Your browser failed to load CSS style sheets. Your browser or web proxy might not support elliptic-curve TLS

Building network automation solutions

9 module online course

Start now!
back to overview

The hidden wealth of IOS Tcl

Another undocumented (and thus very probably unsupported) Tcl-on-IOS detail: numerous Tcl packages are bundled with IOS and available in the tmpsys:lib/tcl directory (the tmpsys: is a virtual file system mapped to a part of the IOS image).

The list of Tcl packages seems to be pretty stable; 12.2SRC and 12.4T have the same contents of the tmpsys:lib/tcl directory.

router#dir tmpsys:lib/tcl
Directory of tmpsys:lib/tcl/

   13  -r--       19226                    <no date>  auto.tcl
   23  -r--        2549                    <no date>  base.tcl
   25  -r--        7655                    <no date>  cli_lib.tcl
   26  -r--        2589                    <no date>  context_lib.tcl
    3  drw-           0                    <no date>  eem_scripts
   28  -r--         185                    <no date>
   29  -r--         147                    <no date>
   30  -r--         154                    <no date>
   31  -r--         156                    <no date>
   32  -r--         144                    <no date>
   33  -r--         325                    <no date>
   34  -r--         135                    <no date>
   14  -r--        9135                    <no date>  history.tcl
   15  -r--       23558                    <no date>  http.tcl
   19  -r--       17725                    <no date>  init.tcl
   21  -r--        6932                    <no date>  ldAout.tcl
   24  -r--       33266                    <no date>  optparse.tcl
   16  -r--       19415                    <no date>  package.tcl
   20  -r--        1014                    <no date>  parray.tcl
   17  -r--       32649                    <no date>  safe.tcl
   27  -r--       10367                    <no date>  smtp_lib.tcl
   22  -r--       13659                    <no date>  tclIndex
   18  -r--        4499                    <no date>  word.tcl

For whatever weird incomprehensible reason, these packages are not made available to the Tclsh interpreter started from the command line. For example, if you want to use the HTTP package, you cannot execute the package require http command like you would in any normal Tcl environment, but have to use the source "tmpsys:lib/tcl/http.tcl" command.

If you want to safeguard against a potential change-of-mind of IOS Tclsh developers, use this construct:

if {[catch {package require http}]} { source "tmpsys:lib/tcl/http.tcl" }

Please read our Blog Commenting Policy before writing a comment.


  1. I can run a simple tcl command at the command prompt such as:
    3825-r01(tcl)#exec "sho run" | redirect tftp://
    I'd like to copy a tcl script containing this command into the router's flash and have it run every day at
    say 6AM. This should be simple but I can't find any posts about it.

  2. Put your command in a file and copy it to the routers flash. You can create it in Notepad and copy using FTP/TFTP. Or there's a nifty trick on this site to write it directly via TCL...

    As far as scheduling, you can register an EEM Applet which will trigger on a timer

    event manager applet BackupRunning
    event timer cron name BackupRunning cron-entry "0 23 * * 6"
    action 1 cli command "enable"
    action 2 cli command "tclsh flash:BackupRunning.tcl"

    Note - In my limited but painful experience, AAA will kill you with TCL. So if you using AAA you're on your own with automating it... :-)

    IOS v15 does have a new option when you register the applet to specify authorization bypass that may solve my AAA woes, but I haven't had a chance to test it out.

    event manager applet BackupRunning authorization bypass

  3. Thanks, Bryan! BTW, this is how you solve the AAA problem:

    There was also a bug where AAA authorization would fail under weird circumstances. I know a bug report was filed, I'm not sure whether it was fixed or when.

  4. Ivan -

    Ah, curses you are right... :-) I had tried that and it didn't work at first so I moved on to trying to bypass AAA in other ways. I've revisited and determined that I needed both the cli username and the action "enable" to work (I didn't have that originally). Thank you very much for prompting the fresh look!

    There was a bug with 12.4(22)T where TCL would only send a null username to AAA. That was fixed in 12.4(22)T2.

    Here's my script and EEM config if it is helpful to anyone else. This is to backup flash on a CME router.

    - Bryan

    proc get_dir {} {
    set dir_flash [ exec "dir flash:\n" ]
    foreach result $dir_flash {
    #Match words ending in .xxx, exclude .bin
    if [regexp -nocase {(\S+\.\w+[^bin]$)} $result] {
    lappend dir_out $result
    return $dir_out

    #Replace ftp user/pass and server IP as appropriate
    foreach f [get_dir] {
    puts "$f"
    typeahead "\n"; exec "copy $f ftp://cmehi-1-a:[email protected]\n"

    EEM Config:
    event manager session cli username "cmnq981"

    event manager applet CopyFlash
    event timer cron name CopyFlash cron-entry "0 23 * * 6" maxrun 1800
    action 1 cli command "enable"
    action 2 cli command "tclsh flash:CopyFlash.tcl"

  5. One reason these packages are not available from Tclsh is because they are in the tmpsys file system which is controlled, managed and owned by the EEM development team at Cisco. The Tcl development team can't rely on the packages and libraries always being there since they don't own them. So they are not available to Tclsh as auto-loaded packages. At one point in time these packages were stored in the system file system but later they were moved. Such a change would have caused issues with Tclsh if they were still looking for them in system.


Constructive courteous comments are most welcome. Anonymous trolling will be removed with prejudice.