好的，所以

action policy POLICY_NAME $arg

不将参数传递给脚本 - 必须切换到

action cli command "tclsh flash:/script.tcl $arg"`

确实如此，但是...

EEM 操作无法从变量中捕获换行符以外的内容。我确实找到了出路 - 从$_syslog_msg（换行符是第一个字符）修剪换行符并分配给一个新变量。

这是端到端的解决方案：

CISCO-1811#sh run | s event
event manager directory user policy "flash:/"
event manager directory user library "flash:/"
event manager directory user repository tftp://1.1.1.3/
event manager applet TRIGGER_ON_SYSLOG
  event syslog occurs 1 pattern "%.*"
  action 1.0 string trimleft "$_syslog_msg"
  action 2.0 cli command "enable"
  action 2.1 cli command "tclsh flash:/sendevent.tcl \"$_string_result\""

$_string_result 是一个 EEM 内置变量，用于收集字符串 trimleft 的输出

从http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-a2.html：

使用该action string trimleft命令从另一个字符串的左端修剪一个字符串。此命令string2从 的左端修剪由 指定的字符string1。默认情况下，string2对应于空白。

下表显示了action string trimleft存储命令结果的内置变量。

内置变量： $_string_result

描述：action string trimleft命令的结果存储在这个变量中。

以上实际上是不完整/误导/或 Cisco 不知道他们选择的语言是如何工作的： string trimleft没有第二个参数会修剪空格、制表符、换行符和 CR而不仅仅是空格（参见：http : //wiki.tcl.tk /10177）。

发送事件.tcl

#...
# my own http_get implementation here
# ...

# My actual event code

set url "http://some.http.destination:8000"

# Event log message is passed in as "$argv 0".
# That's the first item in $argv (which is a list)
set rawmsg [lindex $argv 0]

# Strip quotes from syslog message
set cleanmsg [string map { "\"" "" } $rawmsg]

# Get the time stamp at source
set timestamp [clock format [clock seconds] -format "%Y-%m-%dT%H:%M:%S"]

set json "{
    \"RouterTimestamp\": \"$timestamp\",
    \"Message\": \"$cleanmsg\"
}\n"

# This makes a POST request. Yes a POST.
# Don't know, ask the TCL developers what's with the name :)
if {[catch {http_get $url -query $json} token]} {
    puts "HTTP POST request failed: $token"
} else {
    # Everything is fine
    puts "POST successful."
}

结果

POST / HTTP/1.1
Accept: */*
Host: some.http.destination
User-Agent: Snobu Speshul TCL HTTP/1.1 Client library // build 21
Connection: close
Content-Length: 151
Content-Type: application/json

{
    "RouterTimestamp": "2017-02-02T10:09:49",
    "Message": "*Feb  2 10:09:49.307: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console"
}

GitHub repo 在这里（代码完整）：https : //github.com/snobu/cisco-syslog-over-http