Contents

EAA commands· 1

action cli 1

action email 2

action reboot 2

action switchover 3

action syslog· 4

commit 5

display rtm environment 6

display rtm policy· 6

event cli 8

event hotplug· 10

event interface· 11

event period· 13

event process· 13

event snmp oid· 15

event snmp-notification· 16

event syslog· 17

event track· 20

rtm cli-policy· 21

rtm email domain· 22

rtm email max-size· 23

rtm email username password· 23

rtm environment 24

rtm event syslog buffer-size· 25

rtm scheduler suspend· 26

rtm tcl-policy· 27

running-time· 27

user-role· 28

 

EAA commands

action cli

Use action cli to add a CLI action to a monitor policy.

Use undo action to remove an action.

Syntax

action number cli command-line

undo action number

Default

A monitor policy does not contain any actions.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

number: Specifies an action ID in the range of 0 to 231.

cli command-line: Specifies the command line to be executed when the event occurs. You can enter abbreviated forms of command keywords, but you must make sure the forms can uniquely identify the command keywords. For example, you can enter int loop 1 for the interface loopback 1 command.

Usage guidelines

You can configure a series of actions to be executed in response to the event specified in a monitor policy. EAA executes the actions in ascending order of action IDs. When you add actions to a policy, you must make sure the execution order is correct. If two actions have the same ID, the most recent one takes effect.

To execute a command in a view other than user view, you must define actions required for accessing the target view before defining the command execution action. In addition, you must number the actions in the order they should be executed, starting with entering system view.

For example, to shut down an interface, you must create the following actions in order:

1.     Action to enter system view.

2.     Action to enter interface view.

3.     Action to shut down the interface.

When you define an action, you can specify a value or specify a variable name for an argument. For more information about using EAA environment variables, see "rtm environment."

Examples

# Configure a CLI action for the CLI-defined policy test to shut down Ten-GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] action 1 cli system-view

[Sysname-rtm-test] action 2 cli interface ten-gigabitethernet 1/0/1

[Sysname-rtm-test] action 3 cli shutdown

action email

Use action email to add an email sending action to a monitor policy.

Use undo action to remove an action.

Syntax

action number email receiver rx-list subject subject [ content content ]

undo action number

Default

A monitor policy does not contain any actions.

Views

CLI-defined policy view

Predefined use roles

network-admin

mdc-admin

Parameters

number: Specifies an action ID in the range of 0 to 231.

receiver rx-list: Specifies a space-separated list of email receivers.

subject subject: Specifies an email subject, a case-sensitive string of 1 to 255 characters that can contain environment variables.

content content: Specifies the email content, a case-sensitive string of 1 to 255 characters that can contain environment variables. If you do not specify this option, the email body is empty.

Usage guidelines

After you add this action to an EAA monitor policy, EAA generates and sends an email with the specified content to the designated receivers when the policy event occurs. You can use this feature to collect and send device O & M information to the administrators periodically.

Examples

# Add an email sending action to CLI-defined policy test, specifying test1@163.com and test2@qq.com as the email receivers, [ALARM][SAMPLE] as the email subject, and test-msg as the email body.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rmt-test] action 4 email receiver test1@163.com,test2@qq.com subject [ALARM][SAMPLE] content test-msg

Related commands

rtm email domain

rtm email max-size

rtm email username password

action reboot

Use action reboot to add a reboot action to a monitor policy.

Use undo action to remove an action.

Syntax

In standalone mode:

action number reboot [ slot slot-number ]

undo action number

In IRF mode:

action number reboot [ chassis chassis-number [ slot slot-number ] ]

undo action number

Default

A monitor policy does not contain any actions.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

number: Specifies an action ID in the range of 0 to 231.

chassis chassis-number: Specifies an IRF member device by its member ID. If you do not specify a member device, the command reboots the IRF fabric. (In IRF mode.)

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command reboots the device.

Usage guidelines

The reboot action configured with this command reboots devices or cards without saving the running configuration. If you want to save the running configuration, use the action cli command to configure reboot actions.

You can configure a series of actions to be executed in response to the event specified in a monitor policy. EAA executes the actions in ascending order of action IDs. When you add actions to a policy, you must make sure the execution order is correct. If two actions have the same ID, the most recent one takes effect.

When you define an action, you can specify a value or specify a variable name for an argument. For more information about using EAA environment variables, see "rtm environment."

Examples

# (In standalone mode.) Configure an action for CLI-defined policy test to reboot the specified slot.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] action 3 reboot slot 1

action switchover

Use action switchover to add an active/standby switchover action to a monitor policy.

Use undo action to remove an action.

Syntax

action number switchover

undo action number

Default

A monitor policy does not contain any actions.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

number: Specifies an action ID in the range of 0 to 231.

Usage guidelines

You can configure a series of actions to be executed in response to the event specified in a monitor policy. EAA executes the actions in ascending order of action IDs. When you add actions to a policy, you must make sure the execution order is correct. If two actions have the same ID, the most recent one takes effect.

(In standalone mode.) This command does not trigger an active/standby MPU switchover in either of the following situations:

·     The device has only one MPU.

·     The standby MPU is not in up state.

(In IRF mode.) This command does not trigger an active/standby global MPU switchover in either of the following situations:

·     No global standby MPU is configured.

·     The global standby MPU is not in up state.

Examples

# Configure an action for the CLI-defined policy test to perform an active/standby switchover.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] action 3 switchover

action syslog

Use action syslog to add a Syslog action to a monitor policy.

Use undo action to remove an action.

Syntax

action number syslog priority priority facility local-number msg msg-body

undo action number

Default

A monitor policy does not contain any actions.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

number: Specifies an action ID in the range of 0 to 231.

priority priority: Specifies the log severity level in the range of 0 to 7. A lower value represents a higher severity level.

facility local-number: Specifies a logging facility by its facility number in the range of local0 to local7. Facility numbers are used by a log host to identify log creation facilities for filtering log messages.

msg msg-body: Configures the log message body.

Usage guidelines

EAA sends log messages to the information center. You can configure the information center to output these messages to certain destinations. For more information about the information center, see "Configuring the information center."

You can configure a series of actions to be executed in response to the event specified in a monitor policy. EAA executes the actions in ascending order of action IDs. When you add actions to a policy, you must make sure the execution order is correct. If two actions have the same ID, the most recent one takes effect.

When you define an action, you can specify a value or specify a variable name for an argument. For more information about using EAA environment variables, see "rtm environment."

Examples

# Configure an action for the CLI-defined policy test to send a log message "hello" with a severity of 7 from the facility device local3.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] action 3 syslog priority 7 facility local3 msg hello

commit

Use commit to enable a CLI-defined monitor policy.

Syntax

commit

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

You must execute this command for a CLI-defined monitor policy to take effect.

After changing the settings in a policy that has been enabled, you must re-execute this command for the changes to take effect.

Examples

# Enable CLI-defined monitor policy test.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] commit

display rtm environment

Use display rtm environment to display user-defined EAA environment variables and their values.

Syntax

display rtm environment [ var-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

var-name: Specifies a user-defined EAA environment variable by its name, a case-sensitive string of 1 to 63 characters. The name can contain digits, letters, and the underscore sign (_), but its leading character cannot be the underscore sign. If you do not specify a variable, this command displays all user-defined EAA environment variables.

Examples

# Display all user-defined EAA environment variables.

<Sysname> display rtm environment

Name             Value

save_cmd         save main force

show_run_cmd     display current-configuration

Table 1 Command output

Field	Description
Name	Name of a user-defined EAA environment variable. This field displays a maximum of 30 characters. To display a user-defined EAA environment variable name of more than 30 characters, use the display current-configuration command.
Value	Value of the user-defined EAA environment variable. This field displays a maximum of 30 characters. To display a user-defined EAA environment variable value of more than 30 characters, use the display current-configuration command.

‌

display rtm policy

Use display rtm policy to display information about EAA monitor policies.

Syntax

display rtm policy { active | registered [ verbose ] } [ policy-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

active: Specifies policies that are executing the actions.

registered: Specifies policies that have been created.

verbose: Displays detailed information about monitor policies.

policy-name: Specifies a policy by its name, a case-sensitive string of 1 to 63 characters. If you do not specify a policy, the command displays information about all monitor policies.

Usage guidelines

To display the running configuration of CLI-defined monitor policies, execute the display current-configuration command in any view or execute the display this command in CLI-defined monitor policy view.

Examples

# Display monitor policies that are executing the actions.

<Sysname> display rtm policy active

JID   Type  Event      TimeActive           PolicyName

507   CLI   INTERFACE  Aug 29 14:55:55 2019 test

Table 2 Command output

Field	Description
JID	Job ID, displayed only when you specify the active keyword.
Type	Policy creation method: ·     TCL—The policy was configured by using Tcl. ·     CLI—The policy was configured from the CLI.
Event	Event type, including CLI, hotplug, interface, period, process, SNMP, SNMP-Notification, Syslog, and track.
TimeActive	Time when the monitor policy was triggered.
PolicyName	Name of the monitor policy.

‌

# Display brief information about all created monitor policies.

<Sysname> display rtm policy registered

Total number: 1

Type  Event      TimeRegistered       PolicyName

CLI   INTERFACE  Aug 29 14:54:50 2019 test

Table 3 Command output

Field	Description
Total number	Total number of the monitor policies.
Type	Policy creation method: ·     TCL—The policy was configured by using Tcl. ·     CLI—The policy was configured from the CLI.
Event	Event type, including CLI, hotplug, interface, period, process, SNMP, SNMP-Notification, Syslog, and track.
TimeRegistered	Time when the monitor policy was created.
PolicyName	Name of the monitor policy.

‌

# Display detailed information about all monitor policies.

<Sysname> display rtm policy registered verbose

  Total number: 1

 

   Policy Name: test

   Policy Type: CLI

    Event Type: INTERFACE

TimeRegistered: Aug 29 14:54:50 2019

     User-role: network-operator

                network-admin

Table 4 Command output

Field	Description
Total number	Total number of the monitor polices.
PolicyName	Name of the monitor policy.
Policy Type	Policy creation method: ·     TCL—The policy was configured by using Tcl. ·     CLI—The policy was configured from the CLI.
Event Type	Event type, including CLI, hotplug, interface, period, process, SNMP, SNMP-Notification, Syslog, and track.
TimeRegistered	Time when the policy was created.
User-role	User roles for executing the monitor policy. To execute the monitor policy, an administrator must have a minimum of one of the displayed user roles.

‌

event cli

Use event cli to configure a CLI event for a CLI-defined monitor policy.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

event cli { async [ skip ] | sync } mode { execute | help | tab } pattern regular-exp

undo event

Default

No CLI event is configured.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

async [ skip ]: Enables or disables the system to execute the command that triggers the policy. If you specify the skip keyword, the system executes the actions in the policy without executing the command that triggers the policy. If you do not specify the skip keyword, the system executes both the actions in the policy and the command entered at the CLI.

sync: Enables the system to execute the command that triggers the event only if the policy has been executed successfully.

mode { execute | help | tab }: Specifies the CLI operation to monitor:

·     execute: Triggers the policy when a matching command is entered.

·     help: Triggers the policy when a question mark (?) is entered at a matching command line.

·     tab: Triggers the policy when the Tab key is pressed to complete a parameter in a matching command line.

pattern regular-exp: Specifies a regular expression for matching commands that trigger the policy. For more information about using regular expressions, see CLI in Fundamentals Configuration Guide.

Usage guidelines

Use CLI event monitor policies to monitor operations performed at the CLI.

You can configure only one event for a monitor policy. If the monitor policy already contains an event, the new event replaces the old event.

Examples

# Configure a CLI-defined policy to monitor execution of commands that contain the display interface brief string. Enable the system to execute the actions in the policy without executing the command that triggers the policy.

<Sysname>system-view

[Sysname] rtm cli-policy test

[Sysname-rmt-test] event cli async skip mode execute pattern display interface brief

# Configure a CLI-defined policy to monitor the use of the Tab key at command lines that contain the display interface brief string. Enable the system to execute the actions in the policy and display the complete parameter when Tab is pressed at a policy-matching command line.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rmt-test] event cli async mode tab pattern display interface brief

# Configure a CLI-defined policy to monitor the use of the question mark (?) at command lines that contain the display interface brief string. Enable the system to execute a policy-matching command line only if the actions in the policy are executed successfully when a question mark is entered at the command line.

<Sysname>system-view

[Sysname] rtm cli-policy test

[Sysname-rmt-test] event cli sync mode help pattern display interface brief

event hotplug

Use event hotplug to configure a hot-swapping event.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

In standalone mode:

event hotplug [ insert | remove ] slot slot-number

undo event

In IRF mode:

event hotplug [ insert | remove ] chassis chassis-number slot slot-number

undo event

Default

No hotplug event is configured.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

insert: Specifies the card insert event.

remove: Specifies the card remove event.

slot slot-number: Specifies a card by its slot number. (In standalone mode.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. (In IRF mode.)

Usage guidelines

After you configure the event, the monitor policy is triggered when a card is inserted in or removed from the specified slot. If you do not specify the insert or remove keyword, EAA monitors the card slot for both removal and insert actions.

You can configure only one event entry for a monitor policy. If the monitor policy already contains an event entry, the new event entry replaces the old event entry.

Examples

# (In standalone mode.) Configure a CLI-defined policy to monitor the specified slot for card swapping.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event hotplug slot 1

event interface

Use event interface to configure an interface event for a CLI-defined monitor policy.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

event interface interface-list monitor-obj monitor-obj start-op start-op start-val start-val restart-op restart-op restart-val restart-val [ interval interval ]

undo event

Default

No interface event is configured.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

interface-list: Specifies a space-separated list of up to eight interface items. An item specifies an interface or specifies a range of interfaces in the form of interface-type interface-number to interface-type interface-number. The interfaces in an interface range must be same type. The start interface number must be smaller than the end interface number.

monitor-obj monitor-obj: Specifies the traffic statistic to be monitored on the interface. For keywords available for the monitor-obj argument, see Table 5.

start-op start-op: Specifies the operator for comparing the monitored traffic statistic with the start threshold. The start threshold is crossed if the comparison result meets the condition. For keywords available for the start-op argument, see Table 6.

start-val start-val: Specifies the start threshold to be compared with the monitored traffic statistic. The value range is 0 to 4294967295.

restart-op restart-op: Specifies the operator for comparing the monitored traffic statistic with the restart threshold. The restart threshold is crossed if the comparison result meets the condition. For keywords available for the restart-op argument, see Table 6.

restart-val restart-val: Specifies the restart threshold to be compared with the monitored traffic statistic. The value range is 0 to 4294967295.

interval interval: Specifies the interval to sample the monitored traffic statistic for a comparison. The value range is 1 to 4294967295, in seconds. The default value is 300.

Table 5 Monitored objects

Monitored traffic statistic	Description
input-drops	Number of discarded incoming packets during the sampling interval
input-errors	Number of incoming error packets during the sampling interval
output-drops	Number of discarded outgoing packets during the sampling interval
output-errors	Number of outgoing error packets during the sampling interval
rcv-bps	Receive rate, in bits per second
rcv-broadcasts	Number of incoming broadcasts during the sampling interval
rcv-kbps	Receive rate, in kilobits per second
rcv-kpps	Receive rate, in kilo packets per second
rcv-pps	Receive rate, in packets per second
tx-bps	Transmit rate, in bps
tx-kbps	Transmit rate, in kilobits per second
tx-kpps	Transmit rate, in kilo packets per second
tx-pps	Transmit rate, in packets per second

‌

Table 6 Comparison operators

Comparison operator	Description
eq	Equal to
ge	Greater than or equal to
gt	Greater than
le	Less than or equal to
lt	Less than
ne	Not equal to

‌

Usage guidelines

Use interface event monitor policies to monitor traffic statistics on an interface.

You can configure only one event for a monitor policy. If the monitor policy already contains an event, the new event replaces the old event.

EAA executes an interface event policy when the monitored interface traffic statistic crosses the start threshold in the following situations:

·     The statistic crosses the start threshold for the first time.

·     The statistic crosses the start threshold each time after it crosses the restart threshold.

The following is the interface event monitor process of EAA:

1.     Compares the traffic statistic sample with the start threshold at sampling intervals until the start threshold is crossed.

2.     Executes the policy.

3.     Compares the traffic statistic sample with the restart threshold at sampling intervals until the restart threshold is crossed.

4.     Compares the traffic statistic sample with the start threshold at sampling intervals until the start threshold is crossed.

5.     Executes the policy again.

This process cycles for the monitor policy to be executed and re-executed.

Examples

# Configure a CLI-defined policy to monitor the incoming error packet statistic on Ten-GigabitEthernet 1/0/1 every 60 seconds. Set the start threshold to 1000 and the restart threshold to 50. Enable EAA to execute the policy when the statistic exceeds 1000 for the first time. Enable EAA to re-execute the policy if the statistic exceeds 1000 each time after the statistic has dropped below 50.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event interface ten-gigabitethernet 1/0/1 monitor-obj input-errors start-op gt start-val 1000 restart-op lt restart-val 50 interval 60

event period

Use event period to configure a periodic event for a CLI-defined monitor policy.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

event period interval

undo event

Default

No periodic event is configured for a monitor policy.

Views

CLI-defined policy view

Predefined use roles

network-admin

mdc-admin

Parameters

interval: Specifies the periodic event interval in the range of 1 to 43200, in minutes.

Usage guidelines

After you configure this event for an EAA monitory policy, EAA executes the policy when the interval expires and then starts the timer for the next interval.

You can configure only one event entry for a monitor policy. If you configure multiple event entries for a monitor policy, the most recent configuration takes effect.

For the actions of a periodic event monitor policy to be executed completely, the interval configured for the periodic event must be equal to or larger than the action running time.

Examples

# Set the periodic event interval to 60 minutes.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event period 60

Related commands

running-time

event process

Use event process to configure a process event for a CLI-defined monitor policy.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

In standalone mode:

event process { exception | restart | shutdown | start } [ name process-name [ instance instance-id ] ] [ slot slot-number ]

undo event

In IRF mode:

event process { exception | restart | shutdown | start } [ name process-name [ instance instance-id ] ] [ chassis chassis-number [ slot slot-number ] ]

undo event

Default

No process event is configured.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

exception: Monitors the specified process for exceptional events. EAA executes the policy when an exception occurs to the monitored process.

restart: Monitors the specified process for restart events. EAA executes the policy when the monitored process restarts.

shutdown: Monitors the specified process for shutdown events. EAA executes the policy when the monitored process is shut down.

start: Monitors the specified process for start events. EAA executes the policy when the monitored process starts.

name process-name: Specifies a user-mode process by its name. The process can be one that is running or not running. If you do not specify a name, this command monitors all use-mode processes.

instance instance-id: Specifies a process instance ID in the range of 0 to 4294967295. The instance ID can be one that has not been created yet. If you do not specify an instance, EAA monitors all instances of the process.

chassis chassis-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command applies to the IRF fabric. (In IRF mode.)

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command applies to the device.

Usage guidelines

Use process event monitor policies to monitor process state changes. These changes can result from manual operations or automatic system operations.

You can configure only one event for a monitor policy. If the monitor policy already contains an event, the new event replaces the old event.

Examples

# Configure a CLI-defined policy to monitor all instances of the process snmpd for restart events.

<Sysname>system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event process restart name snmpd

event snmp oid

Use event snmp oid to configure an SNMP event for a CLI-defined monitor policy.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

event snmp oid oid monitor-obj { get | next } start-op start-op start-val start-val restart-op restart-op restart-val restart-val [ interval interval ]

undo event

Default

No SNMP event is configured.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

oid oid: Specifies the OID of the monitored MIB variable, a string of 1 to 256 characters.

monitor-obj { get | next }: Specifies the SNMP operation used for sampling variable values. The get keyword represents the SNMP get operation, and the next keyword represents the SNMP getNext operation.

start-op start-op: Specifies the operator for comparing the sampled value with the start threshold. The start threshold is crossed if the comparison result meets the condition. For keywords available for the start-op argument, see Table 6.

start-val start-val: Specifies the start threshold to be compared with the sampled value. The start-val argument can be any data type supported by SNMP, including numerals and character strings. The  value range for the start-val argument is a string of 1 to 512 characters. If the threshold value contains spaces, you must enclose the value in quotation marks (" ").

restart-op op: Specifies the operator for comparing the sampled value with the restart threshold. The restart threshold is crossed if the comparison result meets the condition. For keywords available for the start-op argument, see Table 6.

restart-op restart-val: Specifies the restart threshold to be compared with the sampled value. The restart-val argument can be any data type supported by SNMP, including numerals and character strings. The value range for the restart-val argument is a string of 1 to 512 characters. If the threshold value contains spaces, you must enclose the value in quotation marks (" ").

interval interval: Specifies the sampling interval in the range of 1 to 4294967295, in seconds. The default value is 300.

Usage guidelines

Use SNMP event monitor policy to monitor value changes of MIB variables.

You can configure only one event for a monitor policy. If the monitor policy already contains an event, the new event replaces the old event.

EAA executes an SNMP event policy when the monitored MIB variable's value crosses the start threshold in the following situations:

·     The monitored variable's value crosses the start threshold for the first time.

·     The monitored variable's value crosses the start threshold each time after it crosses the restart threshold.

The following is the SNMP event monitor process of EAA:

1.     Compares the variable sample with the start threshold at sampling intervals until the start threshold is crossed.

2.     Executes the policy.

3.     Compares the variable sample with the restart threshold at sampling intervals until the restart threshold is crossed.

4.     Compares the variable sample with the start threshold at sampling intervals until the start threshold is crossed.

5.     Executes the policy again.

This process cycles for the monitor policy to be executed and re-executed.

For the command to take effect, enable SNMP before you execute this command.

Examples

# Configure a CLI-defined policy to get the value of the MIB variable 1.3.6.4.9.9.42.1.2.1.6.4 every five seconds. Set the start threshold to 1 and the restart threshold to 2. Enable EAA to execute the policy when the value changes to 1 for the first time. Enable EAA to re-execute the policy if the value changes to 1 each time after the value has changed to 2.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event snmp oid 1.3.6.4.9.9.42.1.2.1.6.4 monitor-obj get start-op eq start-val 1 restart-op eq restart-val 2 interval 5

event snmp-notification

Use event snmp-notification to configure an SNMP-Notification event for a CLI-defined policy.

Use undo event to remove the event in a CLI-defined policy.

Syntax

event snmp-notification oid oid oid-val oid-val op op [ drop ]

undo event

Default

No SNMP-Notification event is configured.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

oid oid: Specifies the OID of the monitored MIB variable, a string of 1 to 256 characters.

oid-val oid-val: Specifies the threshold to be compared with the sampled value. The oid-val argument can be any data type supported by SNMP, including numerals and character strings. The value range for the oid-val argument is a string of 1 to 512 characters. If the threshold value contains spaces, you must enclose the value in quotation marks (" ").

op op: Specifies the operator for comparing the sampled value with the threshold. The policy is executed if the comparison result meets the condition. For keywords available for the start-op argument, see Table 6.

drop: Drops the notification if the comparison result meets the condition. If you do not specify this keyword, the system sends the notification.

Usage guidelines

Use SNMP-Notification event monitor policies to monitor variables in SNMP notifications.

EAA executes an SNMP-Notification event monitor policy when the value of the monitored variable in an SNMP notification meets the specified condition.

You can configure only one event for a monitor policy. If the monitor policy already contains an event, the new event replaces the old event.

For the command to take effect, enable SNMP before you execute this command.

Examples

# Configure a CLI-defined policy to monitor SNMP notifications that contain the use name variable 1.3.6.1.4.1.25506.2.2.1.1.2.1.0. Enable the system to execute the policy and drop the SNMP notification if the use name variable value is admin.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event snmp-notification oid 1.3.6.1.4.1.25506.2.2.1.1.2.1.0 oid-val admin op eq drop

event syslog

Use event syslog to configure a Syslog event for a CLI-defined monitor policy.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

event syslog priority { priority | all } msg msg occurs times period period

undo event

Default

No Syslog event is configured.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

priority { priority | all }: Specifies the severity level for matching log messages.

·     priority: Specifies the lowest severity level for matching log messages. It is an integer in the range of 0 to 7. A lower number represents higher severity level. For example, specify a severity level of 3 to match log messages from level 3 to level 0.

·     all: Represents any severity level from 0 to 7.

msg msg: Specifies a regular expression to match the logs. The msg argument represents a regular expression, a string of 1 to 255 characters.

occurs times period period: Executes the policy if the number of log matches over an interval exceeds the limit. The times argument specifies the maximum number of log matches in the range of 1 to 32. The period argument specifies an interval in the range of 1 to 4294967295 seconds.

Usage guidelines

Use Syslog event monitor policies to monitor log messages.

EAA executes a Syslog event monitor policy when the number of matching logs over an interval reaches the limit.

 

NOTE: EAA does not count log messages generated by the RTM module when it counts log matches.

‌

You can configure only one event for a monitor policy. If the monitor policy already contains an event, the new event replaces the old event.

A regular expression can contain the special characters described in Table 7.

Table 7 Special characters supported in a regular expression

Characters	Meaning	Examples
^	Matches the beginning of a line.	"^u" matches all lines beginning with "u". A line beginning with "Au" is not matched.
$	Matches the end of a line.	"u$" matches all lines ending with "u". A line ending with "uA" is not matched.
. (period)	Matches any single character.	".s" matches "as" and "bs".
*	Matches the preceding character or string zero, one, or multiple times.	"zo*" matches "z" and "zoo", and "(zo)*" matches "zo" and "zozo".
+	Matches the preceding character or string one or multiple times.	"zo+" matches "zo" and "zoo", but not "z".
|	Matches the preceding or succeeding string.	"def|int" matches a line containing "def" or "int".
( )	Matches the string in the parentheses, usually used together with the plus sign (+) or asterisk sign (*).	"(123A)" matches "123A". "408(12)+" matches "40812" and "408121212", but not "408".
\N	Matches the preceding strings in parentheses, with the Nth string repeated once.	"(string)\1" matches a string containing "stringstring". "(string1)(string2)\2" matches a string containing "string1string2string2". "(string1)(string2)\1\2" matches a string containing " string1string2string1string2".
[ ]	Matches a single character in the brackets.	"[16A]" matches a string containing 1, 6, or A; "[1-36A]" matches a string containing 1, 2, 3, 6, or A (- is a hyphen). To match the character "]", put it immediately after "[", for example, []abc]. There is no such limit on "[".
[^]	Matches a single character that is not in the brackets.	"[^16A]" matches a string that contains one or more characters except for 1, 6, or A, such as "abc". A match can also contain 1, 6, or A (such as "m16"), but it cannot contain these three characters only (such as 1, 16, or 16A).
{n}	Matches the preceding character n times. The number n must be a nonnegative integer.	"o{2}" matches "food", but not "Bob".
{n,}	Matches the preceding character n times or more. The number n must be a nonnegative integer.	"o{2,}" matches "foooood", but not "Bob".
{n,m}	Matches the preceding character n to m times or more. The numbers n and m must be nonnegative integers and n cannot be greater than m.	" o{1,3}" matches "fod", "food", and "foooood", but not "fd".
\<	Matches a string that starts with the pattern following \<. A string that contains the pattern is also a match if the characters preceding the pattern are not digits, letters, or underscores.	"\<do" matches "domain" and "doa".
\>	Matches a string that ends with the pattern preceding \>. A string that contains the pattern is also a match if the characters following the pattern are not digits, letters, or underscores.	"do\>" matches "undo" and "cdo".
\b	Matches a word that starts with the pattern following \b or ends with the pattern preceding \b.	"er\b" matches "never", but not "verb" or "erase". "\ber" matches "erase", but not "verb" or "never".
\B	Matches a word that contains the pattern but does not start or end with the pattern.	"er\B" matches "verb", but not "never" or "erase".
\w	Same as [A-Za-z0-9_], matches a digit, letter, or underscore.	"v\w" matches "vlan" and "service".
\W	Same as [^A-Za-z0-9_], matches a character that is not a digit, letter, or underscore.	"\Wa" matches "-a", but not "2a" or "ba".
\	Escape character. If a special character listed in this table follows \, the specific meaning of the character is removed.	"\\" matches a string containing "\", "\^" matches a string containing "^", and "\\b" matches a string containing "\b".

‌

Examples

# Configure a CLI-defined policy to monitor Syslog messages for level 3 to level 0 messages that contain the down string. Enable the policy to execute when five log matches are found within 6 seconds.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event syslog priority 3 msg down occurs 5 period 6

event track

Use event track to configure a track event for a CLI-defined monitor policy.

Use undo event to delete the event in a CLI-defined monitor policy.

Syntax

event track track-list state { negative | positive } [ suppress-time suppress-time ]

undo event

Default

A CLI-defined policy does not contain a track event.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

track-list: Specifies a space-separated list of up to 16 track items. Each item specifies a track entry number or a range of track entry numbers in the form of track-entry-number to track-entry-number. The value range for the track-entry-number argument is 1 to 1024.

state { negative | positive }: Monitors state change of the track entries.

·     negative: Triggers the policy when the states of the track entries change from Positive to Negative.

·     positive: Triggers the policy when the states of the track entries change from Negative to Positive.

suppress-time suppress-time: Sets a suppress time in the range of 1 to 4294967295, in seconds. The default value is 0.

Usage guidelines

After you configure a track event for an EAA monitor policy, the track event occurs and triggers the policy when the state of the track entry changes from Positive to Negative or from Negative to Positive. If you specify multiple track entries for a policy, the policy is triggered only when the state of all the track entries changes from Positive to Negative or Negative to Positive.

For example, for the sessions between the local device and its downlink BGP peers to disconnect automatically when the sessions between the local device and its uplink BGP peers are disconnected, you can configure a track event monitor policy as follows:

·     Configure a track event for the policy and specify track entries to monitor the links between the local device and its uplink BGP peers.

·     Add the CLI action peer ignore to the policy to disable BGP session establishment between the local device and its downlink BGP peers.

To avoid frequent triggering of the EAA monitor policy by the track event, you can specify suppression time to control the interval between executions of the monitor policy. After the suppression time is configured, the policy is triggered and the suppression timer is started when the track event occurs for the first time.

·     If the track event occurs again before or when the suppression timer expires, the track event will be suppressed and will not trigger the monitor policy.

·     If the track event occurs again after the suppression timer expires, the monitor policy is triggered and the suppression timer will be reset and restart timing until the monitor policy is stopped.

For example, if you execute the track 1 interface gigabiteethernet 1/0/1 and event track 1 state negative suppress-time 60 commands to configure a track event for a monitor policy, the following occurs:

·     When the state of interface Ten-GigabitEthernet 1/0/1 changes to down for the first time, the monitor policy is triggered.

·     If the state of interface Ten-GigabitEthernet 1/0/1 changes to down again within 60 seconds, the monitor policy will not be triggered. This prevents frequent triggering of the monitor policy within one minute in case of state flapping of Ten-GigabitEthernet 1/0/1.

·     If the state of interface Ten-GigabitEthernet 1/0/1 changes to down again after 1 minute, the monitor policy is triggered.

You can configure only one event entry for a monitor policy. If the monitor policy already contains an event entry, the new event entry replaces the old event entry.

Examples

# Create CLI-defined monitor policy test. Configure a track event for the policy that occurs when the states of track entry 1 to track entry 8 change from Positive to Negative. Set the suppress time to 180 seconds for the policy.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] event track 1 to 8 state negative suppress-time 180

rtm cli-policy

Use rtm cli-policy to create a CLI-defined EAA monitor policy and enter its view, or enter the view of an existing CLI-defined EAA monitor policy.

Use undo rtm cli-policy to delete a CLI-defined monitor policy.

Syntax

rtm cli-policy policy-name

undo rtm cli-policy policy-name

Default

No CLI-defined monitor policies exist.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

policy-name: Specifies the name of a CLI-defined monitor policy, a case-sensitive string of 1 to 63 characters.

Usage guidelines

You must create a CLI-defined monitor policy before you can use the CLI to configure settings in the policy.

For a CLI-defined monitor policy to take effect, you must execute the commit command after you complete configuring the policy.

You can execute this command multiple times to create multiple CLI-defined monitor policies. Make sure the CLI-defined monitor policies that are executed at the same time do not have conflicting actions. If the actions conflict, the system executes the actions randomly.

You can assign the same name to a CLI-defined policy and a Tcl-defined policy.

Examples

# Create a CLI-defined policy and enter its view.

<Sysname> system-view

[Sysname] rtm cli-policy test

Related commands

Commit

rtm email domain

Use rtm email domain to specify an email server domain name.

Use undo rtm email domain to restore the default.

Syntax

rtm email domain domain-name

undo rtm email domain

Default

No email server domain name is specified.

Views

System view

Predefined use roles

network-admin

mdc-admin

Parameters

domain-name: Specifies the email server domain name, a case-sensitive string of 1 to 255 characters. The name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

Usage guidelines

After you specify an email server address by its domain name, you do not need to reconfigure the email server address when the email server address changes.

Examples

# Specify 163.com as the email server domain name.

<Sysname> system-view

[Sysname] rtm email domain 163.com

Related commands

action email

rtm email max-size

rtm email username password

rtm email max-size

Use rtm email max-size to set the maximum email size that the device can send.

Use undo rtm email max-size to restore the default.

Syntax

rtm email max-size size

undo rtm email max-size

Default

The device can send an email with a maximum size of 2 MB.

Views

System view

Predefined use roles

network-admin

mdc-admin

Parameters

size: Specifies the maximum email size in the range of 1 to 50, in MB.

Usage guidelines

For an email to be sent correctly, make sure the email size does not exceed the value specified by this command and the maximum email size configured on the email server.

Examples

# Set the maximum email size that the device can send to 10 MB.

<Sysname> system-view

[Sysname] rtm email max-size 10

Related commands

rtm email domain

rtm email username password

Use rtm email username password to set the email username and password.

Use undo rtm email username to restore the default.

Syntax

rtm email username username password { simple | cipher} password

undo rtm email username

Default

No email username or password exists.

Views

System view

Predefined use roles

network-admin

mdc-admin

Parameters

username: Specifies an email username, a case-insensitive string of 1 to 31 characters that do not contain the domain name.

cipher: Specifies an email password in encrypted form.

simple: Specifies an email password in plaintext form. The password will be saved in encrypted form.

password: Sets a case-sensitive password. The password is a string of 1 to 31 characters in plaintext form or a string of 33 to 73 characters in encrypted form.

Usage guidelines

For an email to be sent correctly, make sure the email username and password are consistent with those registered with the email server.

Examples

# Set both the email username and password to test.

<Sysname> system-view

[Sysname] rtm email username test password simple test

Related commands

rtm email domain

rtm environment

Use rtm environment to configure an EAA environment variable.

Use undo rtm environment to delete a user-defined EAA environment variable.

Syntax

rtm environment var-name var-value

undo rtm environment var-name

Default

No user-defined EAA environment variables exist.

The system provides the variables in Table 8. You cannot create, delete, or modify these system-defined variables.

Table 8 System-defined EAA environment variables by event type

Event	Variable name and description
Any event	_event_id: Event ID _event_type: Event type _event_type_string: Event type description _event_time: Time when the event occurs _event_severity: Severity level of an event
CLI	_cmd: Commands that are matched
Syslog	_syslog_pattern: Log message content
Hotplug	_slot: ID of the slot where card hot-swapping occurs
Interface	_ifname: Interface name
SNMP	_oid: OID of the MIB variable where an SNMP operation is performed _oid_value: Value of the MIB variable
SNMP-Notification	_oid: OID that is included in the SNMP notification.
Process	_process_name: Process name

 

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

var-name: Specifies a user-defined EAA environment variable by its name, a case-sensitive string of 1 to 63 characters. The name can contain digits, letters, and the underscore sign (_), but its leading character cannot be the underscore sign.

var-value: Specifies the variable value.

Usage guidelines

When you define an action, you can enter a variable name with a leading dollar sign ($variable_name) instead of entering a value for an argument. EAA will replace the variable name with the variable value when it performs the action.

For an action argument, you can specify a list of variable names in the form of $variable_name1$variable_name2...$variable_nameN.

Examples

# Create an environment variable: set its name to if and set its value to interface.

<Sysname> system-view

[Sysname] rtm environment if interface

rtm event syslog buffer-size

Use rtm event syslog buffer-size to set the size for the EAA-monitored log buffer.

Use undo rtm event syslog buffer-size to restore the default.

Syntax

rtm event syslog buffer-size buffer-size

undo rtm event syslog buffer-size

Default

The size of the EAA-monitored log buffer is 50000.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

buffer-size: Specifies the size for the EAA-monitored log buffer, in the range of 1 to 500000.

Usage guidelines

After you execute a Syslog event monitor policy, the system saves a copy of the logs to the EAA-monitored log buffer. When the logs in the buffer match the Syslog event, EAA executes the monitor policy actions.

Typically, the default EAA-monitored log buffer size is sufficient. However, when a feature malfunctions or the user enables multiple debugging functions, a large number of logs are generated. Some logs might be discarded before the matching is performed. You can set the EAA-monitored log buffer to a large size based on the memory usage.

Examples

# Set the size of the EAA-monitored log buffer to 1000.

<Sysname> system-view

[Sysname] rtm event syslog buffer-size 1000

Related commands

event syslog

rtm scheduler suspend

Use rtm scheduler suspend to suspend all monitor policies, including CLI monitor policies and Tcl monitor policies.

Use undo rtm scheduler suspend to resume monitor policies.

Syntax

rtm scheduler suspend

undo rtm scheduler suspend

Views

System view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

You need to suspend the monitor policies under the following circumstances:

·     The monitor policies are triggered frequently, affecting the system services and performance.

·     The Tcl script of a policy needs to be revised.

After you execute this command, EAA will not execute the policies even if the trigger conditions are met.

This command does not suspend a running monitor policy until all its actions are executed.

Examples

# Suspend monitor policies.

<Sysname> system-view

[Sysname] rtm scheduler suspend

rtm tcl-policy

Use rtm tcl-policy to create a Tcl-defined policy and bind it to a Tcl script file.

Use undo rtm tcl-policy to delete a Tcl policy.

Syntax

rtm tcl-policy policy-name tcl-filename

undo rtm tcl-policy policy-name

Default

No Tcl policies exist.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

policy-name: Specifies a policy name, a case-sensitive string of 1 to 63 characters.

tcl-filename: Specifies a .tcl script file name. The file name is case sensitive. You must ensure that the file is available on a storage medium of the device.

Usage guidelines

When you use this command to create a Tcl-defined policy, follow these guidelines:

Make sure the script file is saved on all MPUs. This practice ensures that the policy can run correctly after an active/standby or master/standby switchover occurs or the MPU where the script file resides fails or is removed.

This command both creates and enables the specified Tcl-defined monitor policy. To revise the Tcl script of a Tcl-defined policy, you must suspend all monitor policies first, and then resume the policies after you finish revising the script. The system cannot execute a Tcl-defined policy if you edit its Tcl script without suspending all monitor policies.

To bind a Tcl-defined policy to a different Tcl script file:

1.     Execute the undo rtm tcl-policy command to delete the Tcl policy.

2.     Create the Tcl policy again, and then bind it to the new Tcl script file.

You can assign the same policy name to a CLI-defined policy and a Tcl-defined policy. However, you cannot assign the same name to policies that are the same type.

Examples

# Create a Tcl policy and bind it to a Tcl script file.

<Sysname> system-view

[Sysname] rtm tcl-policy test test.tcl

running-time

Use running-time to configure the action runtime of a CLI-defined policy.

Use undo running-time to restore the default.

Syntax

running-time time

undo running-time

Default

The action runtime of a CLI-defined policy is 20 seconds.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

time: Specifies the action runtime in the range of 0 to 31536000 seconds. If you specify 0, the policy runs its actions forever once the policy is triggered.

Usage guidelines

The action runtime limits the amount of time that the monitor policy runs its actions from the time it is triggered. When the runtime is reached, the system stops executing the actions even if the execution is not finished.

This setting prevents an incorrectly defined policy from running its actions permanently to occupy resources.

For the actions of a periodic event monitor policy to be executed completely, the action running time must be smaller than or equal to the interval configured for the periodic event.

Examples

# Set the action runtime to 60 seconds for CLI-defined policy test.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] running-time 60

Related commands

event period

user-role

Use user-role to assign a user role to a CLI-defined policy.

Use undo user-role to remove a user role from a CLI-defined policy.

Syntax

user-role role-name

undo user-role role-name

Default

A monitor policy contains user roles that its creator had at the time of policy creation.

Views

CLI-defined policy view

Predefined user roles

network-admin

mdc-admin

Parameters

role-name: Specifies a user role by its name, a case-sensitive string of 1 to 63 characters.

Usage guidelines

For EAA to execute an action in a monitor policy, you must assign the policy the user role that has access to the action-specific commands and resources. If EAA lacks access to an action-specific command or resource, EAA does not perform the action and all the subsequent actions.

For example, a monitor policy has four actions numbered from 1 to 4. The policy has user roles that are required for performing actions 1, 3, and 4, but it does not have the user role required for performing action 2. When the policy is triggered, EAA executes only action 1.

A monitor policy supports a maximum of 64 valid user roles. User roles added after this limit is reached do not take effect.

An EAA policy cannot have both the security-audit user role and any other user roles. Any previously assigned user roles are automatically removed when you assign the security-audit user role to the policy. The previously assigned security-audit user role is automatically removed when you assign any other user roles to the policy.

Examples

# Assign user roles to a CLI-defined policy.

<Sysname> system-view

[Sysname] rtm cli-policy test

[Sysname-rtm-test] user-role network-admin

[Sysname-rtm-test] user-role admin