RE: EEM not working

Thanks Nick & everybody,

 Its working with \ before ( and )

Regards,
Girish

-----Original Message-----
From: Nick Matthews [mailto:matthn_at_gmail.com]
Sent: Thursday, May 21, 2009 3:52 PM
To: Bryan Bartik
Cc: Malla, Girish; Lloyd Ardoin; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
Subject: Re: EEM not working

Just as I had thought, you need the \ before the ) and (.

This is working in my lab:

event manager applet test

 event syslog pattern ".*%DUAL-5-NBRCHANGE: IP-EIGRP\(0\) 1: Neighbor
192.168.2.1 \(Serial1/0\) is down: holding time expired"

 action 1.0 cli command "enable"

 action 1.1 cli command "configure terminal"

 action 1.3 syslog msg "Static route removed"

Slightly modified with .* at the beginning because I was using "send
log" which prepends stuff to the line, and took out the ip route
statement.

-nick

On Thu, May 21, 2009 at 3:26 PM, Bryan Bartik <bbartik_at_ipexpert.com> wrote:
> Girish,
>
> I would try it in on a real rack if you can. I always have issues with
> dynamips and EEM. The script seems to die at config t. Did you do "debug
> event manager action cli"? This is a good command for seeing your commands
> are being entered.
>
> On Thu, May 21, 2009 at 1:22 PM, Malla, Girish <Girish.Malla_at_amd.com> wrote:
>
>> I am using Dynamips.
>>
>> Both \. And \( is not working I tried like
>>
>> "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\(.168\(.3\(.2
>> (FastEthernet0/0) is down: holding time expired"
>>
>> "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\(168\(3\(2
>> (FastEthernet0/0) is down: holding time expired"
>>
>>
>>
>>
>>
>> %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192\.168\.3\.2
>> (FastEthernet0/0) is down: holding time expired
>>
>>
>>
>> Regards,
>>
>> *Girish*
>>
>>
>>
>> *From:* Bryan Bartik [mailto:bbartik_at_ipexpert.com]
>> *Sent:* Thursday, May 21, 2009 2:12 PM
>> *To:* Lloyd Ardoin
>> *Cc:* Malla, Girish; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
>> *Subject:* Re: EEM not working
>>
>>
>>
>> Or maybe I should say "does it start"? :) I tried with dynamips and it
>> stalled on "config t." What do you get with "debug event manager action
>> cli"?
>>
>> On Thu, May 21, 2009 at 1:04 PM, Bryan Bartik <bbartik_at_ipexpert.com>
>> wrote:
>>
>> The script starts so I would think the pattern is okay. Tried adding an
>> "exit" command after the route. Also, is this dynamips or a real router?
>>
>>
>>
>> On Thu, May 21, 2009 at 12:49 PM, Lloyd Ardoin <Lloyd_at_thewizkid.biz>
>> wrote:
>>
>> Y have your escape character backwards... 192\.168\.1\.1 and as the
>> other gentleman said the other meta characters have to be escaped like
>> the parenthesis \(
>>
>> hth,
>> Lloyd
>>
>> On May 21, 2009, at 1:17 PM, Malla, Girish wrote:
>>
>> > Thanks guys for quick response .
>> >
>> > I tried with \. But it didn t work. i.e. %DUAL-5-NBRCHANGE: IP-
>> > EIGRP(0) 1: Neighbor 192/.168/.3/.2 (FastEthernet0/0) is down:
>> > holding time expired
>> >
>> > But this message pattern is working event syslog pattern
>> > ".*192.168.3.2.*down.*
>> >
>> > Regards,
>> > Girish
>> >
>> > From: Lloyd Ardoin [mailto:Lloyd_at_TheWizKid.biz]
>> > Sent: Wednesday, May 20, 2009 2:28 PM
>> > To: Malla, Girish; ccielab_at_groupstudy.com; nobody_at_groupstudy.com
>> > Subject: RE: EEM not working
>> >
>> > I fought this for a long time once. Here is the answer...basic
>> > regular expression formatting issue on the ip address, since the
>> > period is a meta character it has to be escaped like this - 192\.
>> > 168\.1\.0
>> >
>> > HTH,
>> > Lloyd
>> >
>> >
>> > From: Malla, Girish
>> > Sent: Wed 5/20/2009 12:37 PM
>> > To: ccielab_at_groupstudy.com; nobody_at_groupstudy.com
>> > Subject: EEM not working
>> > Experts,
>> >
>> >
>> >
>> > I am facing problem with below configuration. Anything wrong in this
>> > configuration? The EEM is not able to match this syslog message. Does
>> > the EEM match only specific syslog messages?
>> >
>> >
>> >
>> >
>> >
>> > event manager applet test
>> >
>> > event syslog pattern "%DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor
>> > 192.168.2.1 (Serial1/0) is down: holding time expired"
>> >
>> > action 1.0 cli command "enable"
>> >
>> > action 1.1 cli command "configure terminal"
>> >
>> > action 1.2 cli command "no ip route 192.168.1.0 255.255.255.0
>> > fastEthernet 0/0 192.168.3.2"
>> >
>> > action 1.3 syslog msg "Static route removed"
>> >
>> >
>> >
>> > below are the output of "debug event manager all"
>> >
>> >
>> >
>> > *Mar 1 03:56:34.431: fh_fd_syslog_event_match: num_matches = 0
>> >
>> > *Mar 1 03:56:34.431: fh_fd_data_syslog: num_matches = 0
>> >
>> >
>> >
>> > Regards,
>> >
>> > Girish
>> >
>> >
>> > Blogs and organic groups at http://www.ccie.net
>> >
>> > _______________________________________________________________________
>> > Subscription information may be found at:
>> > http://www.groupstudy.com/list/CCIELab.html
>> >
>> >
>> >
>> >
>> >
>> >
>> >
>>
>> Lloyd V Ardoin
>> lloyd_at_thewizkid.biz
>>
>>
>>
>> Blogs and organic groups at http://www.ccie.net
>>
>> _______________________________________________________________________
>> Subscription information may be found at:
>> http://www.groupstudy.com/list/CCIELab.html
>>
>>
>>
>>
>>
>>
>>
>>
>> --
>>
>> Bryan Bartik
>> CCIE #23707 (R&S), CCNP
>> Sr. Support Engineer - IPexpert, Inc.
>> URL: http://www.IPexpert.com
>>
>>
>>
>>
>> --
>> Bryan Bartik
>> CCIE #23707 (R&S), CCNP
>> Sr. Support Engineer - IPexpert, Inc.
>> URL: http://www.IPexpert.com
>>
>
>
>
> --
> Bryan Bartik
> CCIE #23707 (R&S), CCNP
> Sr. Support Engineer - IPexpert, Inc.
> URL: http://www.IPexpert.com
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Fri May 22 2009 - 20:13:53 ART