Solved: is it possible to create two scripts? - Page 4

Josiah Inubio · ‎04-25-2013

Is it possible this way if I'm making two script? Thanks.

Script 1

For this log:

Apr 24 07:40:01.884 MNL: %LINK-3-UPDOWN: Interface Cellular0/2/0, changed state

to down

ROUTER(config)#event manager applet cell1

ROUTER(config-applet)# event syslog pattern "Interface Cellular0/2/0, changed state to down"

ROUTER(config-applet)# action 1.0 cli command "enable"

ROUTER(config-applet)# action 1.1 cli cmmand "configure term"

ROUTER(config-applet)# action 1.2 cli command "interface Cellular0/2/0"

ROUTER(config-applet)# action 1.3 cli command "no shut"

ROUTER(config-applet)#

Script 2

For this log:

Apr 25 11:17:49.881 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/2 is DOWN

ROUTER(config)#event manager applet cell2

ROUTER(config-applet)# event syslog pattern "Modem in HWIC slot 0/2 is DOWN"

ROUTER(config-applet)# action 1.0 cli command "enable"

ROUTER(config-applet)# action 1.1 cli cmmand "reload at 19:00"

ROUTER(config-applet)#

Josiah Inubio · ‎09-04-2013

and this is another scenario. the script should be initiated after 19:00 since the syslog occur on 15:00. as you see below, i think the script didn't work.

Sep 4 15:15:13.953 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/1 is DOWN

Sep 4 15:15:13.957 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : CTL : cli_opencalled.

Sep 4 15:15:13.957 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : PHILAM-SFL-BR01#

Sep 4 15:15:13.957 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : IN : PHILAM-SFL-BR01#enable

Sep 4 15:15:14.269 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : No authorization entry found for 172.29.7.55

Sep 4 15:15:14.269 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT :

Sep 4 15:15:14.269 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : PHILAM-SFL-BR01#

Sep 4 15:15:14.269 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : IN : PHILAM-SFL-BR01#show clock

Sep 4 15:15:14.281 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : 15:15:14.273 MNL Wed Sep 4 2013

Sep 4 15:15:14.281 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : PHILAM-SFL-BR01#

Sep 4 15:15:14.281 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : CTL : cli_close called.

Josiah Inubio · ‎10-30-2013

Hi Joseph, i really need your help here. I tried not to reload it manually and observed it that the script doesn't work. Here's the script.

event manager session cli username "jvi01131990"

event manager applet cell1

description "TEST ONLY"

event syslog pattern "Interface Cellular0/0/0, changed state to down"

action 1.0 cli command "enable"

action 1.1 cli command "test cellular 0/0/0 modem-power-cycle"

action 1.2 end

event manager applet cell2

description "TEST ONLY"

event syslog pattern "Modem in HWIC slot 0/0 is DOWN"

action 1.0 cli command "enable"

action 1.1 cli command "show clock"

action 1.2 regexp "([0-9]+):[0-9]+:[0-9]+" "$_cli_result" match hour

action 1.3 if $hour ge 18

action 1.4 reload

action 1.5 end

action 1.6 if $hour le 6

action 1.7 reload

action 1.8 end

Here's the logs:

=========================

Router 1

=========================

Router 1#sh log | i Oct 30

Oct 30 03:08:48.826 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/0 is DOWN

Oct 30 08:06:23.725 MNL: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down

Oct 30 08:06:24.725 MNL: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down

Oct 30 08:06:32.725 MNL: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up

Oct 30 08:06:33.725 MNL: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up

Oct 30 09:53:45.824 MNL: %HA_EM-6-FMPD_EEM_CONFIG: cell1: "end" action found outside of conditional block

Oct 30 09:53:54.828 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Router 1#sh clo

18:48:31.798 MNL Wed Oct 30 2013

=========================

Router 2

=========================

Router 2#sh log | i Oct 30

Oct 30 09:31:32.529 MNL: %HA_EM-6-FMPD_EEM_CONFIG: cell1: "end" action found outside of conditional block

Oct 30 09:31:42.169 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Router 2#sh clo

18:24:27.239 MNL Wed Oct 30 2013

=========================

Router 3

=========================

Router 3#sh log | i Oct 30

Oct 30 09:17:03.899 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:22:26.559 MNL: %HA_EM-6-FMPD_EEM_CONFIG: cell1: "end" action found outside of conditional block

Oct 30 09:29:25.147 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Router 3#sh clo

18:11:22.917 MNL Wed Oct 30 2013

=========================

Router 4

=========================

Router 4#sh log | i Oct 30

Oct 30 04:11:23.706 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/0 is DOWN

Oct 30 09:49:38.513 MNL: %HA_EM-6-FMPD_EEM_CONFIG: cell1: "end" action found outside of conditional block

Oct 30 09:54:01.005 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Router 4#sh clo

18:32:06.895 MNL Wed Oct 30 2013

=========================

Router 5

=========================

Router 5#sh log | i Oct 30

Oct 30 02:02:08.631 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/0 is DOWN

Oct 30 09:32:44.613 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:33:22.745 MNL: %HA_EM-6-FMPD_EEM_CONFIG: cell1: "end" action found outside of conditional block

Oct 30 09:33:30.249 MNL: %HA_EM-4-FMPD_NO_EVENT: No event configured for applet cell2

Oct 30 09:33:30.249 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:36:40.993 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:37:06.905 MNL: %HA_EM-6-FMPD_EEM_CONFIG: cell1: "end" action found outside of conditional block

Oct 30 09:37:14.277 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Router 5#sh clo

18:34:42.955 MNL Wed Oct 30 2013

=========================

Router 6

=========================

Router 6#sh log | i Oct 30

Oct 30 09:00:53.282 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/0 is DOWN

Oct 30 09:53:31.309 MNL: %HA_EM-6-FMPD_EEM_CONFIG: cell1: "end" action found outside of conditional block

Oct 30 09:53:39.709 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Router 6#sh clo

18:41:18.951 MNL Wed Oct 30 2013

=========================

Router 7

=========================

Router 7#sh log | i Oct 30

Oct 30 09:25:42.539 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:26:30.703 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : CTL : cli_open called.

Oct 30 09:26:30.707 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : PHILAM-ANT-BR01>

Oct 30 09:26:30.707 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : IN : PHILAM-ANT-BR01>enable

Oct 30 09:26:31.019 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : PHILAM-ANT-BR01#

Oct 30 09:26:31.019 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : IN : PHILAM-ANT-BR01#show clock

Oct 30 09:26:31.031 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : 09:26:31.023 MNL Wed Oct 30 2013

Oct 30 09:26:31.031 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : OUT : PHILAM-ANT-BR01#

Oct 30 09:26:31.031 MNL: %HA_EM-6-LOG: cell2 : DEBUG(cli_lib) : : CTL : cli_close called.

Oct 30 09:27:45.923 MNL: %HA_EM-4-FMPD_NO_EVENT: No event configured for applet cell2

Oct 30 09:27:45.923 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:29:39.703 MNL: %HA_EM-4-FMPD_NO_EVENT: No event configured for applet cell2

Oct 30 09:29:39.703 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:32:19.571 MNL: %SYS-5-PRIV_AUTH_FAIL: Authentication to privilege level 15 failed by jvi01131990 on vty0 (10.49.135.135)

Oct 30 09:39:27.103 MNL: %SYS-5-CONFIG_I: Configured from console by jvi01131990 on vty0 (10.49.135.135)

Router 7# sh clo

18:37:49.320 MNL Wed Oct 30 2013

Joe Clarke · ‎10-30-2013

Get rid of action 1.2 in cell1. Additionally, if your router 7 output, the time is outside the window, so the reload would not happen.

Josiah Inubio · ‎05-16-2013

Hey joseph, is it possible to create a script that will send an email to you on a syslog that you choose?

Joe Clarke · ‎05-17-2013

Yes. You can use the "mail" action in an applet to send the email and use the syslog event detector to match your syslog message.

Josiah Inubio · ‎05-17-2013

for example for this event syslog pattern "Modem in HWIC slot 0/2 is DOWN", how will i create the script to notify me thru email?

Joe Clarke · ‎05-17-2013

event manager applet mode-down

event syslog pattern "Modem in HWIC slot 0/2 is DOWN"

action 1.0 mail from user@company.com to user@company.com server 10.1.1.1 subject "Modem down" body "$_syslog_msg"

Josiah Inubio · ‎05-17-2013

is that a default server ip used in general?

Joe Clarke · ‎05-17-2013

That server needs to be an SMTP server that allows relaying from your device.

Josiah Inubio · ‎05-19-2013

I'm using microsoft exchange server with an IP of 10.50.162.67 (Cache Exchange mode). Is this different from an SMTP server? See error below. Thanks.

May 20 11:43:31.381 MNL: %HA_EM-3-FMPD_SMTP: Error occurred when sending mail to

SMTP server: 10.50.162.67 : error in connecting to SMTP server

May 20 11:43:31.381 MNL: %HA_EM-3-FMPD_ERROR: Error executing applet mode-down s

tatement 1.0

This is the script:

event manager applet mode-down

event syslog pattern "LINK-5-CHANGED: Interface Cellular0/0/0, changed state to administratively down"

action 1.0 mail from GLOBENETWORKSUPPORT@AIA.com to GLOBENETWORKSUPPORT@AIA.com server 10.50.162.67 subject "TEST_Interface Cellular0/0/0, changed state to administratively down" body "$_syslog_msg"

Josiah Inubio · ‎05-19-2013

or do i need to configure on the router regarding smtp relay?

Josiah Inubio · ‎05-19-2013

The devices was on different network - its on VPN. They have different SMTP server, also we have our SMTP server. Is it possible to use our SMTP server to make this work?

Joe Clarke · ‎05-19-2013

Yes, it's possible, provided that SMTP server is configured to allow relaying from your device. You may need to speak to your SMTP administrator to confirm this. In fact, you should probably speak to them to learn what is required in terms of authentication (if any) as well.

Josiah Inubio · ‎05-20-2013

hey joseph, the smtp administrator is asking for source and destination IP. What does he mean? Is it each WAN IP from all routers on the VPN?

Joe Clarke · ‎05-20-2013

I don't know why he'd need the destination IP as that will be the SMTP server itself. The source will typically be the IP address of the device closest to the SMTP server from a routing perspective, but newer IOS lets you control that with the source-address argument to the mail action. That way, you can control exactly what address will be used by the device when communicating to the SMTP server.