action 1.0 syslog msg [message]
Generates a syslog message from an Embedded Event Manager (EEM) applet, used to log custom events or debug information during automation.
Definition: action 1.0 syslog msg [message] is a Cisco IOS applet config command. Generates a syslog message from an Embedded Event Manager (EEM) applet, used to log custom events or debug information during automation.
Overview
The 'action 1.0 syslog msg [message]' command is used within Cisco IOS Embedded Event Manager (EEM) applets to generate a syslog message. EEM is a powerful automation framework that allows network engineers to monitor and react to events on Cisco devices. This command is critical for logging custom events, debugging automation scripts, and providing visibility into network behavior.
When an EEM applet triggers, the syslog message is sent to the device's logging buffer, syslog server, or console, depending on the logging configuration. This enables engineers to track specific occurrences, such as interface flapping, high CPU usage, or configuration changes, without manual intervention. The command is often used in conjunction with other EEM actions like 'cli', 'snmp-trap', or 'mail' to create comprehensive automation workflows.
It is particularly valuable for proactive monitoring and troubleshooting, as it can capture transient events that might otherwise go unnoticed. The syslog message can include variables like $_syslog_severity or $_event_id to provide context. This command does not modify the running configuration directly; it only generates log output.
It requires privilege level 15 to configure EEM applets. The syslog message is buffered and can be viewed with 'show logging'. Understanding this command is essential for CCNA and CCNP candidates as it demonstrates knowledge of network automation and event-driven operations, which are increasingly important in modern networks.
action 1.0 syslog msg [message]When to Use This Command
- Logging a custom message when a specific interface goes down to trigger troubleshooting.
- Recording the output of a show command during an event for later analysis.
- Sending a notification when a routing protocol neighbor state changes.
- Logging the time and details of a configuration change made via EEM.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| message | text string | The custom syslog message text to be generated. It can include plain text and EEM variables like $_syslog_severity or $_event_id. Common mistakes include forgetting to enclose the message in quotes if it contains spaces, or using unsupported special characters. The message length is limited to 255 characters. |
Command Examples
Basic syslog message from EEM applet
action 1.0 syslog msg "Interface GigabitEthernet0/1 went down at [event-clock]"*Mar 1 12:34:56.789: %HA_EM-6-LOG: Interface GigabitEthernet0/1 went down at 12:34:56 UTC Mon Mar 1 2021
The output shows the syslog message generated by the EEM applet. The timestamp is automatically added by IOS. The message includes the custom text and the event-clock variable expanded to the current time.
Syslog with embedded show command output
action 1.0 syslog msg "Current OSPF neighbors: [show ip ospf neighbor]"*Mar 1 12:35:00.123: %HA_EM-6-LOG: Current OSPF neighbors: Neighbor ID Pri State Dead Time Address Interface 192.168.1.2 1 FULL/DR 00:00:35 10.0.0.2 GigabitEthernet0/0 192.168.1.3 1 FULL/BDR 00:00:33 10.0.0.3 GigabitEthernet0/0
The output includes the syslog header followed by the output of the 'show ip ospf neighbor' command embedded in the message. Each line shows neighbor details: Neighbor ID, Priority, State, Dead Time, Address, and Interface.
Understanding the Output
The output begins with a timestamp in the format '*Month Day HH:MM:SS.mmm:' followed by the syslog facility and severity code '%HA_EM-6-LOG'. The custom message text appears after the colon. If the message includes embedded command output (e.g., using [show command]), that output is inserted verbatim.
In a real network, you would use these messages to track events, debug automation scripts, or trigger alerts. Good messages are clear and include relevant context like interface names or timestamps. Watch for messages that are too verbose or missing critical details.
Configuration Scenarios
Log Interface Status Change with Custom Syslog
A network engineer wants to log whenever a specific interface goes up or down, including the interface name and new state, to assist in troubleshooting intermittent connectivity issues.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2Steps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Enter EEM applet configuration: Router(config)# event manager applet LOG_INTERFACE
- 3.Step 3: Define the event trigger: Router(config-applet)# event syslog pattern '.*UPDOWN.*GigabitEthernet0/0.*'
- 4.Step 4: Set the action to generate a syslog message: Router(config-applet)# action 1.0 syslog msg 'Interface Gi0/0 state changed'
- 5.Step 5: Exit applet configuration: Router(config-applet)# end
! Full IOS config block Router(config)# event manager applet LOG_INTERFACE Router(config-applet)# event syslog pattern '.*UPDOWN.*GigabitEthernet0/0.*' Router(config-applet)# action 1.0 syslog msg 'Interface Gi0/0 state changed' Router(config-applet)# end
Verify: Use 'show event manager policy available' to verify the applet is registered. Then, simulate an interface flap with 'shutdown' and 'no shutdown' on Gi0/0, and check 'show logging' for the custom syslog message.
Watch out: The syslog pattern must match the exact format of the IOS syslog message. Use 'show logging' to see the actual syslog format and adjust the regex accordingly.
Log High CPU Usage Event with Severity
An engineer needs to be alerted when CPU utilization exceeds 90% for more than 10 seconds, with the syslog message including the severity level for filtering.
Topology
Single router R1Steps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Enter EEM applet configuration: Router(config)# event manager applet HIGH_CPU
- 3.Step 3: Define the event trigger for CPU threshold: Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 90 poll-interval 10
- 4.Step 4: Set the action to generate a syslog message with severity: Router(config-applet)# action 1.0 syslog msg 'High CPU: $_event_pub1'
- 5.Step 5: Exit applet configuration: Router(config-applet)# end
! Full IOS config block Router(config)# event manager applet HIGH_CPU Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 90 poll-interval 10 Router(config-applet)# action 1.0 syslog msg 'High CPU: $_event_pub1' Router(config-applet)# end
Verify: Use 'show event manager policy available' to verify. Generate high CPU load (e.g., with 'ping flood') and check 'show logging' for the custom message. The variable $_event_pub1 will contain the CPU value.
Watch out: The SNMP OID for CPU utilization may vary by IOS version. Verify the correct OID using 'show snmp mib walk' or consult documentation. Also, ensure SNMP is configured on the device.
Troubleshooting with This Command
When troubleshooting EEM applets that use the 'action syslog msg' command, the first step is to verify that the applet is registered and enabled. Use 'show event manager policy available' to list all registered policies and check their status. If the applet is not listed, it may not have been configured correctly or the event trigger may not be valid.
Next, check the logging configuration with 'show logging' to ensure syslog messages are being captured. Look for the custom message in the logging buffer. If the message is not appearing, verify that the event trigger conditions are met.
For example, if using a syslog pattern event, ensure the pattern matches the exact syslog message format. Use 'debug event manager action cli' to see detailed output of EEM actions, but be cautious as this can generate a lot of output. Common symptoms include the syslog message appearing but with incorrect variable substitution, which indicates a syntax error in the message string.
Also, check the severity level of the syslog message; by default, EEM syslog messages are severity 6 (informational). If you need a different severity, use the 'severity' option in the action command. Correlate the EEM syslog messages with other show commands like 'show process cpu' or 'show interface' to understand the context.
If the applet triggers too frequently, consider adjusting the event parameters or adding a 'time' action to throttle. Remember that EEM applets run in the control plane, so excessive logging can impact CPU. Use 'show event manager statistics' to see how many times the applet has triggered.
Finally, ensure that the device's clock is set correctly, as syslog messages are timestamped. If the applet uses variables like $_event_time, incorrect time can lead to confusion. By following this systematic approach, you can effectively troubleshoot EEM syslog actions and ensure they provide the intended visibility.
CCNA Exam Tips
Remember that EEM applets use 'action' with a sequence number; the syslog action is just one of many actions.
You can embed show command output using square brackets, e.g., [show ip route].
The syslog message is generated with severity 6 (Informational) by default.
CCNA may test that EEM applets require 'event manager applet' configuration and that actions are executed in sequence.
Common Mistakes
Forgetting to enclose the message in double quotes if it contains spaces.
Using incorrect variable syntax like $(event-clock) instead of [event-clock].
Not including a sequence number before the action keyword (e.g., 'action syslog msg' instead of 'action 1.0 syslog msg').
action 1.0 syslog msg [message] vs event manager applet
Both commands are part of Cisco's Embedded Event Manager (EEM) but serve different roles: 'action 1.0 syslog msg' is a subcommand used inside an applet to generate a syslog message, while 'event manager applet' is the global configuration command that creates the applet itself. They are often confused because both are essential to EEM automation, yet one defines the container and the other defines an action within it.
| Aspect | action 1.0 syslog msg [message] | event manager applet |
|---|---|---|
| Scope | Single action within an applet | Defines the entire applet |
| Configuration mode | Applet Config (after 'event manager applet' and 'event xxx') | Global Config |
| Persistence | Saved as part of the applet configuration | Saved as a top-level EEM configuration |
| Cause of execution | Triggered only when the applet runs due to its event | Not directly executed; defines the event that triggers the applet |
| Typical use | Logging custom messages or debugging during automation | Automating responses to system events like syslog, interface events, or timers |
Use action 1.0 syslog msg [message] when you need to generate a custom syslog message from within an existing EEM applet, for logging or debugging purposes.
Use event manager applet when you need to create a new EEM applet that will automatically execute CLI commands or actions in response to a specific system event.
Platform Notes
In IOS-XE, the 'action syslog msg' command syntax is identical to classic IOS. However, IOS-XE uses a different underlying logging infrastructure, and the syslog message format may include additional fields like sequence numbers. The command is available in IOS-XE versions 16.x and later.
In NX-OS, the equivalent command is 'event manager applet' with 'action syslog' but the syntax differs slightly; for example, NX-OS uses 'action <tag> syslog <message>' without the 'msg' keyword. Additionally, NX-OS supports 'action <tag> syslog priority <level> <message>'. For ASA, EEM is not supported; instead, ASA uses 'event manager' but with limited actions, and syslog generation is done via 'logging' commands within the event manager.
In IOS-XR, EEM is not available; the equivalent is 'event manager' but with different syntax and capabilities. The command is present in IOS 12.x and later, but in 12.x, EEM applets were introduced in later versions (12.3(14)T and later). In 15.x and 16.x, the command is fully supported.
Always verify the exact syntax for your IOS version using '?' help. Note that the 'action syslog msg' command does not require any special license, but EEM itself may require a feature license in some IOS versions. For CCNA and CCNP studies, focus on IOS and IOS-XE as they are the most common platforms.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions