Why does EEM execute syslog but not the cli commands

[James Yeo]

Hi all,

Having issues with EEM as I need to execute commands to help troubleshoot High CPU.

My config:

event manager directory user policy "disk0:/"
event manager applet CPU_Over_80%
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.10 get-type next entry-op ge entry-val "10" entry-type value exit-time 300 poll-interval 5 maxrun 300
action 1.0 syslog msg "High CPU Utilization Condition: Over 80%"
action 1.1 cli command "enable"
action 2.0 syslog msg "Started logging information to disk0:CPU-UTIL_80.txt..."
action 2.1 cli command "show clock | append disk0:CPU-UTIL_80.txt"
action 3.0 syslog msg "Starting NETDR Capture to disk0:CPU-UTIL_80.txt"
action 4.0 cli command "debug netdr capture rx"
action 5.0 cli command "show clock | append disk0:CPU-UTIL_80.txt"
action 5.1 cli command "show proc cpu history | append disk0:CPU-UTIL_80.txt"
action 5.2 cli command "show proc cpu sorted | append disk0:CPU-UTIL_80.txt"
action 5.3 cli command "show log | append disk0:CPU-UTIL_80.txt"
action 5.4 cli command "show clock | append disk0:CPU-UTIL_80.txt"
action 6.0 cli command "undebug all"
action 7.0 cli command "show netdr captured-packets | append disk0:CPU-UTIL_80.txt"
action 8.0 cli command "debug netdr clear-capture"
action 9.0 cli command "show clock | append disk0:CPU-UTIL_80.txt"
action 9.1 cli command "exit"
action 9.2 syslog msg "Finished logging information to disk0:CPU-UTIL_80.txt..."
!
end

Here is the syslog messages popping up but no info on disk0:

6500#
378445: Apr 24 10:04:14.376 GMT+2: %HA_EM-6-LOG: CPU_Over_80%: High CPU Utilization Condition: Over 80%
378446: Apr 24 10:04:14.588 GMT+2: %HA_EM-6-LOG: CPU_Over_80%: Started logging information to disk0:CPU-UTIL_80.txt...
378447: Apr 24 10:04:14.600 GMT+2: %HA_EM-6-LOG: CPU_Over_80%: Starting NETDR Capture to disk0:CPU-UTIL_80.txt
378448: Apr 24 10:04:14.932 GMT+2: %HA_EM-6-LOG: CPU_Over_80%: Finished logging information to disk0:CPU-UTIL_80.txt...
6500_Prod#

Thanks

James

[Joe Clarke · Accepted solution]

Could be a problem with AAA command authorization.  Enable "debug event manager action cli" and post the output.

[James Yeo]

Hi Joseph,

You are correct. After runniing the commands in debug, authorisation fails :-) Below is the auth configs:

aaa authorization exec tacacs-author group tacacs+ local

aaa authorization commands 0 tacacs-author group tacacs+ local

aaa authorization commands 1 tacacs-author group tacacs+ local

aaa authorization commands 15 tacacs-author group tacacs+ local

Is there anything special one needs to do for the local device to run the cli commands? Will read in the doc to see in the meantime

Thanks

James

[Joe Clarke]

Configure:

event manager session cli username USER

Where USER is an AAA user authorized to run all of the CLI commands in your EEM policies.