Kron TCL Job

[efairbanks]

I have seen several references to spawning a TCL script from a kron job, but no actual example of how to do it. Everything I have read pertaining to kron jobs states that kron jobs can only execute exec commands that are independent of one another. For example, to run a TCL script you must first enter the TCL scripting environment by typing "tclsh", therefore the TCL script itself is dependent on the preceeding "tclsh" command and fails. Has anoyone gotten this to work? Thanks in advance for any assistance provided.

[wong34539]

One of the practical example of using kron job is configuring the interface to shut down at specified time and making it up during another specific time.Write a script that will telnet to the router, go to enable mode, config mode and the interface. It will then do a shut/no shut on the BRI interface.

[Joe Clarke]

TCL and kron only started working together in 12.4. Prior to that, kron thought all TCL scripts were interactive, and refused to execute them. If you want to run a TCL script, say script.tcl, out of kron, do the following:

kron occurrence tcl_occur in 12:0 recurring

policy-list tclpol

kron policy-list tclpol

tclsh flash:/script.tcl

This will run the script.tcl TCL script every 12 hours.

As an alternative to this, check out the Embedded Event Manager and its TCL policy capability (http://www.cisco.com/en/US/products/ps6441/products_configuration_guide_chapter09186a0080559cd5.html ). You can use a cron event detector to kick of a TCL script periodically.

[sunilferrao]

hi,

will this work over Tacacs ???

[Joe Clarke]

If you mean for purposes of authorization and accounting, yes. All kron occurrences can be scheduled as a particular user. All subsequent CLI commands will then run as that user. For example:

kron occurrence tclpol-occur user marcus in 12:0 recurring

policy-list tclpol

Will run the tclpol policy list every 12 hours as the user marcus.

[efairbanks]

How will the router authenticate as 'Marcus' without a password given?

Also, I created a very simple tcl ping script using 'exec' that runs fine when executed from the command line, but produces a "Major 4, Minor 8, Signaled from Runaway Process" error when ran by the kron process. The kron policy is then removed automatically from the router due to the error. The script, on average, takes 2 minutes to complete processing when run by a user. The kron process terminates after apx 30 seconds. Is there any fix for this? I have a requirement to to "wake up" a full mesh of tunnels on a daily basis. Kron scheduled TCL ping scripts look like a viable solution if I can get the thing to work....

[Joe Clarke]

It doesn't authenticate, it authorizes. It does not need a password for that.

There was a bug in code prior to 12.4(3) and 12.4(3)T where TCL scripts could not be run from kron. The behavior you are seeing is a symptom of that bug.

For this reason as well as for better reliability, you should consider porting your TCL script to an EEM timer policy. See http://www.cisco.com/en/US/products/ps6441/products_configuration_guide_chapter09186a0080559cd5.html for more on writing EEM TCL policies.

[efairbanks]

I am actually running 12.4(4)T, which shouldn't be affected by that bug. Regardless, I am going to take your advice and look into implementing an EEM timer policy. Thank you very much :)

-Erik

[Joe Clarke]

No it shouldn't. Something in your script must be causing kron to think the command is interactive. kron can certainly run scripts that take longer than 30 seconds.

EEM is a much better way to go anyway since you will only be using one subsystem to trigger and run your code.