Technical Tip: Trigger CLI script through an automation stitch for BGP event logs

[princes]

Description	This article describes how to trigger an automation stitch with CLI commands when an BGP event is triggered.
Scope	All supported versions of FortiOS.
Solution	Configure BGP on FortiGate: BGP configuration. Create an automation stitch under Security Fabric -> Automation, as explained in Creating automation stitches - FortiGate administration guide. Create a trigger with the 'BGP neighbor status changed' event: Note: The log ID of this event should match that of the triggered event; then, only automation stitch will trigger the configured action. Create a CLI script like the following, which marks the interface port4 as down: Note: If the following event log is seen in the general system event logs, make sure the cli script has super_admin access as explained below. User delete the result of script autod.10 from autod Similarly, any number of stitches can be triggered with different event IDs. The result of the script can be verified with the following logs: After the above event was triggered, the interface port4 was marked as down by the CLI script: Interface port4 was marked as down: Note: Event trigger 'BGP neighbor status changed' is shown every time a BGP peer is down, for example: date=2025-06-25 time=16:26:52 eventtime=1750894012430389982 tz="-0700" logid="0103020300" type="event" subtype="router" level="warning" vd="root" logdesc="BGP neighbor status changed" msg="BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 172.16.30.2 Down BGP Notification FSM-ERR" If a specific BGP neighbor down event is necessary (in this case, when BGP peer 172.16.30.2 is down) to trigger the automation-stitch, a filter can be applied under 'edit Automation Trigger': As it is shown in the above image, the limit for the field filter value is 63 characters, and because of this restriction, an option is to set the message in the following way: "msg="BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 172.16.30.2 Down BGP*" This will execute the automation-stitch every time the specific BGP peer 172.16.30.2 is down: FGT-HUBDC1 (BGP_peer_DOWN) # show config system automation-trigger     edit "BGP_peer_DOWN"         set description "BGP peer DOWN"         set event-type event-log         set logid 20300             config fields                 edit 1                     set name "message"                     set value "BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 172.16.30.2 Down BGP*"                 next             end     next end Related documents: Technical Tip: Use FortiGate automation stitches for alert emails Automation stitches