Multiple EEM Event Detectors

michael.woolingham · ‎11-03-2010

I am using 4 event detectors as triggers for a single applet using boolean "or" logic to coorelate on any 1 of the detectors. They are:

event tag 1.0 is a timer

event tag 2.0 is a syslog pattern

event tag 3.0 is a cli pattern

event tag 4.0 is a cli pattern

How can I know which detector was the trigger? If I try to look at the internal variable associated with the detector and it wasn't the trigger for the applet to be executed, then the applet crashes. For example, if I try to reference the syslog detector (_syslog_msg) and the syslog detector was not the trigger then the applet does not continue on with the execution of the other actions and it sends a syslog message indicating an error occurred executing applet <applet_name> statement <label> . I'm trying to use the detector that triggers the applet as a determiner of the actions to follow.

Joe Clarke · ‎11-03-2010

You can change the error handler:

action 1.0 handle-error type ignore
action 2.0 set var $_syslog_msg
action 3.0 if $_error ne FH_EOK
action 4.0  set var $_cli_line
action 5.0 end
...

michael.woolingham · ‎11-04-2010

First off, thanks for the quick reply/answer. I have a few questions:

1) I'm having some difficulty in locating documentation explaining the handle-error EEM applet action command.

2) I'm assuming _error is an internal variable but with what (detector????) is it associated with? Or is it a general catch for any error produced in executing the applet?

3) What is FH_EOK?

4)I'm assuming _cli_line is an internal variable but with what (detector????) is it associated with?

I apologize for the "RTFM" type questions but I've looked and can't seem to find any documentation to clear things up for me. If you can point me in the right direction where I can find such documentation, I will find the answers out. Thanks in advance and again, my apologies.

Joe Clarke · ‎11-05-2010

1. Sadly, the EEM documentation is lacking on Cisco.com. The handle-error function was introduced in EEM 3.0 as a way of changing the way error handling works (so conditional evaluations could be done in applets).

2. The _error variable is built-in, and only set when handle-error is set to ignore. The variable is not associated with any event detector. It is controlled solely by the handle-error action.

3. FH_EOK is the error code returned when no error occurs. If the value of _error is set to any other value (e.g. FH_EMEMORY), then an error occurred executing the previous action.

4. The _cli_line variable is an event detector variable associated with the CLI event detector. You can see all ED variables using the "show event detector DETECTOR detail" command. For example, run "show event manager detector cli detail" to see the details for the CLI ED. The _cli_line variable will hold the command that was executed.