Re: EEM not working

The script starts so I would think the pattern is okay. Tried adding an
"exit" command after the route. Also, is this dynamips or a real router?

On Thu, May 21, 2009 at 12:49 PM, Lloyd Ardoin <Lloyd_at_thewizkid.biz> wrote:

> Y have your escape character backwards... 192\.168\.1\.1 and as the
> other gentleman said the other meta characters have to be escaped like
> the parenthesis \(
>
> hth,
> Lloyd
> On May 21, 2009, at 1:17 PM, Malla, Girish wrote:
>
> > Thanks guys for quick response .
> >
> > I tried with \. But it didn t work. i.e. %DUAL-5-NBRCHANGE: IP-
> > EIGRP(0) 1: Neighbor 192/.168/.3/.2 (FastEthernet0/0) is down:
> > holding time expired
> >
> > But this message pattern is working event syslog pattern
> > ".*192.168.3.2.*down.*
> >
> > Regards,
> > Girish
> >
> > From: Lloyd Ardoin [mailto:Lloyd_at_TheWizKid.biz]
> > Sent: Wednesday, May 20, 2009 2:28 PM
> > To: Malla, Girish; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
> > Subject: RE: EEM not working
> >
> > I fought this for a long time once. Here is the answer...basic
> > regular expression formatting issue on the ip address, since the
> > period is a meta character it has to be escaped like this - 192\.
> > 168\.1\.0
> >
> > HTH,
> > Lloyd
> >
> >
> > From: Malla, Girish
> > Sent: Wed 5/20/2009 12:37 PM
> > To: ccielab_at_groupstudy.com; nobody_at_groupstudy.com
> > Subject: EEM not working
> > Experts,
> >
> >
> >
> > I am facing problem with below configuration. Anything wrong in this
> > configuration? The EEM is not able to match this syslog message. Does
> > the EEM match only specific syslog messages?
> >
> >
> >
> >
> >
> > event manager applet test
> >
> > event syslog pattern "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor
> > 192.168.2.1 (Serial1/0) is down: holding time expired"
> >
> > action 1.0 cli command "enable"
> >
> > action 1.1 cli command "configure terminal"
> >
> > action 1.2 cli command "no ip route 192.168.1.0 255.255.255.0
> > fastEthernet 0/0 192.168.3.2"
> >
> > action 1.3 syslog msg "Static route removed"
> >
> >
> >
> > below are the output of "debug event manager all"
> >
> >
> >
> > *Mar 1 03:56:34.431: fh_fd_syslog_event_match: num_matches = 0
> >
> > *Mar 1 03:56:34.431: fh_fd_data_syslog: num_matches = 0
> >
> >
> >
> > Regards,
> >
> > Girish
> >
> >
> > Blogs and organic groups at http://www.ccie.net
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
> >
> >
> >
> >
> >
> >
> >
>
> Lloyd V Ardoin
> lloyd_at_thewizkid.biz
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>
>

-- 
Bryan Bartik
CCIE #23707 (R&S), CCNP
Sr. Support Engineer - IPexpert, Inc.
URL: http://www.IPexpert.com
Blogs and organic groups at http://www.ccie.net