I need an EEM for TCL script

Hello All,
This is my first time here and hope this is right place to post this:
I have a TCL script written by a very help person that sends a tone over my PA System from my CME. I would like to have an EEM script to automatically run the script at certain times a day. Please be advised this is my introduction to both TCL and EEM. Any help is appreciated.
application
service paging flash:paging_89.tcl
param prompt-1 flash:500hz.au

I don't think you can schedule this script to run using EEM. It's an IVR script, and I think it has to be configured the way you have it. I'm not an IVR expert, though. You might want to ask on one of the voice communities here if this script can be run manually. If it can, then you can use EEM to schedule it.

Similar Messages

Using EEM and TCL scripts for voice

HI all,
I'd like to use eem to check Sip dial-peer status+interface BRI status, when sip dial-peer has no answer to invite and bri interface is down the LAN interface must be shutted down. Is it possible to avhieve it using eem? I didn't find anything for eem monitoring sip dial-peers...
thanks
Massimiliano

EEM doesn't have any ability to control the data plane currently. Therefore, there is no direct voice tie-in. There is a way to do Tcl scripting of some voice operations (e.g. IVR scripts), but those do not relate to EEM.
That said, if there are some show commands which provide you the data you need, you can create an EEM timer policy (i.e. one that runs periodically), parsers the show command output, and takes further action if the output contains certain patterns. Depending on the version of IOS, this may require an EEM Tcl script, or you may be able to do it within an EEM applet.
If you need further assistance, you will need to provide your IOS version, and the exact commands (and output) which would tell you if the SIP peer isn't getting an answer and the BRI interface is truly down (I'm imagining something like "show isdn status" for this one).
Please support CSC Helps Haiti
https://supportforums.cisco.com/docs/DOC-8895
https://supportforums.cisco.com

Q: Best Method for TCL scripts to pass info between routers?

I want to have routers tell each other how busy their links are. Whats the best method to pass information between TCL scripts running on different routers?
Thanks!
Tim

Likely the easiest approach is to use SNMP traps from one router to another. See https://supportforums.cisco.com/message/3713232#3713232 for an example.

EEM and TcL Script to Disable Inactive Ports

I've browsed around to the other support strings to make sure I didn't miss anything, but I can't seem to get this to work. I have the latest sl_suspend_ports.tcl and tm_suspend_ports.tcl created by Joseph Clarke from strings that verified they worked as planned.   Here are the commands I issued to register the scripts -
Directory of flash:/policies/
    9 -rwx        3101   May 3 2013 07:58:03 +00:00 sl_suspend_ports.tcl
   10 -rwx        4669   May 3 2013 07:58:44 +00:00 tm_suspend_ports.tcl
conf t
event manager directory user policy flash:/policies
event manager policy sl_suspend_ports.tcl
event manager environment suspend_ports_days 1
event manager environment suspend_ports_config flash:/susp_ports.dat
event manager policy tm_suspend_ports.tcl
#show run | inc event manager environment
event manager environment suspend_ports_days 1
event manager environment suspend_ports_config flash:/susp_ports.dat
It doesn't appear to work though. Essentially, we have a need to make sure all computers are always on and all ports not active for >24 hours to be shutdown and moved to a designated vlan (I added the 'lappend' statement to the script to specify the additional command of assigning the vlan)
I'm running 12.2(55)SE7 on Catalyst 3560s and 3750s
Is there a way to manually run the script? Did I miss anything in the configuration?
Thanks for your help!
Chris

SUCCESS! AWESOME!
I added one more line to the lappend statements to add a description with the time stamp, here's what happened -
Port      Name               Status       Vlan       Duplex Speed Type
Fa0/2     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/3     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/4     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/5     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/6     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/7     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/8     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/9     Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
Fa0/10    Disable by Inactiv disabled     666          auto   auto 10/100BaseTX
#sh run int fa0/2
Building configuration...
Current configuration : 408 bytes
interface FastEthernet0/2
description Disable by Inactivity Script last used on Tue May 14 04:32:10 ZULU 2013
switchport access vlan 666
shutdown
end
So to recap for any future folks that stumble upon this thread and want to use this method.
1. Create a TACACS service account or use a TACACS/RADIUS account that has a high enough privilege to edit the config.
2. Create a "policies" directory on flash and copy the attached scripts to it.
3. Register the scripts using the following commands -
#conf t
(config)#event manager directory user policy flash:/policies
(config)#event manager policy sl_suspend_ports.tcl
(config)#event manager environment suspend_ports_days 1 "<--Or the number of days inactive you choose"
(config)#event manager environment suspend_ports_config flash:/susp_ports.dat
(config)#event manager policy tm_suspend_ports.tcl
(config)#event manager session cli username "svc.eemscript" "<---The account you created to run in step 1"
The output of "show event manager policy registered" should then show the following -
#show event manager policy registered
No. Class     Type    Event Type          Trap Time Registered           Secu Name
1    script    user    syslog              Off   Fri May 3 10:20:26 2013   2048 sl_suspend_ports.tcl
pattern {LINEPROTO-5-UPDOWN}
nice 0 queue-priority normal maxrun 600.000 scheduler rp_primary
2    script    user    timer cron          Off   Tue May 14 05:25:42 2013 2048 tm_suspend_ports.tcl
cron entry {0 0 * * *}
nice 0 queue-priority normal maxrun 600.000 scheduler rp_primary
NOTE: On lines 140-145 of the tm_suspend_ports.tcl file, you can edit the commands you want the script to execute to your liking. I have it adding a description as seen in the above output and moving to an isolated non-routable VLAN of my network.
Thanks Joe Clarke for the awesome script and assistance in getting it running!

Need Kick start for Java Script

Hi I am working on WAD, I need to learn Java script as early as possible. I am trying from all my sides. can u suggest me so that i can learn Java Script.

Hi,
http://www.w3schools.com/js/default.asp is a veruy good start.
Others are:
http://www.echoecho.com/javascript.htm
http://www.wdvl.com/Authoring/JavaScript/Tutorial/
Eddy
PS.
Did you put yourself on the SDN world map already? Pls check
/people/eddy.declercq/blog/2006/06/14/from-the-grumpy-old-man-hoy-en-el-mundo
for details.

EEM And Tcl scripts

Hi
Please teach me. How to implementation EEM.
I want use EEM this situation.
When gi1/1 detect down EEM scripts enable.
In case gi1/1 is up within 3 seconds then finish the EEM scripts.
Another case gi1/1 down time is over 3 seconds, Then shutdown gi1/2 and gi1/3.
IOS version 12.2(46)SG.

You have a tight time margin here, but these EEM applet policies should work:
event manager environment quote "event manager applet int-down event syslog pattern "LINEPROTO-5-UPDOWN.*GigabitEthernet1/1.*changed state to down" action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "event manager applet int-down-countdown" action 3.1 cli command "event timer countdown time 3" action 3.2 cli command "action 1.0 cli command enable" action 3.3 cli command "action 2.0 cli command $quote config t$quote" action 3.4 cli command "action 3.0 cli command $quote int gi1/2$quote" action 3.5 cli command "action 4.0 cli command $quote shutdown$quote" action 3.6 cli command "action 5.0 cli command $quote int gi1/3$quote" action 3.7 cli command "action 6.0 cli command $quote shutdown$quote" action 3.8 cli command "action 7.0 cli command $quote no event manager applet int-down-countdown$quote" action 3.9 cli command "action 8.0 cli command $quote end$quote" action 4.0 cli command "end"event manager applet int-up event syslog pattern "LINEPROTO-5-UPDOWN.*GigabitEthernet1/1.*changed state to up" action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "no event manager applet int-down-countdown" action 4.0 cli command "end"

Looking for TCL/Scripting Resource

Hey guys,
I'm looking to contract with someone that can write scripts (TCL/Csh/etc) on the Cisco gateways to do things like custom CDR, digit manipulation, IVR, etc. Can anyone point me to some good people?
Thanx,
-Tim

Contact Berbee.com or cdw.com they have good resources. Andy (Adignan) my buddy can guide you to a good contact as well.
Baseer.

Need to execute tcl script from a Java Program

Hello,
I need to execute a tcl script from a Java Program. But I do not know how to call the tcl Interpreter. Can anybody help me?

Iam using the exec command as follows:
Process proc =
rt.exec("C:/SpirentConnect/engines/tcl/8.3.4/windows/s
ctcl.exe C:/Hello.tcl");
But Hello.tcl is not executed.And does that exact string work on the command line?
And what is the return code from running it?

Running tcl script in parallel with vi code

i need to run a tcl script from within a vi but i don't want to be blocked by tcl script. right now when i call tcl script within my vi using "system exec" vi, the rest of the code in my vi does not get executed until tcl script exits. i need to run tcl script in parallel.
an equivalent operation in unix can be done by running a script in background using &.
any ideas how to do it in labview.

Go to your help menu and select Show Context Help. Move your mouse over the function. You'll now see the help for the function and you can read what the input called 'wait until completion? (T)' means.

ACE TCL Script to retrieve Cookie

I am in need to to do a post instead of a Get with a probe. So I have configured a TCL script to perform this. The issue I have is that I also need to parse the Cookie instead of the http1. response. Any ideas? Or does anyone have a variable indetifiers for TCL scripting that Cisco uses?
Thank you,
Tim

HI Thulin,
Health probe scripts have access to many configured items through a predefined TCL array. The most common use of this array is to find the current real server IP addresses of the suspect during any particular launch of the script.
Whenever the ACE executes a script probe, a special array called scriptprobe_env is passed to the script. This array holds important parameters that may be used by the script.
Member name Content
realIP
Suspect IP address
realPort
Suspect IP port
intervalTimeout
Configured probe interval in seconds
openTimeout
Configured socket open timeout for this probe (tbd)
recvTimeout
Configured socket receive timeout for this probe
failedTimeout
Configure failed timeout
retries
Configured retry count
healthStatus
Current suspect health status
contextID
The ID for the context running this script
failedRetries
Consecutive successful retries on a failed server before marking it as passed
isRouted
Boolean to determine if this IP address is a routed address
pid
Process identifier of the TCL process
runID
Pointer to the event structure (em_event_t)
Kindly refer to the following url to get more info regarding your tcl variables:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/slb/guide/script.html#wp1082112
http://www.cisco.com/univercd/cc/td/doc/solution/dc_ap11i.pdf
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/ace/ace_301/slbgd/script.pdf
Regards,
Sachin Garg

Signing byte-encoded TCL script for EEM

Good day,
I am trying to figure out how to sign a TCL script which is distributed in byte-encoded form.
The byte coding is performed with TCL pro (http://sourceforge.net/projects/tclpro/files/TclPro-1.4.1/)
Any pointers on how to do it will be much appreciated.
Regards,
Alexei

EEM 3.4 should support third party signing of Tcl policies. As to whether or not byte-code compiled policies will be supported is uncertain. However, you should be able to sign a byte-code compiled Tcl script (regular Tcl script, and not EEM policy) by putting the signature after the closing tbcload '}'. I assume the same thing will eventually be doable with EEM.

Setting the source-interface in a tcl script for email.

So once again I am trying to figure this out and failing miserably. The only thin I can think of at the moment is that I need to tell it to source from a specific vrf interface. I've tried looking through possible enviornment variables. Hoping I could set it that way but have yet to find one. I have read varios settings for source-interface and attempted them. But fail every time with:
vpn_failure.tcl: smtp_send_email: error connecting to mail server:
EEM Version:
sho event manager version
Embedded Event Manager Version 4.00
Component Versions:
eem: (rel4)1.0.4
eem-gold: (rel1)1.0.2
eem-call-home: (rel2)1.0.0
Below is the stock format for sending the email from the script. If someone could guide me in the correct way to set this up to source the interface that would be awesome.
# create mail form
action_syslog msg "Creating mail header for vpn_failure.tcl script..."
set body [format "Mailservername: %s" "$_email_server"]
set body [format "%s\nFrom: %s" "$body" "$_email_from"]
set body [format "%s\nTo: %s" "$body" "$_email_to"]
set _email_cc ""
set body [format "%s\nCc: %s" "$body" ""]
set body [format "%s\nSubject: %s\n" "$body" "VPN Failure Detected: Router $routername Crypto tunnel is DOWN. Peer $remote_peer"]
set body [format "%s\n%s" "$body" "Report Summary:"]
set body [format "%s\n%s" "$body" "   - syslog message"]
set body [format "%s\n%s" "$body" "   - summary of interface(s) in an up/down state"]
set body [format "%s\n%s" "$body" "   - show ip route $remote_peer"]
set body [format "%s\n%s" "$body" "   - show crypto isakmp sa"]
set body [format "%s\n%s" "$body" "   - show crypto session detail"]
set body [format "%s\n%s" "$body" "   - show crypto engine connection active"]
set body [format "%s\n%s" "$body" "   - show ip nhrp detail (DMVPN only)"]
set body [format "%s\n%s" "$body" "   - show log"]
set body [format "%s\n\n%s" "$body" "---------- syslog message ----------"]
set body [format "%s\n%s" "$body" "$syslog_msg"]
set body [format "%s\n\n%s" "$body" "---------- summary of interface(s) in an up/down state ----------"]
set body [format "%s\n\n%s" "$body" "$show_ip_interface_brief_up_down"]
set body [format "%s\n\n%s" "$body" "---------- show ip route $remote_peer ----------"]
set body [format "%s\n\n%s" "$body" "$show_ip_route"]
set body [format "%s\n\n%s" "$body" "---------- show crypto isakmp sa ----------"]
set body [format "%s\n\n%s" "$body" "$show_crypto_isakmp_sa"]
set body [format "%s\n\n%s" "$body" "---------- show crypto session detail ----------"]
set body [format "%s\n\n%s" "$body" "$show_crypto_session_detail"]
set body [format "%s\n\n%s" "$body" "---------- show crypto engine connection active ----------"]
set body [format "%s\n\n%s" "$body" "$show_crypto_engine_connection_active"]
set body [format "%s\n\n%s" "$body" "---------- show ip nhrp detail (DMVPN only) ----------"]
set body [format "%s\n\n%s" "$body" "$show_ip_nhrp_detail"]
set body [format "%s\n\n%s" "$body" "---------- show log ----------"]
set body [format "%s\n\n%s" "$body" "$show_log"]
if [catch {smtp_send_email $body} result] {
    action_syslog msg "smtp_send_email: $result"

I got this far, saw the MAXRUN error, bumped that out and then turned on debugging. I am still not connecting to the mail server. So I don't think I am reaching the mail server yet. I don't think it is using the sourceinterface. In debugging everyting in the script works except for the mail portion.
Jul 29 16:01:00.334: %HA_EM-6-LOG: vpn_failure.tcl: Creating mail header for vpn_failure.tcl script...
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl: Process Forced Exit- MAXRUN timer expired.
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:     while executing
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl: "action_syslog msg "smtp_send_email: $result""
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:     invoked from within
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl: "$slave eval $Contents"
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:     (procedure "eval_script" line 7)
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:     invoked from within
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl: "eval_script slave $scriptname"
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:     invoked from within
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl: "if {$security_level == 1} {       #untrusted script
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:      interp create -safe slave
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:      interp share {} stdin slave
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:      interp share {} stdout slave
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl: ..."
Jul 29 16:02:36.464: %HA_EM-6-LOG: vpn_failure.tcl:     (file "tmpsys:/lib/tcl/base.tcl" line 50)
Jul 29 16:02:36.465: %HA_EM-6-LOG: vpn_failure.tcl: Tcl policy execute failed:
Jul 29 16:02:36.465: %HA_EM-6-LOG: vpn_failure.tcl: Process Forced Exit- MAXRUN timer expired.
Debugging On:
Jul 29 16:28:51.471: [fh_smtp_debug_cmd]
Jul 29 16:28:51.472: %HA_EM-6-LOG: vpn_failure.tcl : DEBUG(smtp_lib) : smtp_connect : attempt 2
Jul 29 16:29:24.473: [fh_smtp_debug_cmd]
Jul 29 16:29:24.473: %HA_EM-6-LOG: vpn_failure.tcl : DEBUG(smtp_lib) : smtp_connect : attempt 3
Jul 29 16:29:57.475: [fh_smtp_debug_cmd]
Jul 29 16:29:57.475: %HA_EM-6-LOG: vpn_failure.tcl : DEBUG(smtp_lib) : smtp_connect : attempt 4
Jul 29 16:30:30.478: [fh_smtp_debug_cmd]
Jul 29 16:30:30.479: %HA_EM-6-LOG: vpn_failure.tcl : DEBUG(smtp_lib) : smtp_connect : attempt 5
Jul 29 16:31:00.482: %HA_EM-6-LOG: vpn_failure.tcl: smtp_send_email: error connecting to mail server:
cannot connect to all the candidate mail servers
Jul 29 16:31:00.483: %HA_EM-6-LOG: vpn_failure.tcl: vpn_failure.tcl script completed
event manager environment _email_server 10.79.1.126
event manager environment _email_from [email protected]
event manager environment _email_to [email protected]
interface Port-channel1.101
description MGMT-1
encapsulation dot1Q 101
vrf forwarding MGMT-1
ip address 10.79.1.252 255.255.255.0
ip nat inside
ip virtual-reassembly
redundancy rii 101
redundancy group 2 ip 10.79.1.254 exclusive decrement 10
end
#----------------------- send mail ----------------------
# create mail form
action_syslog msg "Creating mail header for vpn_failure.tcl script..."
set body [format "Mailservername: %s" "$_email_server"]
set body [format "%s\nFrom: %s" "$body" "$_email_from"]
set body [format "%s\nTo: %s" "$body" "$_email_to"]
set _email_cc ""
set body [format "%s\nCc: %s" "$body" "[email protected]"]
set body [format "%s\nSourceintf: %s" "$body" "port-channel1.101"]
set body [format "%s\nSubject: %s\n" "$body" "VPN Failure Detected: Router $routername Crypto tunnel is DOWN. Peer $remote_peer"]
set body [format "%s\n%s" "$body" "Report Summary:"]
set body [format "%s\n%s" "$body" "   - syslog message"]
set body [format "%s\n%s" "$body" "   - summary of interface(s) in an up/down state"]
set body [format "%s\n%s" "$body" "   - show ip route $remote_peer"]
set body [format "%s\n%s" "$body" "   - show crypto isakmp sa"]
set body [format "%s\n%s" "$body" "   - show crypto session detail"]
set body [format "%s\n%s" "$body" "   - show crypto engine connection active"]
set body [format "%s\n%s" "$body" "   - show ip nhrp detail (DMVPN only)"]
set body [format "%s\n%s" "$body" "   - show log"]
set body [format "%s\n\n%s" "$body" "---------- syslog message ----------"]
set body [format "%s\n%s" "$body" "$syslog_msg"]
set body [format "%s\n\n%s" "$body" "---------- summary of interface(s) in an up/down state ----------"]
set body [format "%s\n\n%s" "$body" "$show_ip_interface_brief_up_down"]
set body [format "%s\n\n%s" "$body" "---------- show ip route $remote_peer ----------"]
set body [format "%s\n\n%s" "$body" "$show_ip_route"]
set body [format "%s\n\n%s" "$body" "---------- show crypto isakmp sa ----------"]
set body [format "%s\n\n%s" "$body" "$show_crypto_isakmp_sa"]
set body [format "%s\n\n%s" "$body" "---------- show crypto session detail ----------"]
set body [format "%s\n\n%s" "$body" "$show_crypto_session_detail"]
set body [format "%s\n\n%s" "$body" "---------- show crypto engine connection active ----------"]
set body [format "%s\n\n%s" "$body" "$show_crypto_engine_connection_active"]
set body [format "%s\n\n%s" "$body" "---------- show ip nhrp detail (DMVPN only) ----------"]
set body [format "%s\n\n%s" "$body" "$show_ip_nhrp_detail"]
set body [format "%s\n\n%s" "$body" "---------- show log ----------"]
set body [format "%s\n\n%s" "$body" "$show_log"]
if [catch {smtp_send_email $body} result] {
    action_syslog msg "smtp_send_email: $result"
action_syslog msg "vpn_failure.tcl script completed"
#------------------ end of send mail --------------------

EEM TCL script configuration issue

Hi Experts,
I need help with an EEM TCL script for the CRS platform that generates a SYSLOG message after the CPU reaches a threshold value and then stays over the threshold value for 15 minutes, I've already tryied several thing and the last TCL script that I tested generated the SYSLOG message when the CPU reaches the threshold but I can't seem to find any way to make it wait the 15 min over the threshold and then generate the message.
My current script looks like this:
::cisco::eem::event_register_wdsysmon timewin 900 sub1 cpu_tot op ge val 70
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
array set event_details [event_reqinfo]
action_syslog msg "sub1 is $event_details(sub1)"
action_syslog msg "High CPU threshold value over 70%"
puts ok
I've tryied using the 'period' option for the 'cpu_tot' variable but the TCL script was'nt recognized and couldn't be registered, and I'm using the 'timewin' option here but it seems to be wrong as it says it's the time it has for multiple sub-events to ocurr in order for the script to execute.
timewin
(Optional) Time window within which all of the subevents have to occur in order for an event to be generated and is specified in SSSSSSSSSS[.MMM] format. SSSSSSSSSS format must be an integer representing seconds between 0 and 4294967295 inclusive. MMM format must be an integer representing milliseconds between 0 and 999).
Also, the 'period' option I believe wouldn't have worked because I understand that it referrs to the time period that the script will take to monitor the CPU:
•1. cpu_tot [op gt|ge|eq|ne|lt|le] [val ?] [period ?]
op
(Optional) Comparison operator that is used to compare the collected total system CPU usage sample percentage with the specified percentage value. If true, an event is raised.
val
(Optional) Percentage value in which the average CPU usage during the sample period is compared.
period
(Optional) Time period for averaging the collection of samples and is specified in SSSSSSSSSS[.MMM] format. SSSSSSSSSS format must be an integer representing seconds between 0 and 4294967295, inclusive. MMM format must be an integer representing milliseconds between 0 and 999. If this argument is not specified, the most recent sample is used.
As I said, I couldn't try this because the script send an error when I tried to register using the following line:
::cisco::eem::event_register_wdsysmon sub1 cpu_tot op ge val 70 period 900
This is the error message that appeared:
RP/0/RP0/CPU0:CRS(config)#event manager policy test.tcl username cisco
RP/0/RP0/CPU0:CRS(config)#commit
Thu Aug 29 12:35:43.569 CDT
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
RP/0/RP0/CPU0:CRS(config)#sh conf fail
Thu Aug 29 12:35:52.427 CDT
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
event manager policy test.tcl username cisco persist-time 3600
!!% Embedded Event Manager configuration: failed to retrieve intermediate registration result for policy test.tcl
end
Anyway, to make this work I understand that I need nested TCL scripts that do the following:
•1. Monitor the CPU and when it reaches the threshold install another TCL policy that counts down 15 min.
•2. If the second TCL policy reaches zero then it should generate the SYSLOG message.
•3. Monitor the CPU while this is running and if it falls below the threshold it should stop the second TCL policy.
I don't know how I can acomplish this so if anyone can help me with this or show me another way to do this I would really appreciate it.
Thanks in advance for all your help!

Neither option is likely to do what you want. The timewin is for correlating multiple events, and period is the polling interval. What you want is to create a timer when the CPU is first detected as being high, countdown 15 minutes, then alert you. You can do this with a nested EEM policy. For example, you can add the following to your existing policy:
proc get_pol_dir { fd } {
    set res {}
    set output [cli_exec $fd "show event manager directory user policy"]
    set output [string trim $output]
    regsub -all "\r\n" $output "\n" result
    set lines [split $result "\n"]
    foreach line $lines {
        if { $line == "" } {
            continue
        if { ! [regexp {\s} $line] && ! [regexp {#$} $line] } {
            set res $line
            break
    if { $res == {} } {
        return -code error "The user policy directory has not been configured"
    return $res
if { [catch {cli_open} result] } {
    error $result $errorInfo
array set cli $result
set output [cli_exec $cli(fd) "show event manager policy registered | inc tm_alert_high_cpu.tcl"]
if { [regexp {tm_alert_high_cpu.tcl} $output] } {
    exit 0
set poldir [get_pol_dir $cli(fd)]
set polname "${poldir}/tm_alert_high_cpu.tcl"
set fd [open $polname "w"]
puts $fd "::cisco::eem::event_register_timer countdown time 900"
puts $fd "namespace import ::cisco::eem::*"
puts $fd "namespace import ::cisco::lib::*"
puts $fd "action_syslog msg \"CPU has been over 70% for 15 minutes\""
close $fd
cli_exec $cli(fd) "config t"
cli_exec $cli(fd) "event manager policy tm_lert_high_cpu.tcl username eem"
cli_exec $cli(fd) "commit"
cli_exec $cli(fd) "end"
catch {cli_close $cli(fd) $cli(tty_id)}
Additionally, you'll want another permanently configured policy that checks for a low CPU threshold. Something like:
::cisco::eem::event_register_wdsysmon sub1 cpu_tot op le val 10
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
if { [catch {cli_open} result] } {
    error $result $errorInfo
array set cli $result
cli_exec $cli(fd) "config t"
cli_exec $cli(fd) "no event manager policy tm_alert_high_cpu.tcl"
cli_exec $cli(fd) "commit"
cli_exec $cli(fd) "end"
catch {cli_close $cli(fd) $cli(tty_id)}

TCL script help needed on Nexus7000 !

Does anyone know how to create a TCL script on Nexus7000 switch for following scenario ? Need urgent help here.. :-
Here is what I am trying to do :-
1. Whenever following log on "show log log" prints out :-
testnexus7000 %PIXM-2-PIXM_SYSLOG_MESSAGE_TYPE_CRIT:
2. Print out the output of show system internal pixm errors
And look for following line :-
[102] pixm_send_msg_mcast(1208): MTS Send to LC X failed >> where X is 0 based
and this error can occur multiple times for different LCs too.
4. Reload line card (s) X and syslog " task done"
Regards
Vijaya

Hi,
Vijaya I found same post on support cisco forums So people helped someone in same question !!!!!!
Please read it ....
https://supportforums.cisco.com/thread/2128886
Yes plus if u can help me in ......Cisco ASA same security problem than that will be good for me .....I will contact u and will be great help for me if u help
Hope that link help u .....
Bye,

Eem applet or script for sending email for syslog denies

I am wanting to have my isr's send an email when a certain number of deny's occur on an ace. So if i have a particular ace set up to log when tcp 3389 denied. Then the eem applet or script would track when that deny entry happens. When the deny hits on that entry reach three times, it will send an email alert. The thing i am wondering about is how to set a variable within an event syslog pattern statement. For instance, how do i say express a variable for the source ip/port in the below
config-applet)# event syslog pattern "SEC-6-IPACCESSLOGP: list 198 denied tcp 201.198.71.51(38531) -> 212.184.81.52(3389)" occurs 3
The source ip and port could rotate or change so i'd need to express that with some kind of variable. How could that be done?(or is there a better approach altogether).

I put the below script in and it takes fine but does not send email alert. Is there something more to do for configuring email sending?
event manager applet Intrusion-Tracking
event syslog pattern "SEC-6-IPACCESSLOGP:.*-> 208.195.174.115$3389$" occurs 3
action 1.0 mail server "173.16.7.2" to ".[email protected]" from ".eem@company1." subject ".intrusion_alert_from_c2900isr." body "Intrustion alert c2800isr"

I need an EEM for TCL script

Similar Messages

Maybe you are looking for