Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

EEM - limiting action to 3 runs

Hello everybody.

I have follen in love with EEM ;-)

I am looking for simple way (without tcl)

to limit the action to take place not more than x times.

If you monitor syslog for ios bug occurance that at some point starts generating 1 message a second you do not want to get 1 email a second until you log into the router and disable it, do you ?



Cisco Employee

Re: EEM - limiting action to 3 runs

You can do this with a counter applet. That is, have the counter applet what the count, then disable the other syslog applet. Here is an example (syslog applet elided as you already have this presumably):

event manager applet syslog_watch

event syslog pattern "..."

action 1.0 ...

action N.0 counter name applet_exec_counter op inc value 1

event manager applet counter_watch

event counter name applet_exec_counter entry-val 3 entry-op eq exit-val 0 exit-op eq

action 1.0 syslog msg "Disabling syslog_watch applet"

action 2.0 cli command "enable"

action 3.0 cli command "config t"

action 4.0 cli command "event manager applet syslog_watch"

action 5.0 cli command "event none"

action 6.0 cli command "end"

action 7.0 counter name applet_exec_counter op set value 0

This approach leaves the first applet configured, but sets the event detector to none so it must be manually run.

New Member

Re: EEM - limiting action to 3 runs

Thanks a lot.

I was affraid that using another "disabling" applet is the only way.

And "maxrun" keyword looked so promissing ;-)



Cisco Employee

Re: EEM - limiting action to 3 runs

maxrun is useful when your policy needs to run for longer than the default 20 seconds. It does not allow you to control the number of runs. The disabling applet is common, and doesn't have much of a resource impact. The applet is only triggered when the counter changes.