Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

EEM Built-in "Action" Variables

Many of the EEM applet actions set some built-in variable to indicate their success status or store some result data.  Unfortunately, these variables are not well documented...until now.  Below is a list of actions and the variables that they instantiate (along with a brief description of what each variable contains).

 

 

EEM ActionVariable NameDescription
action add$_resultStores the sum of the previous addition operation
action cli$_cli_result

Contains the output from the

last

CLI command executed.  It will be overwritten each time "action cli" is invoked

action counter$_counter_value_remainStores the current value of a counter after the inc, dec, set, or nop operation has been performed
action divide$_result, $_remainderStores the quotient and remainder respectively of the previous division operation
action handle-error$_errorIf the handle-error action is "ignore" then any error will be stored in the $_error variable.  This error will be a string value.  A healthy result is always "FH_EOK".
action info type cli frequency

$_info_cli_freq_num_entries, $_info_cli_freq_pattern_[1 - N], $_info_cli_freq_time_sec_[1 - N], $_info_cli_freq_time_msec_[1 - N], $_info_cli_freq_match_count_[1 - N], $_info_cli_freq_raise_count_[1 - N], $_info_cli_freq_sync_[1 - N], $_info_cli_freq_skip_[1 - N], $_info_cli_freq_occurs_[1 - N], $_info_cli_freq_period_sec_[1 - N], $_info_cli_freq_period_msec_[1 - N]

Display frequency information about the last N number of CLI commands executed
action info type cli history

$_info_cli_hist_num_entries, $_info_cli_hist_cmd_[1 - N], $_info_cli_hist_time_sec_[1 - N], $_info_cli_hist_time_msec_[1 - N]

Display details about the last N number of CLI commands executed
action info type eventSets the event detector specific variablesSee "show event manager detector DETECTOR detail" depending on the event tag passed to "info type event".
action info type interface-names

$_info_interface_names

The list of interfaces on the device corresponding to any filters passed to the action
action info type routername

$_info_routername

This action retrieves the hostname of the current device.
action info type snmp getid

$_info_snmp_sysdescr_oid, $_info_snmp_sysdescr_value, $_info_snmp_sysobjectid_oid, $_info_snmp_sysobjectid_value, $_info_snmp_sysuptime_oid, $_info_snmp_sysuptime_value, $_info_snmp_syscontact_oid, $_info_snmp_syscontact_value, $_info_snmp_sysname_oid, $_info_snmp_sysname_value, $_info_snmp_syslocation_oid, $_info_snmp_syslocation_value

This action sets a number of variables that provide an equivalent to the SNMP system branch of the SNMP MIB.
action info type snmp oid$_info_snmp_oid, $_info_snmp_valueThe OID and the value of the result of an SNMP GET, GETNEXT,  or SET operation.
action info type syslog frequency

$_info_syslog_freq_num_entries, $_info_syslog_freq_pattern_[1 - N], $_info_syslog_freq_time_sec_[1 - N], $_info_syslog_freq_time_msec_[1 - N], $_info_syslog_freq_match_count_[1 - N], $_info_syslog_freq_raise_count_[1 - N], $_info_syslog_freq_occurs_[1 - N], $_info_syslog_freq_period_sec_[1 - N], $_info_syslog_freq_period_msec_[1 - N]

Display frequency information about the last N number of syslog messages generated

action info type syslog history

$_info_syslog_hist_num_entries, $_info_syslog_hist_msg_[1 - N], $_info_syslog_hist_time_sec_[1 - N], $_info_syslog_hist_time_msec_[1 - N]

Display details about the last N number of syslog messages generated

action multiply$_resultThe product of the last multiplication operation
action regexp  

$_regexp_result

A  boolean value that indicates whether the regular expression matched.    It the match was successful, the value will be '1', else it will be  '0'.

action string$_string_result

For the string command "match" the result will be '1' if the string  matches the substring or '0' otherwise.  For all other string commands,  $_string_result will hold the result of the string operation

action subtract$_resultThe difference of the last subtraction operation
action track$_track_stateThe state of the tracked object being set or read
Comments

Fantastic information....thanks!!

Mike

Wonderfull thanks

Its make my life easy

I add two variable and find where it store the result

Thanks once again

Cisco Employee

Great page, any idea what the "action variable" for 'action decrement' is?

Cisco Employee

The increment, decrement, set, and append actions do not actually use a built-in result variable.  You pass the variable name to the actions, and the variable is mutated.  For example:

action 1.0 set var 1

action 2.0 decrement var

action 3.0 puts $var

The value of 0 will be printed.

Cisco Employee

Great info. I've been looking for this data for a couple of hours  and finally found it in a very nice way here. Thanks!

Adrian

Bronze

Is there same document for NX-OS EEM? There are variables too, but use another syntax.

Cisco Employee

For NX-OS 7.x with the new programmatic applet support, these variables are the same where the same actions exist.  For example, _cli_result is the same.

In order to find the per-event detector variables for NX-OS, use the "show event manager event-types" command.  The field marked "Event Parameters" lists the variables.  For example, for the CLI event, the $command variable will give you the command that was run.

Bronze

Our version is 7.0(5)N1(1), but _cli_result variable does not work:

SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $_cli_result
^
% Invalid command at '^' marker.

Also I tried to view which variables are supported:

show event manager event-types 

Name : cli
Description : EEM CLI command filter
Event Parameters : command
Publisher : CLI events publisher
Default Action :

Well, $command should work, but it does not: 

SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $command
^
% Invalid command at '^' marker.

I've found on some examples that variable format should be $(VARIABLE), but the only thing that works, and works strange is a timestamp:

SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $(TIMESTAMP)
SD2-5-7-20-L3SW-160(config-applet)# sh run eem


event manager applet EMA-CLI-cmds
action 1.0 syslog msg 2017-08-03-16.36.20

So it translates to real value immediately after entering action command.

Cisco Employee

This works in 7.3.  I believe in 7.0 you couldn't begin the message with a variable.  Try:

action 1.0 syslog msg Command : $_cli_result

Bronze

Now command is accepted, but not syslogged, even more, without variable also does not work:

event manager applet EMA-CLI-cmds
 event cli match "*"
 action 1.0 event-default
 action 2.0 syslog msg AKHTUNG

Produces only this in log:

2017 Aug 4 08:51:22 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29366
2017 Aug 4 08:51:23 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29398
2017 Aug 4 08:51:23 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29377
2017 Aug 4 08:51:24 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29396
2017 Aug 4 08:51:24 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29379

Seems like cosmetic bug :(

Bronze

We opened a case in TAC and th response is as follows:

We had a discussion with our engineering regarding this behaviour of EEM. Using EEM on the Nexus, we can only execute commands that are not “session dependent / interactive ssh”. The “show cli history” that we want to run using the EEM will always return an empty string because the event manager initiates a new vsh session and the output of this command for a new session is always null.

The only feasible option we have right now is to configure a scheduler at the beginning of the day and capture the “show accounting log” for the previous day, then push it to the syslog using the EEM. There are multiple filters we can have to achieve a clean result –

“show accounting log” – All the configuration changes done by any user.
“show accounting log all” – All the CLI executed by any user including show commands
“show accounting log all | in update” – Clears all clutter and shows up only relevant things

This output can be filtered by the day and sent to syslog. And this seems to be the only feasible option at this point on the Nexus platform. Let me know how you would like to proceed further.

 

So, currently there is no way to make NX-OS replicate entered commands to syslog in real-time, only on sheduled basis. And I think this is still a bug, since "..the event manager initiates a new vsh session and the output of this command for a new session is always null"and actually after applying configs of EEM  from previous messages we got 100% CPU load on our Nexus box and hundreds of VSH pocesses that lived forever until we killed them using debug plugin via Linux shell.

8099
Views
10
Helpful
11
Comments