Event Handlers

Stop Packet Capture

Start a packet capture that will continue to run after logging out, create an event handler to stop it once the trigger has been detected in syslog:

bash nohup sudo tcpdump -nevvnni et1 host x.x.x.x and tcp port 179 -C 100 -W 10 -w /mnt/flash/bgp-flap.pcap &

conf t
event-handler BGP_Flap_Capture_Stop
   trigger on-logging
      regex %BGP-3-NOTIFICATION: received from neighbor x.x.x.x 
   action bash sudo killall tcpdump

 

---