Background #
In 64-bit XR system, we have a easy way to monitor syslog and trigger a collection action. (EDCD + PAM EEM agent)
In 32-bit XR system, we may only can use the EEM script.
But the EEM script is hard for us to write. there are cups of articles that show some examples, we can reference and do some modify.
Reference: ASR9000 EEM Script repository
EEM Script #
The EEM script can run in the background when a Syslog like “%ROUTING-BGP-3-NPL_TIMEOUT” appears, then it begins to collect two show tech files:
::cisco::eem::event_register_syslog pattern "%ROUTING-BGP-3-NPL_TIMEOUT" maxrun_sec 600
#
# errorInfo gets set by namespace if any of the auto_path directories do not
# contain a valid tclIndex file. It is not an error just left over stuff.
# So we set the errorInfo value to null so that we don't have left
# over errors in it.
#
set errorInfo ""
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
#
# errorInf gets set by namespace if any of the auto_path directories do not
# contain a valid tclIndex file. It is not an error just left over stuff.
# So we set the errorInfo value to null so that we don't have left
# over errors in it.
#
set errorInfo ""
#Notify users that we're collecting
set output_msg "Collecting commands"
action_syslog priority info msg $output_msg
#query the event info
array set arr_einfo [event_reqinfo]
if {$_cerrno != 0} {
set result [format "component=%s; subsys err=%s; posix err=%s;\n%s" \
$_cerr_sub_num $_cerr_sub_err $_cerr_posix_err $_cerr_str]
error $result
}
#Extract the message from the event info and append it to the email body
set syslog_msg $arr_einfo(msg)
#open a cli connection
if [catch {cli_open} result] {
error $result $errorInfo
} else {
array set cli1 $result
}
if [catch {cli_exec $cli1(fd) "term len 0"} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "show tech routing bgp "} _cli_result] {
error $_cli_result $errorInfo
}
if [catch {cli_exec $cli1(fd) "show tech-support tcp nsr"} _cli_result] {
error $_cli_result $errorInfo
}
# Close open cli before exit.
if [catch {cli_close $cli1(fd) $cli1(tty_id)} result] {
error $result $errorInfo
}
IOX Router Config #
event manager directory user policy harddisk:/scripts/
event manager policy bgpnpl.tcl username event_manager_user persist-time 3600
username event_manager_user
group root-system
group cisco-support
!
aaa authorization commands eem-method none
aaa authorization eventmanager default local
line template eem-template
authorization commands eem-method
!
vty-pool eem 100 105 line-template eem-template
Copy your script to harddisk:/scripts/
Verify the output from the Router #
RP/0/RP0/CPU0:Lab#show cli history detail
963 - vty100 exec Thu Feb 1 15:36:32.105 2024 UTC terminal length 0
964 - vty100 exec Thu Feb 1 15:36:32.513 2024 UTC terminal length 0
965 - vty100 exec Thu Feb 1 15:36:32.935 2024 UTC show tech-support routing bgp
994 - vty100 exec Thu Feb 1 15:40:58.091 2024 UTC show tech-support tcp nsr
1000 - vty100 exec Thu Feb 1 15:43:09.972 2024 UTC exit
RP/0/RP0/CPU0:TAC-Lab#dir harddisk:/showtech
Thu Feb 1 15:42:05.904 UTC
Directory of harddisk:/showtech
24166 -rw- 17359650 Thu Feb 1 15:40:57 2024 showtech-bgp-2024-Feb-01.153633.UTC.tgz
24167 drwx 4096 Thu Feb 1 15:41:42 2024 showtech-tcp_nsr-2024-Feb-01.154058.UTC
6302136320 bytes total (3869633024 bytes free)
Notes #
Be careful to use it to collect showtech file or some heavy output, as it may increase router loaded and cause some other issue.