02-17-2015 08:47 AM
Hello,
I'm trying to find a way to perform some action on cable modem basing on syslog event. Let's take an example: I'm getting the following message in the syslog:
%UBR10000-5-UNREGSIDTIMEOUT: CMTS deleted unregistered Cable Modem XXXX.YYYY.ZZZZ
Now, I'd like the script to reset this modem when such event occurs (maybe it makes no sense to reset deleted modem but it's only example)
And now I'm looking for the way, how to use the event syslog message in the script and how to extract the MAC address of the modem from this line.
Being specific - how to get $MAC variable, having in mind that there's no regexp command on UBR IOS?
event manager applet modem_reset
event syslog occurs 1 pattern "CMTS deleted unregistered Cable Modem" period 1
action 1 cli command "clear cable modem $MAC reset"
BR,
Andrzej
Solved! Go to Solution.
02-18-2015 09:16 AM
On platforms that do not yet support EEM 3.0, you will need to switch to EEM Tcl to do any kind of programmatic operation (including regexp). You can write your applet as it would appear in EEM 3.0, then take it to http://www.marcuscom.com/convert_applet to get the Tcl version, which you can then register as an EEM Tcl policy on the UBR.
02-18-2015 09:16 AM
On platforms that do not yet support EEM 3.0, you will need to switch to EEM Tcl to do any kind of programmatic operation (including regexp). You can write your applet as it would appear in EEM 3.0, then take it to http://www.marcuscom.com/convert_applet to get the Tcl version, which you can then register as an EEM Tcl policy on the UBR.
02-19-2015 02:54 AM
Hello, Joseph,
Thanks a lot for your reply. I have followed your advice and prepare an example script, however I have an issue with extracting particular substring. This is the first time I'm fighting with TCL scripts so sorry my ignorance. Please, could you look at this and let me know what could be wrong here:
U10k#sh run | sec event event manager environment sub4 event manager directory user policy "disk0:/" event manager session cli username "user" event manager applet config event syslog occurs 1 pattern "Configured from" period 1 action 1 cli command "type $_syslog_msg | append disk0:conf_log" action 2 cli command "show cable modem | append disk0:conf_log" action 3 policy tcl.tcl event manager policy tcl.tcl type user U10k# U10k# U10k# U10k# U10k#more disk0:tcl.tcl ::cisco::eem::event_register_syslog occurs 1 pattern {Configured from} period 1 # # This EEM tcl policy was generated by the EEM applet conversion # utility at http://www.marcuscom.com/convert_applet/ # using the following applet: # # event manager applet config # event syslog occurs 1 pattern "Configured from" period 1 # action 1 regexp "from console by [A-Za-z] on" $_syslog_msg user sub1 sub2 sub3 sub4 # action 2 syslog msg "Configuration changed by $sub4" # # namespace import ::cisco::eem::* namespace import ::cisco::lib::* array set arr_einfo [event_reqinfo] set _regexp_result [regexp {from console by [A-Za-z] on} $arr_einfo(msg) user sub1 sub2 sub3 sub4] action_syslog msg "Configuration changed by $sub4" U10k# U10k# U10k# U10k# U10k#clear logging Clear logging buffer [confirm] U10k#conf t Enter configuration commands, one per line. End with CNTL/Z. U10k(config)#int gig U10k(config)#int gigabitEthernet 1/0/2 U10k(config-if)#shu U10k(config-if)#shutdown U10k(config-if)#no shu U10k(config-if)#no shutdown U10k(config-if)#exit U10k(config)#exit U10k#sh U10k#show logg U10k#show logging Syslog logging: enabled (0 messages dropped, 781 messages rate-limited, 5 flushes, 0 overruns, xml disabled, filtering disabled) No Active Message Discriminator. No Inactive Message Discriminator. Console logging: level debugging, 500 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level informational, 1225 messages logged, xml disabled, filtering disabled Exception Logging: size (4096 bytes) Count and timestamp logging messages: disabled Persistent logging: disabled Trap logging: level informational, 1230 message lines logged Log Buffer (131072 bytes): 001264: Feb 19 11:39:06.647 GMT+1: %SYS-5-CONFIG_I: Configured from console by klonex on vty1 (192.168.101.197) 001265: Feb 19 11:39:06.787 GMT+1: %HA_EM-6-LOG: tmpsys:/eem_policy/tcl.tcl: Configuration changed by 001266: Feb 19 11:39:07.167 GMT+1: %HA_EM-3-FMPD_ERROR: Error executing applet config statement 3
BR,
Andrzej
02-19-2015 07:24 AM
The policy produced by this tool is a syslog policy, so you can't execute it using "action policy". Remove the applet. You don't need it. This single Tcl policy will do all the work. You also need to change your regexp to:
[A-Za-z]+
02-19-2015 07:52 AM
OK, I have removed the applet. There's still something wrong with substring.
When I have the script looking like this:
set _regexp_result [regexp {console by [A-Za-z]+ on} $arr_einfo(msg) _user _sub1 _sub2 _sub3 ] action_syslog msg "Configuration changed by $_user"
I'm getting:
001668: Feb 19 16:32:41.217 GMT+1: %SYS-5-CONFIG_I: Configured from console by klonex on vty1 (192.168.101.197) 001669: Feb 19 16:32:41.357 GMT+1: %HA_EM-6-LOG: tmpsys:/eem_policy/tcl.tcl: Configuration changed by console by klonex on
However, when I change the script to:
set _regexp_result [regexp {console by [A-Za-z]+ on} $arr_einfo(msg) _user _sub1 _sub2 _sub3 ] action_syslog msg "Configuration changed by $_sub1"
I'm getting:
001670: Feb 19 16:33:45.346 GMT+1: %SYS-5-CONFIG_I: Configured from console by klonex on vty1 (192.168.101.197) 001671: Feb 19 16:33:45.486 GMT+1: %HA_EM-6-LOG: tmpsys:/eem_policy/tcl.tcl: Configuration changed by
02-19-2015 07:56 AM
You also need to surround your pattern in parentheses:
([A-Za-z]+)
And make sure you reregister the Tcl policy when you upload the new copy. Simply copying the new script into place will not enable the changes.
02-27-2015 06:23 AM
Thanks, Joseph, you were very helpful.
BR,
Andrzej
07-16-2015 06:13 AM
Hello, Joseph,
One quick question to this closed discussion - is there any way to modify the action performed by the script, to include timeout before executing the action (e.g. 60 seconds)?
BR,
Andrzej
07-16-2015 03:50 PM
You can use the "after" Tcl command to introduce a sleep. But you will need to increase the maxrun value of the policy by as much. For example, if you want a 60 second delay, use:
after 60000
Then add maxrun 80 to the event registration line to give the policy enough time to execute.
07-17-2015 12:16 AM
Thank you very much. We'll test it.
BR,
Andrzej
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: