[c-nsp] eem-script problem

[Peter Rathlev]

On Thu, 2019-01-03 at 11:30 +0100, Robert Hass wrote:
> event manager applet blah2 authorization bypass
>  event syslog pattern "%CLEAR-5-COUNTERS: .*"
>  action 0.01 syslog msg "blah2 script"
>  action 0.02 cli command "enable"
>  action 0.03 cli command "term exec prompt timestamp"
>  action 0.04 cli command "term length 0"
>  action 0.05 cli command "show clock"
>  action 1.01 cli command "sh int gi 1 | include input errors"
>  action 1.02 regexp "frame.*" "" $_cli_result
>  action 1.03 puts "match is $_cli_result"
> 
> "sh int gigabitEthernet 1 | include input errors" returns line eg.:
>      2 input errors, 2 CRC, 0 frame, 0 overrun, 0 ignored
> 
> I want to have in syslog only 2 input errors, 2 CRC instead rest of
> line How I can do that ?

The "action regexp" syntax is:

  action <tag> regexp <regexp> <input> <match> <subvar1> <subvar...>

When testing on IOS 15.2 it seems that the regular expression has an
implicit anchor in the beginning ("^"). If you don't mind the extra
whitespace in front of the result then a short version is:

  action 1.02 regexp ".+CRC" $_cli_result var
  action 1.03 puts "match is $var"

If you want it without the excess whitespace then use a submatch:

  action 1.02 regexp " +(.*), [0-9]+ frame" $_cli_result dummy var
  action 1.03 puts "match is $var"

-- 
Peter