action 1.0 syslog msg [message]
Generates a syslog message from an Embedded Event Manager (EEM) applet, used to log custom events or debug information during automation.
action 1.0 syslog msg [message]When to Use This Command
- Logging a custom message when a specific interface goes down to trigger troubleshooting.
- Recording the output of a show command during an event for later analysis.
- Sending a notification when a routing protocol neighbor state changes.
- Logging the time and details of a configuration change made via EEM.
Command Examples
Basic syslog message from EEM applet
action 1.0 syslog msg "Interface GigabitEthernet0/1 went down at [event-clock]"*Mar 1 12:34:56.789: %HA_EM-6-LOG: Interface GigabitEthernet0/1 went down at 12:34:56 UTC Mon Mar 1 2021
The output shows the syslog message generated by the EEM applet. The timestamp is automatically added by IOS. The message includes the custom text and the event-clock variable expanded to the current time.
Syslog with embedded show command output
action 1.0 syslog msg "Current OSPF neighbors: [show ip ospf neighbor]"*Mar 1 12:35:00.123: %HA_EM-6-LOG: Current OSPF neighbors: Neighbor ID Pri State Dead Time Address Interface 192.168.1.2 1 FULL/DR 00:00:35 10.0.0.2 GigabitEthernet0/0 192.168.1.3 1 FULL/BDR 00:00:33 10.0.0.3 GigabitEthernet0/0
The output includes the syslog header followed by the output of the 'show ip ospf neighbor' command embedded in the message. Each line shows neighbor details: Neighbor ID, Priority, State, Dead Time, Address, and Interface.
Understanding the Output
The output begins with a timestamp in the format '*Month Day HH:MM:SS.mmm:' followed by the syslog facility and severity code '%HA_EM-6-LOG'. The custom message text appears after the colon. If the message includes embedded command output (e.g., using [show command]), that output is inserted verbatim. In a real network, you would use these messages to track events, debug automation scripts, or trigger alerts. Good messages are clear and include relevant context like interface names or timestamps. Watch for messages that are too verbose or missing critical details.
CCNA Exam Tips
Remember that EEM applets use 'action' with a sequence number; the syslog action is just one of many actions.
You can embed show command output using square brackets, e.g., [show ip route].
The syslog message is generated with severity 6 (Informational) by default.
CCNA may test that EEM applets require 'event manager applet' configuration and that actions are executed in sequence.
Common Mistakes
Forgetting to enclose the message in double quotes if it contains spaces.
Using incorrect variable syntax like $(event-clock) instead of [event-clock].
Not including a sequence number before the action keyword (e.g., 'action syslog msg' instead of 'action 1.0 syslog msg').
Related Commands
Practice for the CCNA 200-301
Test your knowledge with hundreds of CCNA practice questions covering all exam domains.
Practice CCNA Questions