Configure an Event Policy to Execute Operational Mode Commands

Overview of the execute-commands Event Policy Action

Operational mode commands perform an operation or provide diagnostic output on a device running Junos OS or device running Junos OS Evolved. They enable you to view statistics and information about a device’s current operating status. They also enable you to take corrective actions, such as restarting software processes, taking a PIC offline and back online, switching to redundant interfaces, or adjusting LSP bandwidth.

You can configure an event policy that executes operational mode commands, saves the command output to a file, and archives the file to a specified location. To execute commands and archive the output file, include the following statements at the [edit event-options] hierarchy level:

In the events statement, you can list multiple events. If one or more of the listed events occur, the eventd process executes the operational mode commands configured in the commands statement. Enclose each command in quotation marks (" "). The eventd process issues the commands in the order in which you configure them. For example, in the following configuration, policy1 executes the show interfaces command first, followed by the show chassis alarms command:

The destination statement specifies the archive site where the system uploads the file. You must reference a destination name that is configured at the [edit event-options destinations] hierarchy level. The output-filename statement defines a descriptive string that the system includes in the output filename. The previous policy might configure output-filename as interfaces-and-alarms to indicate the type of command output in the file.

By default, the command output format is Junos Extensible Markup Language (XML). Configure the output-format text statement to generate command output in ASCII text format.

Reference Event Attributes in Commands

You can include variables in the configured commands to automatically include data from the trigger event or a received event in the command syntax. The eventd process replaces each variable with the appropriate values. You can use command variables of the following forms:

• {$$.attribute-name}—The double dollar sign ($$) notation represents the event that triggers the policy. When combined with an attribute name, the variable resolves to the value of the attribute associated with the triggering event. For example, {$$.interface-name} resolves to the interface name associated with the triggering event.

• {$event.attribute-name}—The single dollar sign with the event name ($event) notation represents the most recent event that matches event. When combined with an attribute name, the variable resolves to the value of the attribute associated with that event. For example, when a policy issues the show interfaces {$COSD_CHAS_SCHED_MAP_INVALID.interface-name} command, the {$COSD_CHAS_SCHED_MAP_INVALID.interface-name} variable resolves to the interface name associated with the most recent COSD_CHAS_SCHED_MAP_INVALID event cached by the event process.

• {$*.attribute-name}—The dollar sign with the asterisk ($*) notation represents the most recent event that matches any of the correlating events. The variable resolves to the value of the attribute associated with most recent event that matches any of the correlated events specified in the policy configuration.

You can determine an event's attributes in a number of ways, for example:

• Use System Log Explorer.

• Use the help syslog event operational mode command in the CLI.

• Use context-sensitive help in configuration mode when you configure the attribute.

The System Log Explorer application enables you to search the standard system log messages for a given operating system and release. The message details include the attributes that you can reference for that event.

Alternatively, in the CLI, the help syslog event operational mode command also displays a list of the attributes that you can reference for a given event. The command output shows the event attributes in angle brackets (<>). The following output shows that the ACCT_ACCOUNTING_SMALL_FILE_SIZE event has three attributes that you can reference: filename, file-size, and record-size.

You also view event attributes by issuing the set attributes-match event? configuration mode command. Issue the command at the [edit event-options policy policy-name] hierarchy level, as shown in the following example:

Note:

This set command does not include a space between the event name and the question mark (?).

To view a list of all event attributes that you can reference, issue the set attributes-match ? configuration mode command at the [edit event-options policy policy-name] hierarchy level.

Archive the Command Output File

When the event policy executes the commands it saves the command output to a file. The system uploads the file to the location specified in the destination statement. You must reference a destination name that is configured at the [edit event-options destinations] hierarchy level. For more information, see Event Policy File Archiving.

The output file has the following naming convention.

The filename includes the hostname and timestamp to ensure that the each filename is unique. The output-filename statement defines a descriptive string that the system includes in the filename. In addition, if a policy triggers multiple times in a 1-second period, the system appends an index number to the filename. The index number range is 001 through 999.

For example, suppose you configure the output-filename statement as ifl-events for an event policy on device r1. If the event policy triggers three times in one second, the device generates the following files:

• r1_20060623_132333_ifl-events

• r1_20060623_132333_ifl-events_001

• r1_20060623_132333_ifl-events_002