syslog triggered action during 8am – 4pm, Monday – Friday

[nzhang1001]

Hi. I am new to EEM, and have read some postings here before giving this a try. But i Need some help and recommendations.

C6513E Supervisor Engine 720 10GE with s72033-adventerprisek9_wan-mz.122-33.SXH8.bin (does not support some of the command syntax)

C2821 – current IOS no good. What software version would be recommended?

objective: during 8am – 4pm, Monday – Friday, to detect eigrp neighbor, if it goes down, passive the respective interface.

example:

read out Vlan108 from “Neighbor * is down” and execute commands “router eigrp 36” and “passive-interface Vlan108”

May 13 09:32:36: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 36: Neighbor 10.9.3.2 (Vlan108) is down

event manager applet eigrp36_flap

event timer cron cron-entry 0 8 * * 1-5 name MonFri maxrun 28800

event syslog pattern "DUAL-5-NBRCHANGE: IP-EIGRP(0) 36: Neighbor ([^,]+) is down "

action 1.0 regexp "Neighbor \(([^,]+)\) is down" $_syslog_msg match vlan

action 2.0 cli command "enable"

action 3.0 cli command "configure terminal"

action 4.0 cli command "router eigrp 36"

action 5.0 cli command "passive interface $vlan"

action 6.0 cli command "exit"

action 7.0 cli command "exit"

The script is version one and must have some issue with it. I haven't been able to test the script, since the platform/IOS listed above cannot support all the command syntax.

Thanks in advance.

N

[Joe Clarke]

If this must run on your 6500, then you'll need Tcl.  This applet will work natively on IOS 12.4(22)T and higher.  For other versions, you'll need to first convert it to Tcl at http://www.marcuscom.com/convert_applet/ and register it as an EEM Tcl policy.

event manager applet passive-eigrp

 event syslog pattern "DUAL-5-NBRCHANGE: IP-EIGRP(0) 36: Neighbor.*is down"

 action 001 cli command "enable"

 action 002 cli command "show clock"

 action 003 regexp "([0-9]+):[0-9]+:[0-9]+ [^ ]+ (Mon|Tue|Wed|Thu|Fri)" "$_cli_result" match hour day

 action 004 if $hour ge 8

 action 005  if $hour lt 16

 action 006   regexp "Neighbor [0-9\.]+ .([A-Za-z0-9\.:]+)" $_syslog_msg match intf

 action 007   cli command "config t"

 action 008   cli command "router eigrp 36"

 action 009   cli command "passive interface $intf"

 action 010   cli command "end"

 action 011  end

 action 012 end

[nzhang1001]

Awesome.
I’ll upgrade the IOS and give it a run.
Appreciate your help, Joseph.