Re: EEM - Event manager not matching BGP syslog message

Your 2nd policy has two %'s. This may have something to do with half of it.

As well, if you have any type of AAA authorization, you may want to
enter this command to make sure that the commands are sent with the
right user id:

event manager session cli username <user>

Other than that, you should play with the 'send log' command to
reproduce the issue. You may need to enter a .* before your
expression if using this method. Other than that, things look fine.

-nick

On Sun, Jun 7, 2009 at 1:17 PM, marina ferreira<marinalf_at_msn.com> wrote:
> GS,
>
>
>
> I have read the archives and found some particularites to match EIGRP syslog
> messages in Event Manager, which requires some regular expression like \
> before ( and ), however I did not any find any reference to BGP syslog
> messages which does not have any ( or ). I can sucessfully use Event Manager
> in dynamips and it works great, matches BGP going down/up and disable the
> interface I need it to. However, when I test on real routers (12.4 also), it
> does not work. Wondering if any of you have any real deployments of EEM with
> BGP and if there is any specifics. I appreciate any inputs.
>
>
>
> Configuration:
>
> event manager applet BGP-DOWN
> event syslog pattern "%BGP-5-ADJCHANGE: neighbor 1.1.1.1 Down BGP
> Notification sent"
> action 1.0 cli command "enable"
> action 1.1 cli command "configure term"
> action 1.2 cli command "interface loopback100"
> action 1.3 cli command "shut"
> !
> event manager applet BGP-UP
> event syslog pattern "%%BGP-5-ADJCHANGE: neighbor 1.1.1.1 Up"
> action 1.0 cli command "enable"
> action 1.1 cli command "configure term"
> action 1.2 cli command "interface loopback100"
> action 1.3 cli command "no shut"
>
>
>
> Thank you,
>
> --Marina
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Sun Jun 07 2009 - 13:51:15 ART