cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4138
Views
5
Helpful
20
Replies

EEM: Set variable from syslog message

stewart-smith
Level 1
Level 1

Hi all,

I was wondering if it is possible to put the output of a syslog message generated from a TCL script into variable and trim that to only get a subset of the syslog message.

I believe the logic would be like this but still trying to translate it to EEM:

set a (show log | incl % IVR)

set b (string a 4555)

# we only want 4555 from the syslog message

And then put b into a CLI command.

Is that possible? Or do I need to write to a file instead and parse the file for that message and put it into the variable?

Thank you in advance for any suggestions.

3 Accepted Solutions

Accepted Solutions

Okay, cool. Then everything you want can be done in applets given that you are running EEM 3.0:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 001 regexp ": ([0-9]+)" $_syslog_msg ignore pnum

action 002 syslog msg "Phone number is $pnum"

action 003 cli command "enable"

action 004 cli command "do something with $pnum"

...

View solution in original post

No. You will need to convert to Tcl on any platform not running EEM 3.0 (i.e. < 12.4(22)T). Here is a rough Tcl version.

View solution in original post

You need to remove the applet entirely. It has no use on EEM < 3.0. The Tcl policy replaces the whole thing.

Modify the Tcl script so that it runs the desired CLI commands.

Then, you need to decide configure your EEM policy directory. This is the directory in which sl_ivr_runner.tcl exists on the device (e.g. flash:/policies). The command to add is:

event manager directory user policy DIRECTORY

Where DIRECTORY is your policy directory.

Once all of those steps are done, then the policy will work just like the applet does.

View solution in original post

20 Replies 20

Joe Clarke
Cisco Employee
Cisco Employee

You could certainly do this with EEM. You don't even need to parse the show log output as you can have an EEM policy trigger on a syslog message. Your example here is a bit rigid, but if you supply more general details about the nature of the message, and exactly here the magic string exists in the message, I can help construct the Tcl code.

Thank you for your response and your suggestion.

At the moment, I am having a TCL script generate a syslog message with a telephone number inputted in by a user.

The syslog message would contain the string IVR and the telephone number like below:

%IVR-2-APP_CRIT: 902081234567

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 01.0 cli command "enable"

My trigger would be that syslog message and I need a way of importing that number into a CLI command.

Preferably without using TCL :op but whichever way works.

What version of IOS are you using? How is this message being generated? Some methods of message generation do not allow EEM to process them.

Version is: c2800nm-adventerprisek9_ivs-mz.124-22.T1.bin"

In the TCL script, it is the following statement:

set newDivertNumber [infotag get evt_dcdigits]

log -s CRIT $newDivertNumber

I'm not familiar with the IVR log command. Does this message trigger the EEM policy. That is, if you configure:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 01.0 syslog msg "MATCHED MESSAGE"

Do you see the MATCHED MESSAGE syslog when generating this IVR message?

Yes it does and it is triggered ok:

%HA_EM-6-LOG: UserDefinedDivert: MATCHED MESSAGE

Okay, cool. Then everything you want can be done in applets given that you are running EEM 3.0:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 001 regexp ": ([0-9]+)" $_syslog_msg ignore pnum

action 002 syslog msg "Phone number is $pnum"

action 003 cli command "enable"

action 004 cli command "do something with $pnum"

...

Thank you, that works flawlessly... thank you again. :)

Just a quick question if you don't mind.

Would that above applet work with IOS version 12.4.15T9?

Edit: I just tested it on that and the only statement that doesnt work is the regexp command.

Is there another workaround?

No. You will need to convert to Tcl on any platform not running EEM 3.0 (i.e. < 12.4(22)T). Here is a rough Tcl version.

If you don't mind, how would I call it in EEM? I realise I need to register the policy but would I call it from EEM?

You need to copy it to the local device. For example, to a directory flash:/policies. Then configure the EEM policy directory, and register the policy:

event manager directory user policy flash:/policies

event manager policy sl_ivr_runner.tcl

I am having a little bit of trouble with this...

My config is as follows:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 002 syslog msg "Phone number is $pnum"

action 003 cli command "enable"

action 004 cli command "conf t"

action 005 cli command "voice translation-rule 3"

action 006 cli command "rule 1 /00442071234567/ /$pnum/"

action 007 cli command "end"

event manager policy sl_ivr_runner.tcl type user

Am I missing something?

You need to remove the applet entirely. It has no use on EEM < 3.0. The Tcl policy replaces the whole thing.

Modify the Tcl script so that it runs the desired CLI commands.

Then, you need to decide configure your EEM policy directory. This is the directory in which sl_ivr_runner.tcl exists on the device (e.g. flash:/policies). The command to add is:

event manager directory user policy DIRECTORY

Where DIRECTORY is your policy directory.

Once all of those steps are done, then the policy will work just like the applet does.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: