EEM - limiting action to 3 runs

piotr.nowacki · ‎03-19-2008

Hello everybody.

I have follen in love with EEM ;-)

I am looking for simple way (without tcl)

to limit the action to take place not more than x times.

If you monitor syslog for ios bug occurance that at some point starts generating 1 message a second you do not want to get 1 email a second until you log into the router and disable it, do you ?

Ragrds

Peter

Joe Clarke · ‎03-19-2008

You can do this with a counter applet. That is, have the counter applet what the count, then disable the other syslog applet. Here is an example (syslog applet elided as you already have this presumably):

event manager applet syslog_watch

event syslog pattern "..."

action 1.0 ...

action N.0 counter name applet_exec_counter op inc value 1

event manager applet counter_watch

event counter name applet_exec_counter entry-val 3 entry-op eq exit-val 0 exit-op eq

action 1.0 syslog msg "Disabling syslog_watch applet"

action 2.0 cli command "enable"

action 3.0 cli command "config t"

action 4.0 cli command "event manager applet syslog_watch"

action 5.0 cli command "event none"

action 6.0 cli command "end"

action 7.0 counter name applet_exec_counter op set value 0

This approach leaves the first applet configured, but sets the event detector to none so it must be manually run.

piotr.nowacki · ‎03-22-2008

Thanks a lot.

I was affraid that using another "disabling" applet is the only way.

And "maxrun" keyword looked so promissing ;-)

Regards

Peter

Joe Clarke · ‎03-22-2008

maxrun is useful when your policy needs to run for longer than the default 20 seconds. It does not allow you to control the number of runs. The disabling applet is common, and doesn't have much of a resource impact. The applet is only triggered when the counter changes.