In which configuration mode is event syslog pattern [pattern] used?

The event syslog pattern [pattern] command is entered in Applet Config mode on Cisco IOS devices.

AutomationApplet Config

event syslog pattern [pattern]

Defines an Embedded Event Manager (EEM) applet trigger that watches for syslog messages matching a specified pattern, enabling automated responses to network events.

Definition: event syslog pattern [pattern] is a Cisco IOS applet config command. Defines an Embedded Event Manager (EEM) applet trigger that watches for syslog messages matching a specified pattern, enabling automated responses to network events.

Overview

The `event syslog pattern [pattern]` command is used within Cisco IOS Embedded Event Manager (EEM) applet configuration mode to define a trigger that watches for syslog messages matching a specified regular expression pattern. EEM is a powerful, on-box automation framework that allows network engineers to script responses to network events without external tools. This command is essential for proactive network management, enabling automated actions such as sending SNMP traps, executing CLI commands, or generating additional logs when specific syslog messages appear.

For example, you can automatically capture the output of `show interface` when a link-down syslog is generated, or send a custom email when a security-related syslog is seen. The pattern is a regular expression (IOS uses a subset of Perl-compatible regex), so you can match exact messages or use wildcards. The command is entered in applet configuration mode, which is reached via `event manager applet <name>`.

The syslog trigger is one of several event types supported by EEM, including timers, SNMP, counters, and CLI patterns. Compared to other event types, `event syslog pattern` is ideal for reacting to asynchronous events that generate syslog messages, such as interface flaps, routing protocol changes, or authentication failures. It fits into a broader troubleshooting workflow by allowing engineers to automate data collection at the moment of an event, reducing mean time to resolution (MTTR).

Important IOS behaviors: the syslog pattern is matched against the raw syslog message as it would appear in the log buffer; the applet runs with the privileges of the user who configured it (or the default privilege level 15 if no user context is specified); the applet configuration is stored in the running config and can be saved to startup config; multiple applets can be configured with different patterns; the pattern is case-sensitive by default; and the applet can be triggered multiple times, but rate-limiting can be applied using the `event syslog pattern` subcommands like `rate` or `maxrun`. The command does not impact normal router forwarding but consumes CPU when matching syslog messages, so patterns should be specific to avoid excessive triggering.

Syntax·Applet Config

event syslog pattern [pattern]

When to Use This Command

Automatically save the running configuration when a link goes down (interface down syslog).
Send an SNMP trap or email when a specific security event (e.g., failed login) is logged.
Execute a custom script or command when OSPF neighbor state changes are detected in syslog.
Trigger a backup of the startup configuration whenever a critical error message appears.

Parameters

Parameter	Syntax	Required	Description
pattern	regular expression string	Required	A regular expression that the syslog message must match to trigger the applet. The pattern is case-sensitive and supports basic regex metacharacters like . * + ? [ ] ( ) \|. Common mistakes: forgetting to escape special characters (e.g., use '\%' to match a literal percent sign), or making the pattern too broad, causing excessive triggers.

Command Examples

Trigger on interface down syslog

event syslog pattern "%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down"

This command sets the EEM applet to trigger when a syslog message matching the exact pattern for an interface going down is generated. The pattern includes the syslog ID and the interface details.

Trigger on failed login attempt

event syslog pattern "%SEC_LOGIN-4-LOGIN_FAILED: Login failed"

This pattern matches syslog messages indicating a failed login attempt. The EEM applet can then take actions like sending an alert or incrementing a counter.

Understanding the Output

The 'event syslog pattern' command itself does not produce output; it is a configuration command within an EEM applet. The output you see is when you verify the applet with 'show event manager policy registered' or 'show event manager applet'. In those outputs, look for the applet name and its trigger event.

The pattern is displayed under the trigger details. A correctly configured trigger will show the pattern string exactly as entered. If the pattern is too broad, it may trigger on unintended events; if too specific, it may miss events.

Ensure the pattern matches the exact syslog message format, including the syslog ID and any variables like interface names or IP addresses.

Configuration Scenarios

Automatically capture interface state on link down

A network engineer wants to automatically capture the output of 'show interface' and 'show logging' whenever an interface goes down, to aid in troubleshooting flapping links.

Topology

R1(Gi0/0)---192.168.1.0/30---(Gi0/0)R2

Steps

1.Step 1: Enter global configuration mode: R1# configure terminal
2.Step 2: Define an EEM applet named 'capture-linkdown': R1(config)# event manager applet capture-linkdown
3.Step 3: Set the trigger to match syslog messages containing 'UPDOWN' and 'line protocol' and 'changed state to down': R1(config-applet)# event syslog pattern ".*UPDOWN.*line protocol.*changed state to down.*"
4.Step 4: Define an action to write the output of 'show interface' to a file: R1(config-applet)# action 1.0 cli command "show interface | append flash:linkdown-log.txt"
5.Step 5: Define an action to append the current logging buffer: R1(config-applet)# action 2.0 cli command "show logging | append flash:linkdown-log.txt"
6.Step 6: Exit applet configuration: R1(config-applet)# end
7.Step 7: Save configuration: R1# write memory

Configuration

!
event manager applet capture-linkdown
 event syslog pattern ".*UPDOWN.*line protocol.*changed state to down.*"
 action 1.0 cli command "show interface | append flash:linkdown-log.txt"
 action 2.0 cli command "show logging | append flash:linkdown-log.txt"
end

Verify: Simulate a link down by shutting an interface, then check the file: R1# more flash:linkdown-log.txt. Expected output includes the interface status and recent logs.

Watch out: The pattern must match the exact syslog format. For example, the syslog message 'LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down' contains 'UPDOWN' but also 'LINK-3-UPDOWN'. The pattern above uses '.*UPDOWN.*' to match. Also, ensure the file system is writable (flash:).

Send SNMP trap when OSPF neighbor goes down

An engineer wants to be notified via SNMP when an OSPF neighbor adjacency is lost, to quickly respond to routing issues.

Topology

R1(Lo0)---OSPF Area 0---R2(Lo0)

Steps

1.Step 1: Enter global configuration mode: R1# configure terminal
2.Step 2: Define an EEM applet named 'ospf-neighbor-down': R1(config)# event manager applet ospf-neighbor-down
3.Step 3: Set the trigger to match syslog messages indicating OSPF neighbor down: R1(config-applet)# event syslog pattern ".*OSPF-5-ADJCHG.*NBR_DOWN.*"
4.Step 4: Define an action to send an SNMP trap: R1(config-applet)# action 1.0 snmp-trap strdata "OSPF neighbor down"
5.Step 5: Optionally, log the event: R1(config-applet)# action 2.0 syslog msg "EEM: OSPF neighbor down detected"
6.Step 6: Exit and save: R1(config-applet)# end; R1# write memory

Configuration

!
event manager applet ospf-neighbor-down
 event syslog pattern ".*OSPF-5-ADJCHG.*NBR_DOWN.*"
 action 1.0 snmp-trap strdata "OSPF neighbor down"
 action 2.0 syslog msg "EEM: OSPF neighbor down detected"
end

Verify: Simulate an OSPF neighbor down by shutting the interface or changing OSPF config. Check if SNMP trap is sent (use SNMP trap receiver). Also check syslog for the custom message.

Watch out: The SNMP trap action requires SNMP to be configured on the router (snmp-server community, etc.). Also, the pattern must match the exact OSPF syslog message format, which includes the process ID and neighbor details. Use '.*' to be flexible.

Troubleshooting with This Command

When using `event syslog pattern` for troubleshooting, the key is to ensure the pattern correctly matches the intended syslog messages. A common issue is that the applet does not trigger as expected. First, verify that the applet is configured and enabled: `show event manager applet [name]` displays the applet's status, event type, and pattern.

Check if the pattern is too restrictive or too broad. For example, if you want to match 'LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down', a pattern like 'UPDOWN' will match, but '.*UPDOWN.*' is safer. Use `show logging` to see the exact syslog message format on your IOS version, as it may vary.

If the applet is not firing, check if syslog logging is enabled globally (`logging on`) and that the syslog messages are being generated. You can also use `debug event manager action cli` to see the actions being executed. Another diagnostic step is to manually trigger a matching syslog message (e.g., by shutting an interface) and then check `show event manager history events` to see if the event was recorded.

If the event is recorded but actions fail, check the action syntax. For CLI actions, ensure the commands are valid and the user has sufficient privileges. For file writes, verify the file system is writable and has space.

Also, note that EEM applets run with default privilege level 15 unless specified with `event manager applet [name] authorization bypass`. If the applet uses `action cli`, the commands run with the privilege of the user who configured the applet (or level 15 if no user context). Common symptoms: applet not triggering – check pattern and syslog generation; actions not executing – check privilege and syntax; applet triggering too often – use `rate` subcommand to limit.

Correlate with `show event manager policy` and `show event manager event-types` to understand the event system. For complex patterns, test with `event manager debug` or use a simple pattern like '.*' to verify the applet framework works, then refine.

CCNA Exam Tips

CCNA exam tip 1: Remember that the pattern is case-sensitive and must match the exact syslog message format, including the percent sign and syslog ID.

CCNA exam tip 2: You can use regular expressions in the pattern for more flexible matching, but be careful with special characters.

CCNA exam tip 3: The 'event syslog pattern' command is configured inside an EEM applet, not globally. The applet must also have 'action' commands to define what happens when the trigger fires.

CCNA exam tip 4: Common exam scenario: Configure an EEM applet that sends a syslog message when a specific event occurs, using 'action syslog msg'.

Common Mistakes

Mistake 1: Forgetting to include the syslog ID (e.g., %LINEPROTO-5-UPDOWN) in the pattern, causing the trigger to never match.

Mistake 2: Using a pattern that is too generic (e.g., just 'down') which triggers on many unrelated events.

Mistake 3: Not escaping special regex characters like parentheses or periods, leading to pattern matching failures.

event syslog pattern [pattern] vs action 1.0 cli command [cmd]

Both commands are used within Embedded Event Manager (EEM) applet configuration, which often leads to confusion because they serve different roles: one defines a trigger condition and the other defines a response action. They are typically used together in the same applet.

Aspect	event syslog pattern [pattern]	action 1.0 cli command [cmd]
Role in EEM	Defines a trigger (event) that activates the applet when a syslog message matches the pattern.	Defines an action that executes a CLI command when the applet triggers.
Configuration mode	Used within 'event manager applet' configuration mode (applet config).	Used within the same applet configuration mode, as an action step.
Persistence	Persists in running config and startup config if saved; part of the applet definition.	Persists similarly as part of the applet action list.
Precedence / Ordering	Must be defined before actions; it determines when the applet runs.	Defined after the event; multiple actions can be ordered by step numbers (e.g., 1.0, 2.0).
Typical use case	Monitoring for a specific syslog event (e.g., 'interface down') to automate a response.	Executing a command (e.g., 'shutdown') to react to the detected event.

Use event syslog pattern [pattern] when you need to detect a specific syslog message to trigger an automated response or troubleshooting action.

Use action 1.0 cli command [cmd] when you need to execute a CLI command as part of the automated response triggered by an EEM event.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the `event syslog pattern` command syntax is identical to classic IOS. However, IOS-XE uses a different EEM engine (Tcl-based) that supports additional actions and variables. The output of `show event manager applet` may show slightly different fields.

In NX-OS (Cisco Nexus switches), the equivalent command is `event manager applet <name>` with `event syslog pattern <pattern>` but the configuration mode is slightly different: you enter `configure terminal`, then `event manager applet <name>`, then `event syslog pattern <pattern>`. NX-OS also supports `event syslog pattern` but the regex engine is more limited (no lookahead). For ASA (Adaptive Security Appliance), EEM is not supported; instead, use the `event manager` feature in ASA 9.x with `event syslog pattern` but the syntax is `event manager applet <name> event syslog pattern <pattern>`.

In IOS-XR (e.g., ASR 9000, NCS 5500), EEM is available but the command is `event manager applet <name>` and `event syslog pattern <pattern>` works similarly, but the configuration is done in XR config mode. Note that IOS-XR uses a different regex engine (PCRE). Also, in older IOS 12.x, the `event syslog pattern` command may not support all regex metacharacters; upgrade to 15.x or later for full support.

Always check the specific platform documentation for exact syntax and limitations.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions