Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

syslog triggered action during 8am – 4pm, Monday – Friday

Hi. I am new to EEM, and have read some postings here before giving this a try. But i Need some help and recommendations.


C6513E Supervisor Engine 720 10GE with s72033-adventerprisek9_wan-mz.122-33.SXH8.bin (does not support some of the command syntax)

C2821 – current IOS no good. What software version would be recommended?


objective: during 8am – 4pm, Monday – Friday, to detect eigrp neighbor, if it goes down, passive the respective interface.


read out Vlan108 from “Neighbor * is down” and execute commands “router eigrp 36” and “passive-interface Vlan108”

May 13 09:32:36: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 36: Neighbor (Vlan108) is down


event manager applet eigrp36_flap

event timer cron cron-entry 0 8 * * 1-5 name MonFri maxrun 28800

event syslog pattern "DUAL-5-NBRCHANGE: IP-EIGRP(0) 36: Neighbor ([^,]+) is down "

action 1.0 regexp "Neighbor \(([^,]+)\) is down" $_syslog_msg match vlan

action 2.0 cli command "enable"

action 3.0 cli command "configure terminal"

action 4.0 cli command "router eigrp 36"

action 5.0 cli command "passive interface $vlan"

action 6.0 cli command "exit"

action 7.0 cli command "exit"


The script is version one and must have some issue with it. I haven't been able to test the script, since the platform/IOS listed above cannot support all the command syntax.


Thanks in advance.


Cisco Employee

If this must run on your 6500

If this must run on your 6500, then you'll need Tcl.  This applet will work natively on IOS 12.4(22)T and higher.  For other versions, you'll need to first convert it to Tcl at and register it as an EEM Tcl policy.


event manager applet passive-eigrp

 event syslog pattern "DUAL-5-NBRCHANGE: IP-EIGRP(0) 36: Neighbor.*is down"

 action 001 cli command "enable"

 action 002 cli command "show clock"

 action 003 regexp "([0-9]+):[0-9]+:[0-9]+ [^ ]+ (Mon|Tue|Wed|Thu|Fri)" "$_cli_result" match hour day

 action 004 if $hour ge 8

 action 005  if $hour lt 16

 action 006   regexp "Neighbor [0-9\.]+ .([A-Za-z0-9\.:]+)" $_syslog_msg match intf

 action 007   cli command "config t"

 action 008   cli command "router eigrp 36"

 action 009   cli command "passive interface $intf"

 action 010   cli command "end"

 action 011  end

 action 012 end

New Member

Awesome.I’ll upgrade the IOS

I’ll upgrade the IOS and give it a run.
Appreciate your help, Joseph.


CreatePlease to create content