EEM Question

Answered Question
Apr 19th, 2010

Hello,

how correctly write event syslog pattern

if i want to catch debug isdn q931 events:

Call rejected

No circuit/channel available

Resource unavailable, unspecified

Unallocated/unassigned number

I wrote

event syslog pattern ".*Call rejected.*No circuit/channel available.*Resource unavailable, unspecified.*Unallocated/unassigned number"

but it don't work.

Regards,

Mike

I have this problem too.
0 votes
Correct Answer by Joe Clarke about 6 years 7 months ago

If you want one policy to match all messages, you want something like:

event syslog pattern "Cause i =.*(Call rejected|No circuit/channel available|Resource unavailable, unspecified|Invalid information element contents|Switching equipment congestion|Unallocated/unassigned number)"
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Mon, 04/19/2010 - 20:40

This doesn't look right.  Are each of these messages are unique lines?  Can you post the show log output showing the messages you wish to match?

rmv72 Mon, 04/19/2010 - 22:05

Hello!

The lines which i want to match are

Cause i = 0x8295 - Call rejected
Cause i = 0x8AA2 - No circuit/channel available
Cause i = 0x80AF - Resource unavailable, unspecified

Cause i = 0x0080E408 - Invalid information element contents

Cause i = 0x82AA - Switching equipment congestion
Cause i = 0x8281 - Unallocated/unassigned number

Regards,

Mike

Correct Answer
Joe Clarke Mon, 04/19/2010 - 23:58

If you want one policy to match all messages, you want something like:

event syslog pattern "Cause i =.*(Call rejected|No circuit/channel available|Resource unavailable, unspecified|Invalid information element contents|Switching equipment congestion|Unallocated/unassigned number)"

Actions

This Discussion

Related Content