RE: EEM not working

I am using Dynamips.

Both \. And \( is not working I tried like

"%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\(.168\(.3\(.2
(FastEthernet0/0) is down: holding time expired"

"%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\(168\(3\(2
(FastEthernet0/0) is down: holding time expired"

"%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\.168\.3\.2
(FastEthernet0/0) is down: holding time expired"

Regards,

Girish

From: Bryan Bartik [mailto:bbartik_at_ipexpert.com]
Sent: Thursday, May 21, 2009 2:12 PM
To: Lloyd Ardoin
Cc: Malla, Girish; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
Subject: Re: EEM not working

Or maybe I should say "does it start"? :) I tried with dynamips and it
stalled on "config t." What do you get with "debug event manager action
cli"?

On Thu, May 21, 2009 at 1:04 PM, Bryan Bartik <bbartik_at_ipexpert.com>
wrote:

The script starts so I would think the pattern is okay. Tried adding an
"exit" command after the route. Also, is this dynamips or a real router?

On Thu, May 21, 2009 at 12:49 PM, Lloyd Ardoin <Lloyd_at_thewizkid.biz>
wrote:

Y have your escape character backwards... 192\.168\.1\.1 and as the
other gentleman said the other meta characters have to be escaped like
the parenthesis \(

hth,
Lloyd

On May 21, 2009, at 1:17 PM, Malla, Girish wrote:

> Thanks guys for quick response .
>
> I tried with \. But it didn t work. i.e. %DUAL-5-NBRCHANGE: IP-
> EIGRP(0) 1: Neighbor 192/.168/.3/.2 (FastEthernet0/0) is down:
> holding time expired
>
> But this message pattern is working event syslog pattern
> ".*192.168.3.2.*down.*
>
> Regards,
> Girish
>
> From: Lloyd Ardoin [mailto:Lloyd_at_TheWizKid.biz]
> Sent: Wednesday, May 20, 2009 2:28 PM
> To: Malla, Girish; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
> Subject: RE: EEM not working
>
> I fought this for a long time once. Here is the answer...basic
> regular expression formatting issue on the ip address, since the
> period is a meta character it has to be escaped like this - 192\.
> 168\.1\.0
>
> HTH,
> Lloyd
>
>
> From: Malla, Girish
> Sent: Wed 5/20/2009 12:37 PM
> To: ccielab_at_groupstudy.com; nobody_at_groupstudy.com
> Subject: EEM not working
> Experts,
>
>
>
> I am facing problem with below configuration. Anything wrong in this
> configuration? The EEM is not able to match this syslog message. Does
> the EEM match only specific syslog messages?
>
>
>
>
>
> event manager applet test
>
> event syslog pattern "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor
> 192.168.2.1 (Serial1/0) is down: holding time expired"
>
> action 1.0 cli command "enable"
>
> action 1.1 cli command "configure terminal"
>
> action 1.2 cli command "no ip route 192.168.1.0 255.255.255.0
> fastEthernet 0/0 192.168.3.2"
>
> action 1.3 syslog msg "Static route removed"
>
>
>
> below are the output of "debug event manager all"
>
>
>
> *Mar 1 03:56:34.431: fh_fd_syslog_event_match: num_matches = 0
>
> *Mar 1 03:56:34.431: fh_fd_data_syslog: num_matches = 0
>
>
>
> Regards,
>
> Girish
>
>
> Blogs and organic groups at http://www.ccie.net
>
>
Received on Fri May 22 2009 - 00:52:45 ART