IOS-XR EEM script to monitor syslog message and trigger bunch of show commands

[rajpanchal1978]

Hello Team,

I am troubleshooting some issue on ASR 9010 running IOX-XR 4.2.3

To troubleshoot the problem we have a requirement to have a EEM script which is continuously monitoring the syslog messages and in event of a particular syslog message being logged by the ASR 9010 , we need the EEM to also run some (multiple) show commands and amend the results to a file.

So far I have tried creating following sample script (by looking at examples on CCO) but its not working (It is just doing nothing ) . 

EEM script is registered 

RP/0/RSP0/CPU0:D-sun1.cr#show event manager policy registered 
Fri May 23 13:59:34.817 AEST
No.  Class     Type    Event Type          Trap  Time Registered           Name
1    script    user    syslog              Off   Fri May 23 09:49:03 2014  sys.tcl
 pattern {%PKT_INFRA-LINK-3-UPDOWN}
 nice 0 queue-priority normal maxrun 20.000 scheduler rp_primary Secu none
 persist_time: 3600 seconds,  username: eem

============= Script ================

::cisco::eem::event_register_syslog pattern {%IP-TCP_NSR-5-DISABLED} maxrun 240

namespace import ::cisco::eem::*
namespace import ::cisco::lib::*

array set arr_einfo [event_reqinfo]

if [catch {cli_open} result] {
    error $result $errorInfo
} else {
    array set cli1 $result
}

if [catch {cli_exec $cli1(fd) "show clock | file append disk0:int3.txt"} _cli_result] {
    error $_cli_result $errorInfo
}

if [catch {cli_exec $cli1(fd) "show proc cpu sort | file append disk0:int3.txt"} _cli_result] {
    error $_cli_result $errorInfo
}

if [catch {cli_exec $cli1(fd) "show users | file append disk0:int3.txt"} _cli_result] {
    error $_cli_result $errorInfo
}

# Close open cli before exit.
catch {cli_close $cli1(fd) $cli1(tty_id)} result

=============== Script Over =================

Can any of you comment whats going wrong or missing here ?

Cheers

Raj

[Joe Clarke]

According to the show event manager policy registered output, you have not registered this policy with the EEM server.  If you register it like you did for sys.tcl, then it should work.

[rajpanchal1978]

Hi Joseph,

My bad - actually I copied the wrong output from "show event manager policy registered"

I have also noticed that there were other issues with my script like some non-compatible commands !

Intially I tried using the utility available at  http://www.marcuscom.com/convert_applet/ to generate my TCL script and which ended up inheriting Cisco IOS commands into the script which was targetted for IOS-XR box .

Any ways I have figured out my mistakes and honestly thanks to this forum where I have been reading everybody's example and experience which helped me identifying my mistakes  in my first TCL script

Attached is the script which is now working and loaded on my ASR 9010 . This will help me capturing show command outputs for many commands requested by Cisco TAC . The script will run momemt a syslog message is logged .

I had a need to run these set of commands 3 times to capture any incremental counters on the show commands outputs , I am not aware about how to introduce a loop into the script which basically runs the same set of commands "N" times. Hence you would see I have ended up just running commands three times without the loop ( not so efficient !!! )

I would love to learn how to go about introducting such loops

Cheers

Raj

[Joe Clarke · Accepted solution]

Loops are easy.  In this case, a for loop is probably what you want.  You can stick the sets of commands within this block, and they will run three time.

for { set i 0 } { $i < 3 } { incr i } {

 # commands go here

}

[rajpanchal1978]

Thanks a lot Joseph.

Sorry I was bit busy with other stuff and couldn't reply back.

Next step for me is to ignore multiple instance of the same log messages to avoid the script running multiple times based on the number of times the same syslog message was generated. 

Idea is just trigger the script based on the first occurrence of the syslog message pattern log. Do no run the script for subsequent occurrence of same syslog message pattern log.

Cheers

Raj