Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

EEM: Set variable from syslog message

Hi all,

I was wondering if it is possible to put the output of a syslog message generated from a TCL script into variable and trim that to only get a subset of the syslog message.

I believe the logic would be like this but still trying to translate it to EEM:

set a (show log | incl % IVR)

set b (string a 4555)

# we only want 4555 from the syslog message

And then put b into a CLI command.

Is that possible? Or do I need to write to a file instead and parse the file for that message and put it into the variable?

Thank you in advance for any suggestions.

3 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Re: EEM: Set variable from syslog message

Okay, cool. Then everything you want can be done in applets given that you are running EEM 3.0:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 001 regexp ": ([0-9]+)" $_syslog_msg ignore pnum

action 002 syslog msg "Phone number is $pnum"

action 003 cli command "enable"

action 004 cli command "do something with $pnum"

...

Cisco Employee

Re: EEM: Set variable from syslog message

No. You will need to convert to Tcl on any platform not running EEM 3.0 (i.e. < 12.4(22)T). Here is a rough Tcl version.

Cisco Employee

Re: EEM: Set variable from syslog message

You need to remove the applet entirely. It has no use on EEM < 3.0. The Tcl policy replaces the whole thing.

Modify the Tcl script so that it runs the desired CLI commands.

Then, you need to decide configure your EEM policy directory. This is the directory in which sl_ivr_runner.tcl exists on the device (e.g. flash:/policies). The command to add is:

event manager directory user policy DIRECTORY

Where DIRECTORY is your policy directory.

Once all of those steps are done, then the policy will work just like the applet does.

20 REPLIES
Cisco Employee

Re: EEM: Set variable from syslog message

You could certainly do this with EEM. You don't even need to parse the show log output as you can have an EEM policy trigger on a syslog message. Your example here is a bit rigid, but if you supply more general details about the nature of the message, and exactly here the magic string exists in the message, I can help construct the Tcl code.

New Member

Re: EEM: Set variable from syslog message

Thank you for your response and your suggestion.

At the moment, I am having a TCL script generate a syslog message with a telephone number inputted in by a user.

The syslog message would contain the string IVR and the telephone number like below:

%IVR-2-APP_CRIT: 902081234567

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 01.0 cli command "enable"

My trigger would be that syslog message and I need a way of importing that number into a CLI command.

Preferably without using TCL :op but whichever way works.

Cisco Employee

Re: EEM: Set variable from syslog message

What version of IOS are you using? How is this message being generated? Some methods of message generation do not allow EEM to process them.

New Member

Re: EEM: Set variable from syslog message

Version is: c2800nm-adventerprisek9_ivs-mz.124-22.T1.bin"

In the TCL script, it is the following statement:

set newDivertNumber [infotag get evt_dcdigits]

log -s CRIT $newDivertNumber

Cisco Employee

Re: EEM: Set variable from syslog message

I'm not familiar with the IVR log command. Does this message trigger the EEM policy. That is, if you configure:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 01.0 syslog msg "MATCHED MESSAGE"

Do you see the MATCHED MESSAGE syslog when generating this IVR message?

New Member

Re: EEM: Set variable from syslog message

Yes it does and it is triggered ok:

%HA_EM-6-LOG: UserDefinedDivert: MATCHED MESSAGE

Cisco Employee

Re: EEM: Set variable from syslog message

Okay, cool. Then everything you want can be done in applets given that you are running EEM 3.0:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 001 regexp ": ([0-9]+)" $_syslog_msg ignore pnum

action 002 syslog msg "Phone number is $pnum"

action 003 cli command "enable"

action 004 cli command "do something with $pnum"

...

New Member

Re: EEM: Set variable from syslog message

Thank you, that works flawlessly... thank you again. :)

New Member

Re: EEM: Set variable from syslog message

Just a quick question if you don't mind.

Would that above applet work with IOS version 12.4.15T9?

Edit: I just tested it on that and the only statement that doesnt work is the regexp command.

Is there another workaround?

Cisco Employee

Re: EEM: Set variable from syslog message

No. You will need to convert to Tcl on any platform not running EEM 3.0 (i.e. < 12.4(22)T). Here is a rough Tcl version.

New Member

Re: EEM: Set variable from syslog message

If you don't mind, how would I call it in EEM? I realise I need to register the policy but would I call it from EEM?

Cisco Employee

Re: EEM: Set variable from syslog message

You need to copy it to the local device. For example, to a directory flash:/policies. Then configure the EEM policy directory, and register the policy:

event manager directory user policy flash:/policies

event manager policy sl_ivr_runner.tcl

New Member

Re: EEM: Set variable from syslog message

I am having a little bit of trouble with this...

My config is as follows:

event manager applet UserDefinedDivert

event syslog pattern "%IVR-2-APP_CRIT: 90"

action 002 syslog msg "Phone number is $pnum"

action 003 cli command "enable"

action 004 cli command "conf t"

action 005 cli command "voice translation-rule 3"

action 006 cli command "rule 1 /00442071234567/ /$pnum/"

action 007 cli command "end"

event manager policy sl_ivr_runner.tcl type user

Am I missing something?

Cisco Employee

Re: EEM: Set variable from syslog message

You need to remove the applet entirely. It has no use on EEM < 3.0. The Tcl policy replaces the whole thing.

Modify the Tcl script so that it runs the desired CLI commands.

Then, you need to decide configure your EEM policy directory. This is the directory in which sl_ivr_runner.tcl exists on the device (e.g. flash:/policies). The command to add is:

event manager directory user policy DIRECTORY

Where DIRECTORY is your policy directory.

Once all of those steps are done, then the policy will work just like the applet does.

New Member

Re: EEM: Set variable from syslog message

Hmmm... I must be missing something fundamental here...

I amended the tcl script to have the following:

run_cli [list "voice translation-rule 3" "rule 1 /00442071234567/ /$pnum/"]

I then a have the following config:

!

event manager directory user policy "flash:/"

event manager policy sl_ivr_runnerv2.tcl type user

!

And then I made a test call and I see that the syslog message generated by the original script is present BUT the syslog generated by your tcl script is not present so it looks like the script is not called.

Apologies if I am missing the obvious...

New Member

Re: EEM: Set variable from syslog message

A few debugs showing that it doesn't go into configuration mode... guess I need to amend the script a little bit.

Will post again to let you know how I get on.

May 13 2009 23:24:26.473 BST: %HA_EM-6-LOG: sl_ivr_runnerv2.tcl : DEBUG(cli_lib) : OUT : Router#

May 13 2009 23:24:26.473 BST: [fh_cli_debug_cmd]

May 13 2009 23:24:26.473 BST: %HA_EM-6-LOG: sl_ivr_runnerv2.tcl : DEBUG(cli_lib) : IN : Router#voice translation-rule 3

May 13 2009 23:24:26.473 BST: [fh_tty_write_cmd]

May 13 2009 23:24:26.473 BST: [fh_tty_write_cmd] cmd = voice translation-rule 3, cmdsize = 24

May 13 2009 23:24:26.473 BST: [fh_sys_reqinfo_routername_cmd]

May 13 2009 23:24:26.489 BST: [fh_tty_read_cmd]

May 13 2009 23:24:26.489 BST: [fh_tty_read_cmd] size= 66

May 13 2009 23:24:26.489 BST: [fh_tty_prompt_cmd]

May 13 2009 23:24:26.593 BST: [fh_cli_debug_cmd]

May 13 2009 23:24:26.593 BST: %HA_EM-6-LOG: sl_ivr_runnerv2.tcl : DEBUG(cli_lib) : OUT : ^

May 13 2009 23:24:26.593 BST: %HA_EM-6-LOG: sl_ivr_runnerv2.tcl : DEBUG(cli_lib) : OUT : % Invalid input detected at '^' marker.

Cisco Employee

Re: EEM: Set variable from syslog message

Yes, you need to adjust the run_cli line:

run_cli [list "config t" ...]

New Member

Re: EEM: Set variable from syslog message

Finally! Fixed...

I needed to add an extra parameter to go into config mode:

run_cli [list "config t" "voice translation-rule 3" "rule 1 /00442081234567/ /$pnum/"]

Thank you.

Appreciate all the patience and help I have had from you. :)

Cisco Employee

Re: EEM: Set variable from syslog message

Try registering this version. See if you get any output.

New Member

Re: EEM: Set variable from syslog message

The original is working fine Jo. Thank you, I had to add the statement "config t" in the command list. :)

Thank you again. Could not have finished this POCL with you.

881
Views
0
Helpful
20
Replies
CreatePlease to create content