mode, so need to enable in advance , then it works
thx Bruno for the hint
Hubert

EEM CLI Script with parameters

Hi all,
I have a requirement to write an eem cli script that can be triggered using a pattern match and take parameters.
Basically the user has to do many repetitive tasks reconfiguring interfaces regularly. So instead of having to go into each interface individually and run the config that they can write a one word command and give it params which would be for example a comma separated list of interface names and then within my script i could parse the interface names and iterate over them performing the config operation on them.
so i'm just playing around with the cli policy.
::cisco::eem::event_register_cli occurs 1 pattern "nacdrop*" sync yes enter
# Import Namespaces
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
array set arr_einfo [event_reqinfo]
set full_command $arr_einfo(msg)
puts $full_command
You can see here i want the command nacdrop to trigger this policy but when i try and run the command with arguments i get an error on the command line as its not a valid command and the policy doesnt trigger.
Ideal scenario run command
Router#nacdrop fastEthernet0/0,fastEthernet0/1,fastEthernet0/2
the script would then perform a set of config tasks on each of the 3 interfaces.
I thought the "enter" parameter to event_register_cli would do it as that is supposed to trigger the policy before the command is executed therefore before it determines it to be an invalid command. I do not have the latest version of eem however and suspect that the "enter" argument isn't being used as it isn't showing up as an option when i type ? to see what options are available although i don't get an error when registering the policy.
So my question is what version off eem was this "enter" argument introduced and will it allow me to run the policy and get around the invalid command problem.
Once i can run this policy and access the parameters to the cli command it opens up a lot for me in terms of automating repetitive tasks.
Hope someone can help.
Cheers,
Joe.

Cheer Joe. That's great. I've attached the first draft of a script i've written, maybe someone else can find it useful too.
Basically it's for if you would like to perform the same operation on many interfaces you can use an alias and give it parameters
E.G
Router#vlanmove FastEthernet0/1-8,10,13-16
Notice the params use '-' and ',' When you use dash it will perform the operation on all the interfaces in a range and then comma is just for an individual interface and as you can see above you can mix ranges with individual ones.
The above example will give the output:
Configuring Interface: FastEthernet0/1
Configuring Interface: FastEthernet0/2
Configuring Interface: FastEthernet0/3
Configuring Interface: FastEthernet0/4
Configuring Interface: FastEthernet0/5
Configuring Interface: FastEthernet0/6
Configuring Interface: FastEthernet0/7
Configuring Interface: FastEthernet0/8
Configuring Interface: FastEthernet0/10
Configuring Interface: FastEthernet0/13
Configuring Interface: FastEthernet0/14
Configuring Interface: FastEthernet0/15
Configuring Interface: FastEthernet0/16
in the attached script just replace "puts "Configuring Interface: $interfaceName"
with your configuration
e.g.
conf t
interface $interfaceName
switchport access vlan 2
and it will perform that operation on all intefaces in a range. I might update the script later to take config commands as env variables too. That would make the script more generic. But at the moment this script is useful for us as we have to regularly reconfigure interfaces.
Cheers,
Joe.

EEM applet that triggers on high CPU utilization

Hi Folks,
I am trying to create an eem applet which triggers on high cpu utilization (detected by erm).   The applet should then tftp the output from "show proc cpu sorted" to a tftp server.
I am trying to configure this on a 1841 running 124-24.T3 code
This is my config:
resource policy
policy HighGlobalCPU global
   system
    cpu total
     critical rising 5 falling 2 interval 10
    cpu process
     critical rising 5 falling 2 interval 10
! I'm not sure whether it is correct to monitor 'cpu total' or 'cpu process'.   The rising thresholds are deliberately low to maker testing easier
event manager applet ReportHighCPU
event resource policy "HighGlobalCPU"
action 1.0 cli command "show process cpu sorted 5sec | redirect tftp://192.168.1.1/highCPU$_resource_time_sent.txt"
action 2.0 syslog priority debugging msg "high cpu event detected, output tftp sent"
The problem is that I can't seem to trigger the applet.    I have generated enough traffic to push the cpu utilization to over 30% (according to 'show proc cpu'), but the applet does not appear to trigger (no syslog messages appear, and my syslog server does not receive anything).
If anyone can tell me what I've done wrong here I would be very grateful!
Thanks,
Darragh

I am just replying off the top of my head but I believe you
need to also add to your conf the line
user global HighGlobalCPU

EEM Applet - Interface bandwidth utilization

We are planning to get syslog or snmp alert for bandwidth utilization of Uplinks by EEM applet, can any bdy help me on that?
We managed to get alert for input traffic but we are not able to get alert for total bandwidth utilization ( input + output ).

This is possible with an EEM applet. I have done it on G1 ISRs with 15.1. The applet is here:
http://ephemeralportal.blogspot.jp/2014/01/eem-applet-teach-your-router-to-monitor_24.html
I usually run 12.4 on 3745s in GNS3 and they do not have the action set to do variable manipulation, so I am guessing that this is a newer feature, although I could not find what minimum version you would need on a quick search.

EEM applet to reload router after ip is unreachable over time

Hi
I am trying to create an EEM applet that will track the reachability of a group of IP addresses. The condition needs to be as followed:
If the IP addresses become unreachable for about an 1 hour 15 minutes then reload the router. I have looked at the delay command using the IP SLA option but it only delays up to 180 seconds. Any Ideas?

The applet that tracks your IP SLA objects (I'm guessing you have a tracked object that tracks a list of other objects) should configure another timer applet that counts down the time you want. For example:
event manager applet track-down event track 3 state down action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "event manager applet countdown" action 3.1 cli command "event timer countdown time 4500" action 3.2 cli command "action 1.0 reload" action 4.0 cli command "end"!event manager applet track-up event track 3 state up action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "no event manager applet countdown" action 4.0 cli command "end"

EEM - puts action fails in EEM applet/script when called via HTTP

Similar Messages

Maybe you are looking for