Cisco – TCP Client / Server in Cisco EEM 3.0

ciscocisco-eemcisco-ios-12

I'm attempting to set up client / server sockets in Cisco EEM 3.0 TCL with IOS version 12.4(24)T8 (this was recently upgraded to determine whether the problem was EEM ver).

I have the following two example Tcl scripts (ref: http://wiki.tcl.tk/15315 )

Server.tcl:

::cisco::eem::event_register_none maxrun 120

namespace import ::cisco::eem::*
namespace import ::cisco::lib::*

proc accept {chan addr port} {
    puts "$addr:$port says [gets $chan]"
    puts $chan goodbye
    close $chan
}
socket -server accept 12345
vwait forever

Client.tcl:

::cisco::eem::event_register_none maxrun 20

namespace import ::cisco::eem::*
namespace import ::cisco::lib::*

set chan [socket 10.0.0.2 12345]
puts $chan hello
flush $chan
puts "10.0.0.2:12345 says [gets $chan]"
close $chan

10.0.0.2 is assigned to a loopback.

When I show the listening ports via the "show control-plane host open-ports" command, the server port of 12345 is listening, but the client script does not produce any output. A telnet to the router (via a physical interface) to port 12345 results in a connection refused. No ACLs are enabled.

These scripts work from a Windows XP computer running ActiveTCL 8.5.

Is this a bug or security feature within EEM 3.0? Are any additional commands or settings required to enable TCP sockets within EEM 3.0?

Best Answer

I would start with debugging commands. I'd start with

debug event manager tcl cli

There's more information in the EEM best practices document over at https://supportforums.cisco.com/docs/DOC-12757 about debugging and troubleshooting.

Related Solutions

Cisco – time based interface shutdown on cisco router

You can do this with time-based ACL's when talking about ports, or with EEM when talking about interfaces:

interface wlan0
ip address 10.1.1.1 255.255.255.0 
ip access-group 101 in      

access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255        
eq telnet time-range EVERYOTHERDAY  

time-range EVERYOTHERDAY 
periodic Monday Wednesday Friday 8:00 to 17:00

Source: http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#timebasedtimerange

When you want to shut down an interface, take a look at the next article:

https://supportforums.cisco.com/thread/202630 (answer Joseph Clarke)

event manager applet shutdown_port
event timer cron cron-entry "0 0 * * *"
action 010 cli command "enable"
action 020 cli command "config t"
action 030 cli command "interface FastEthernet1/0/1"
action 040 cli command "shut"
action 050 cli command "end"
action 060 syslog msg "Interface FastEthernet1/0/1 has been shutdown"

event manager applet noshut_port
event timer cron cron-entry "0 8 * * *"
action 010 cli command "enable"
action 020 cli command "config t"
action 030 cli command "interface FastEthernet1/0/1"
action 040 cli command "no shut"
action 050 cli command "end"
action 060 syslog msg "Interface FastEthernet1/0/1 has been restored"

in the example above: The port will be shutdown every day at midnight, and brought back up every day at 8 am.

You should look into the cron-entry option (like crontabs in linux/unix) reference: http://www.rogerperkin.co.uk/ccie/index.php/eem-2/understanding-cisco-eem-event-timer-cron/

There are 5 values you can specify for the cron timer

minute – this controls what minute of the hour the command will fire values between 0 and 59
hour – this controls what hour the command will run – specified in the 24 hour clock format 0-23 0=midnight
dom – day of month that you want the command to run e.g 20th = 20
dow – day of week it can be numeric 0-7 or name of day e.g sat

Examples:

01 * * * * This command is run at one min past every hour
17 8 * * * This command is run daily at 8:17 am
*/1 **** this command runs every minute

Cisco EEM – Passing Syslog Messages to a TCL Script in Cisco EEM

Alright, so

action policy POLICY_NAME $arg

doesn't pass arguments to the script - had to switch to

action cli command "tclsh flash:/script.tcl $arg"`

which does, HOWEVER...

EEM actions are unable to capture beyond a newline from a variable. I did find a way out though - trim the newline from $_syslog_msg (newline is the first char) and assign to a new variable.

Here's the end-to-end solution:

CISCO-1811#sh run | s event
event manager directory user policy "flash:/"
event manager directory user library "flash:/"
event manager directory user repository tftp://1.1.1.3/
event manager applet TRIGGER_ON_SYSLOG
  event syslog occurs 1 pattern "%.*"
  action 1.0 string trimleft "$_syslog_msg"
  action 2.0 cli command "enable"
  action 2.1 cli command "tclsh flash:/sendevent.tcl \"$_string_result\""

$_string_result is an EEM built-in variable that collects the output of string trimleft

From http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-a2.html:

Use the action string trimleft command to trim a string from the left end of another string. This command trims the characters specified by string2 from the left end of string1. By default, string2 corresponds to white space.

The table below shows the built-in variable in which the result of the action string trimleft command is stored.

Built-in Variable: $_string_result

Description: The result of the action string trimleft command is stored in this variable.

The above is actually incomplete/misleading/or Cisco has no idea how the language they picked works: string trimleft without a second argument trims space, tab, newline, and CR not just white space (See this: http://wiki.tcl.tk/10177).

sendevent.tcl

#...
# my own http_get implementation here
# ...

# My actual event code

set url "http://some.http.destination:8000"

# Event log message is passed in as "$argv 0".
# That's the first item in $argv (which is a list)
set rawmsg [lindex $argv 0]

# Strip quotes from syslog message
set cleanmsg [string map { "\"" "" } $rawmsg]

# Get the time stamp at source
set timestamp [clock format [clock seconds] -format "%Y-%m-%dT%H:%M:%S"]

set json "{
    \"RouterTimestamp\": \"$timestamp\",
    \"Message\": \"$cleanmsg\"
}\n"

# This makes a POST request. Yes a POST.
# Don't know, ask the TCL developers what's with the name :)
if {[catch {http_get $url -query $json} token]} {
    puts "HTTP POST request failed: $token"
} else {
    # Everything is fine
    puts "POST successful."
}

Result

POST / HTTP/1.1
Accept: */*
Host: some.http.destination
User-Agent: Snobu Speshul TCL HTTP/1.1 Client library // build 21
Connection: close
Content-Length: 151
Content-Type: application/json

{
    "RouterTimestamp": "2017-02-02T10:09:49",
    "Message": "*Feb  2 10:09:49.307: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console"
}

GitHub repo here (code complete): https://github.com/snobu/cisco-syslog-over-http