Multiple EEM Event Detectors

Unanswered Question
Nov 3rd, 2010
User Badges:

I am using 4 event detectors as triggers for a single applet using boolean "or" logic to coorelate on any 1 of the detectors.  They are:

event tag 1.0 is a timer

event tag 2.0 is a syslog pattern

event tag 3.0 is a cli pattern

event tag 4.0 is a cli pattern

How can I know which detector was the trigger?  If I try to look at the internal variable associated with the detector and it wasn't the trigger for the applet to be executed, then the applet crashes.  For example, if I try to reference the syslog detector (_syslog_msg) and the syslog detector was not the trigger then the applet does not continue on with the execution of the other actions and it sends a syslog message indicating an error occurred executing applet <applet_name> statement <label> .  I'm trying to use the detector that triggers the applet as a determiner of the actions to follow.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Joe Clarke Wed, 11/03/2010 - 17:18
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You can change the error handler:

action 1.0 handle-error type ignore

action 2.0 set var $_syslog_msg

action 3.0 if $_error ne FH_EOK

action 4.0  set var $_cli_line

action 5.0 end


michael.woolingham Thu, 11/04/2010 - 06:02
User Badges:

First off, thanks for the quick reply/answer.  I have a few questions:

1) I'm having some difficulty in locating documentation explaining the handle-error EEM applet action command.

2) I'm assuming _error is an internal variable but with what (detector????) is it associated with? Or is it a general catch for any error produced in executing the applet?

3) What is FH_EOK?

4)I'm assuming _cli_line is an internal variable but with what (detector????) is it associated with?

I apologize for the "RTFM" type questions but I've looked and can't seem to find any documentation to clear things up for me.  If you can point me in the right direction where I can find such documentation, I will find the answers out.  Thanks in advance and again, my apologies.

Joe Clarke Fri, 11/05/2010 - 09:45
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

1. Sadly, the EEM documentation is lacking on  The handle-error function was introduced in EEM 3.0 as a way of changing the way error handling works (so conditional evaluations could be done in applets).

2. The _error variable is built-in, and only set when handle-error is set to ignore.  The variable is not associated with any event detector.  It is controlled solely by the handle-error action.

3. FH_EOK is the error code returned when no error occurs.  If the value of _error is set to any other value (e.g. FH_EMEMORY), then an error occurred executing the previous action.

4. The _cli_line variable is an event detector variable associated with the CLI event detector.  You can see all ED variables using the "show event detector DETECTOR detail" command.  For example, run "show event manager detector cli detail" to see the details for the CLI ED.  The _cli_line variable will hold the command that was executed.


This Discussion