Need help in executing EEM applet only once

Question

Do we have any sample script for EEM applet counter ?  We want applet to execute once after reload after matching a string . We tried couple of solutions like “ server suspend  “( customer does not like server suspend)   and event counter ( this does not allow syslog string matching ). Please let me know if there are any options.
At the router reload, match the string , bring down the interface and run this applet only once . I have been trying multiple messages in Bootup log for this for bringing the interface down.
The issue we are facing is that most of the bootup log messages can be triggered when the router is up as well which will result in triggering of the applet which is what we want to avoid.
event manager applet Interface_down
event syslog pattern "SPA removed from subslot 0/0"
trigger delay 10
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface gi0/0/0"
action 2.5 cli command "shutdown"
action 3.0 cli command "end"
event manager applet Interface_up
event syslog pattern "Bulk Sync succeeded"
trigger delay 100
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface gi0/0/0"
action 2.5 cli command "no shutdown"
action 3.0 cli command "end"
end

Answer 1

This is a bit dirty but you can create an applet to run at startup that creates the event detection applet. Then at the end of the detection applet, have it remove itself from the running config. This means that the  applet running at startup will always create the event detection applet but the event detection applet will only ever run once for that router boot period as it deletes itself after first run.
The problem is that when you want to have one applet create another applet, you have issues with the inverted commas being correctly configured for the second applet which will cause it to run once, but fail after that. The way you can get around this is to write the applet to a text file on the flash and then copy the contents of the text file to the running config at boot. This preserves the structure of the applet being created and ensures that it will function correctly.
The following example builds the event detection applet at system restart (BUILDAPPLET)  by copying the file "eventapplet.txt" to running config. The event detection applet (EVENTDETECT) detects a syslog pattern, in this case exiting global config, and runs the applet sending a puts command and outputting HELLO. The event detection applet then removes itself from the running config.
!# configure the router
conf t
!# turn off file prompting to let the BUILDAPPLET run when copying
file prompt quiet
!# create the applet that runs at system restart and copies the flash applet to the running config
event manager applet BUILDAPPLET
 event syslog pattern "%SYS-5-RESTART"
 action 10 cli command "en"
 action 11 cli command "copy flash:eventapplet.txt running-config"
!# exit
end
!######## Create the flash file containing your run once applet ########
! enter the tclsh so we can write our applet to a file - put your event detection applet in here between the {} that you want to run once
tclsh
puts [open "flash:eventapplet.txt" w+] {
event manager applet EVENTDETECT
 event syslog pattern "%SYS-5-CONFIG_I"
 action 1.0 puts "HELLO"
 action 2.0 cli command "en"
 action 3.0 cli command "conf t"
 action 4.0 cli command "no event manager applet EVENTDETECT"