Help with EEM script emailing server

Mark Malone · ‎09-05-2017

Hi i have wriiteen an EEM script basic enough but contains a lot of lines for data collection which work

What i want the script to do is

1 when BGP fails collects all commands and dump them into flash in TXT file (this works)

2 When BGP comes backup wait 5 minutes for everything to settle then email me the file in flash too that was just generated (This doesnt work)

3 Just keep the latest copy in flash only

Now No 1 is working fine file gets dumped to flash

32 -rw- 65898 Sep 5 2017 12:09:20 +00:00 BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR.txt

But i cant get the file to email to me even though i can ping the email server from the router when the BGP is backup

Once this is fully working i plan to convert it to TCL using i think Joes tool so theres less config on the router , were running thousands of lines per device so anything i can keep off it the better ........https://www.marcuscom.com/convert_applet/

Here is exactly what i have , i have left out all the action lines that just collect config as that works its the EMAIL but not working right

I have omitted large part of actions as there just collecting commands 0.6 - 6.7

Im obviously doing something wrong with second syslog match as it doesnt even appear in my running config , so how do i match it when it comes back up and get ot to email

event manager applet BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR
event syslog pattern ".*%BGP-5-ADJCHANGE:.*"
action 0.1 info type routername
action 0.2     cli command "enable"
action 0.3     cli command "del /force bootflash:BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR.txt"
action 0.5     cli command "trace 172.x.x.x num | append

.....

....

.....
action 6.8 cli command "end"
event syslog pattern ".*%BGP-5-ADJCHANGE:.*"
action 6.9 wait 300
action 7.0 mail to "netws@gggg.com" from "mmalone@gggg.com" server "172.x.x.x" subject "BGP/IWAN Failed Information Automatically Collected Emailed And Attached To BootFlash" body "$results"
action 7.1 cli "end"

Also it im hogging the sessions too even though i put the end statement in , i locked myself out temmporarai;luy as all the lines were used

%HA_EM-3-FMPD_ERROR: Error executing applet BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR statement 0.2
388677: Sep 5 12:07:02.615 UTC: %HA_EM-3-FMPD_CLI_CONNECT: Unable to establish CLI session: 'Embedded Event Manager' detected the 'fatal' condition 'no tty lines available, minimum of 2 required by EEM'
388678: Sep 5 12:07:02.615 UTC: %HA_EM-3-FMPD_ERROR: Error executing applet BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR statement 0.2

Thanks for any tips

Joe Clarke · ‎09-05-2017

EEM policies have a default max runtime of 20 seconds. Therefore, waiting 300 isn't going to work without increasing that timer. But that is not the right way to do what you want.

Have a read through How To Introduce Large Delays In EEM Policies . This will give you a solution for adding your hold down timer.

Mark Malone · ‎09-06-2017

Thanks Joe looking at it now

Mark Malone · ‎09-06-2017

Hi Joe

are you not allowed have 2 sysliog matches in the same script , the syntax is there but whenever i add it to the script it doesnt show in running config even though it takes the commands

And can you use the event timer countdown like i have or does it have to be nestled like the link you sent me

no event manager applet BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR
event manager applet BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR
event syslog pattern ".*%BGP-5-ADJCHANGE:.*"
action 0.1 info type routername
action 0.2     cli command "enable"
action 0.3     cli command "del /force bootflash:BGP_IWAN_FAIL_NOTIFICATION_AUTO_LOG_COLLECTOR.txt"
action 0.5     cli command "trace 172.22.160.3 num | append
action 6.8     cli command "end"
event syslog pattern ".*%BGP-5-ADJCHANGE:.*"
action 6.9     cli command "event timer countdown time 300"
action 7.0 mail to .....................................................

Joe Clarke · ‎09-06-2017

You need to create a nested applet. What you're doing here is essentially overwriting the initial applet's event. Pay close attention to the syntax in the article for adding the delay. You need to wrap the "event" command in a CLI command.

If you want to add multiple events in a single policy, then you need to use the tag syntax:

event tag syslog1 syslog ...

event tag syslog2 syslog ...

trigger

 correlate event syslog1 or event syslog2

Mark Malone · ‎09-06-2017

Ok thank you