03-19-2008 10:07 AM
Hello everybody.
I have follen in love with EEM ;-)
I am looking for simple way (without tcl)
to limit the action to take place not more than x times.
If you monitor syslog for ios bug occurance that at some point starts generating 1 message a second you do not want to get 1 email a second until you log into the router and disable it, do you ?
Ragrds
Peter
03-19-2008 11:13 AM
You can do this with a counter applet. That is, have the counter applet what the count, then disable the other syslog applet. Here is an example (syslog applet elided as you already have this presumably):
event manager applet syslog_watch
event syslog pattern "..."
action 1.0 ...
action N.0 counter name applet_exec_counter op inc value 1
event manager applet counter_watch
event counter name applet_exec_counter entry-val 3 entry-op eq exit-val 0 exit-op eq
action 1.0 syslog msg "Disabling syslog_watch applet"
action 2.0 cli command "enable"
action 3.0 cli command "config t"
action 4.0 cli command "event manager applet syslog_watch"
action 5.0 cli command "event none"
action 6.0 cli command "end"
action 7.0 counter name applet_exec_counter op set value 0
This approach leaves the first applet configured, but sets the event detector to none so it must be manually run.
03-22-2008 06:01 AM
Thanks a lot.
I was affraid that using another "disabling" applet is the only way.
And "maxrun" keyword looked so promissing ;-)
Regards
Peter
03-22-2008 11:06 AM
maxrun is useful when your policy needs to run for longer than the default 20 seconds. It does not allow you to control the number of runs. The disabling applet is common, and doesn't have much of a resource impact. The applet is only triggered when the counter changes.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: