Re: EEM not working

Girish,

I would try it in on a real rack if you can. I always have issues with
dynamips and EEM. The script seems to die at config t. Did you do "debug
event manager action cli"? This is a good command for seeing your commands
are being entered.

On Thu, May 21, 2009 at 1:22 PM, Malla, Girish <Girish.Malla_at_amd.com> wrote:

> I am using Dynamips.
>
> Both \. And \( is not working I tried like
>
> "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\(.168\(.3\(.2
> (FastEthernet0/0) is down: holding time expired"
>
> "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\(168\(3\(2
> (FastEthernet0/0) is down: holding time expired"
>
>
>
>
>
> %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\.168\.3\.2
> (FastEthernet0/0) is down: holding time expired
>
>
>
> Regards,
>
> *Girish*
>
>
>
> *From:* Bryan Bartik [mailto:bbartik_at_ipexpert.com]
> *Sent:* Thursday, May 21, 2009 2:12 PM
> *To:* Lloyd Ardoin
> *Cc:* Malla, Girish; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
> *Subject:* Re: EEM not working
>
>
>
> Or maybe I should say "does it start"? :) I tried with dynamips and it
> stalled on "config t." What do you get with "debug event manager action
> cli"?
>
> On Thu, May 21, 2009 at 1:04 PM, Bryan Bartik <bbartik_at_ipexpert.com>
> wrote:
>
> The script starts so I would think the pattern is okay. Tried adding an
> "exit" command after the route. Also, is this dynamips or a real router?
>
>
>
> On Thu, May 21, 2009 at 12:49 PM, Lloyd Ardoin <Lloyd_at_thewizkid.biz>
> wrote:
>
> Y have your escape character backwards... 192\.168\.1\.1 and as the
> other gentleman said the other meta characters have to be escaped like
> the parenthesis \(
>
> hth,
> Lloyd
>
> On May 21, 2009, at 1:17 PM, Malla, Girish wrote:
>
> > Thanks guys for quick response .
> >
> > I tried with \. But it didn t work. i.e. %DUAL-5-NBRCHANGE: IP-
> > EIGRP(0) 1: Neighbor 192/.168/.3/.2 (FastEthernet0/0) is down:
> > holding time expired
> >
> > But this message pattern is working event syslog pattern
> > ".*192.168.3.2.*down.*
> >
> > Regards,
> > Girish
> >
> > From: Lloyd Ardoin [mailto:Lloyd_at_TheWizKid.biz]
> > Sent: Wednesday, May 20, 2009 2:28 PM
> > To: Malla, Girish; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
> > Subject: RE: EEM not working
> >
> > I fought this for a long time once. Here is the answer...basic
> > regular expression formatting issue on the ip address, since the
> > period is a meta character it has to be escaped like this - 192\.
> > 168\.1\.0
> >
> > HTH,
> > Lloyd
> >
> >
> > From: Malla, Girish
> > Sent: Wed 5/20/2009 12:37 PM
> > To: ccielab_at_groupstudy.com; nobody_at_groupstudy.com
> > Subject: EEM not working
> > Experts,
> >
> >
> >
> > I am facing problem with below configuration. Anything wrong in this
> > configuration? The EEM is not able to match this syslog message. Does
> > the EEM match only specific syslog messages?
> >
> >
> >
> >
> >
> > event manager applet test
> >
> > event syslog pattern "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor
> > 192.168.2.1 (Serial1/0) is down: holding time expired"
> >
> > action 1.0 cli command "enable"
> >
> > action 1.1 cli command "configure terminal"
> >
> > action 1.2 cli command "no ip route 192.168.1.0 255.255.255.0
> > fastEthernet 0/0 192.168.3.2"
> >
> > action 1.3 syslog msg "Static route removed"
> >
> >
> >
> > below are the output of "debug event manager all"
> >
> >
> >
> > *Mar 1 03:56:34.431: fh_fd_syslog_event_match: num_matches = 0
> >
> > *Mar 1 03:56:34.431: fh_fd_data_syslog: num_matches = 0
> >
> >
> >
> > Regards,
> >
> > Girish
> >
> >
> > Blogs and organic groups at http://www.ccie.net
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
> >
> >
> >
> >
> >
> >
> >
>
> Lloyd V Ardoin
> lloyd_at_thewizkid.biz
>
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>
>
> --
>
> Bryan Bartik
> CCIE #23707 (R&S), CCNP
> Sr. Support Engineer - IPexpert, Inc.
> URL: http://www.IPexpert.com
>
>
>
>
> --
> Bryan Bartik
> CCIE #23707 (R&S), CCNP
> Sr. Support Engineer - IPexpert, Inc.
> URL: http://www.IPexpert.com
>

--
Bryan Bartik
CCIE #23707 (R&S), CCNP
Sr. Support Engineer - IPexpert, Inc.
URL: http://www.IPexpert.com
Blogs and organic groups at http://www.ccie.net