event manager applet name

The name argument may be up to 32 alphanumeric characters long. Spaces are not allowed.

To remove an event manager applet, enter the no form of this command.

description text

The text argument may be up to 256 characters long. You may include spaces in description text if it is placed within quotes.

• To configure a syslog event, identify a single syslog message or a range of syslog messages that trigger an event manager applet.

  event syslog id nnnnnn [-nnnnnn] [occurs n] [period seconds]

  Example:

  
  ciscoasa(config-applet)# event syslog id 106201
  
  

  The nnnnnn argument identifies the syslog message ID. The occurs n keyword-argument pair indicates the number of times that the syslog message must occur for an event manager applet to be invoked. The default is 1 occurrence every 0 seconds. Valid values are from 1 - 4294967295. The period seconds keyword-argument pair indicates the number of seconds in which the event must occur, and limits how frequently an event manager applet is invoked to at most once in the configured period. Valid values are from 0 - 604800. A value of 0 means that no period is defined.

• To configure an event to occur once per configured period and restart automatically.

  event timer watchdog time seconds

  Example:

  
  ciscoasa(config-applet)# event timer watchdog time 30
  
  

  The number of seconds may range from 1 - 604800.

• To configure an event to occur once and not restart unless it is removed, then re-added.

  event timer countdown time seconds

  Example:

  
  ciscoasa(config-applet)# event timer countdown time 60
  
  

  The number of seconds may range from 1 - 604800. Use the no form of this command remove a countdown timer event.

  Note	This timer reruns when you reboot if it is the startup configuration.

• To configure an event to occur once a day at a specified time and restart automatically.

  event timer absolute time hh:mm:ss

  Example:

  
  ciscoasa(config-applet)# event timer absolute time 10:30:20
  
  

  The time-of-day format is in hh:mm:ss. The time range is from 00:00:00 (midnight) to 23:59:59.

• Trigger a crash event when the ASA crashes.

  event crashinfo

  Example:

  
  ciscoasa(config-applet)# event crashinfo
  
  

  Regardless of the value of the output command, the action commands are directed to the crashinfo file. The output is generated before the show tech command.

action n cli command “command”

The n option is an action ID. Valid IDs range from 0 - 4294967295. The value of the command option must be in quotes; otherwise, an error occurs if the command consists of more than one word. The command runs in global configuration mode as a user with privilege level 15 (the highest). The command may not accept any input, because it is disabled. Use the noconfirm option if the command has it available.

• The None option discards any output from the action commands, which is the default setting:

  output none

  Example:

  
  ciscoasa(config-applet)# output none
  
  

• The Console option sends the output of the action commands to the console.

  output console

  Example:

  
  ciscoasa(config-applet)# output console
  
  

  Note	Running this command affects performance.

• The New File option sends the output of the action commands to a new file for each event manager applet that is invoked.

  output file new

  Example:

  
  ciscoasa(config-applet)# output file new
  
  

  The filename has the format of eem-applet-timestamp.log, in which applet is the name of the event manager applet and timestamp is a dated time stamp in the format of YYYYMMDD-hhmmss.

• The New Set of Rotated Files option creates a set of files that are rotated. When a new file is to be written, the oldest file is deleted, and all subsequent files are renumbered before the first file is written.

  output file rotate n

  Example:

  
  ciscoasa(config-applet)# output file rotate 50
  
  

  The newest file is indicated by 0, and the oldest file is indicated by the highest number (n-1). The n option is the rotate value. Valid values range from 2 - 100. The filename format is eem-applet-x.log, in which applet is the name of the applet, and x is the file number.

• The Single Overwritten File option writes the action command output to a single file, which is overwritten every time.

  output file overwrite filename

  Example:

  
  ciscoasa(config-applet)# output file overwrite examplefile1
  
  

  The filename argument is a local (to the ASA) filename. This command may also use FTP, TFTP, and SMB targeted files.

• The Single Appended File option writes the action command output to a single file, but that file is appended to every time.

  output file append filename

  Example:

  
  ciscoasa(config-applet)# output file append examplefile1
  
  

  The filename argument is a local (to the ASA) filename.

event manager run applet

If you run an event manager applet that has not been configured with the event none command, an error occurs. The applet argument is the name of the event manager applet.

memory logging [1024-4194304] [wrap] [size [1-2147483647]] [process process-name] [context context-name]

The only required argument is the number of entries in the memory logging buffer. The wrap option tells the memory logging utility to save the buffer when it wraps. It can only be saved once.

If the memory logging buffer wraps multiple times, it can be overwritten. When the buffer wraps, a trigger is sent to the event manager to enable saving of the data. The size option monitors a particular size. The process option monitors a particular process.

The context option records memory logging for a given virtual context by the given name.

To change memory logging parameters, you must disable it, then reenable it.

show memory logging [brief | wrap]
show memory logging include [address] [caller] [operator] [size] [process] [time] [context]

Without any options, show memory logging displays statistics and then the recorded operations. The brief option shows only statistics. The wrap option shows the buffer upon wrap, then purges the data so that duplicate data does not appear or get saved. The include option includes only the specified fields in the output. You can specify the fields in any order, but they always appear in the following order:

1. Process

2. Time

3. Context (unless in single mode)

4. Operation (free/malloc/etc.)

5. Address

6. Size

7. Callers

The output format is:

process=[XXX] time=[XXX] context=[XXX] oper=[XXX] address=0xXXXXXXXX size=XX @ XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX

Up to four caller addresses appear. The types of operations are listed in the output (Number of...) shown in the example.

event memory-logging-wrap

The example shows an applet that records all memory allocations. When wrap is enabled for memory logging, the memory logger sends an event to the event manager to trigger configured applets.