Script to Determine When Routes Removed from Table

Carlton Patterson · ‎12-07-2012

Hello Community,

Can someone please help me compile a script that will alert me when routes have vanished from the a routing table?

Cheers

Carlton

John Blakley · ‎12-07-2012

Carlton,

This one is a little easier

You could track the route with tracking and then create an event based on that. If you were watching route 10.10.10.0/24, you could do something like the following:

track 1 ip route 10.10.10.0 255.255.255.0 reachability

event manager applet RouteIsGone

event track 1 state down

*** Below is the mail you could send if you wanted to be alerted via email ***

action 1.0 cli command "enable"

action 2.0 mail server "" to "user@somewhere.com" from "anotherUser@somewhere.com" subject "Route is down" body "Route is down."

The above is very brutal but gets the job done. I found another post from Joseph that gives a couple of other solutions.

https://supportforums.cisco.com/thread/2122275

HTH,
John

*** Please rate all useful posts ***

HTH, John *** Please rate all useful posts ***

avayner · ‎12-07-2012

You can use the routing event detector for that:

event manager applet ROUTES-ALERT

event routing network 10.0.0.0/8 type all protocol all le 24

action 1.0 syslog msg "Network $_routing_network Mask $_routing_mask Using $_routing_protocol: $_routing_type"

Other parameters available:

$_routing_lastgateway

$_routing_distance

$_routing_time

$_routing_time_sec

$_routing_time_msec

$_routing_metric

$_routing_lastinterface

You can see all the variables populated by an event detector by looking at this command:

show event manager detector routing detailed

John Blakley · ‎12-07-2012

Arie,

I've been curious....where can I get a listing of the variables that Cisco has? Like the others you posted: $_routing_xxx

HTH, John *** Please rate all useful posts ***

avayner · ‎12-07-2012

There is a bunch of global ones which are in the general docs:

http://www.cisco.com/en/US/docs/ios-xml/ios/eem/configuration/15-1mt/eem-policy-cli.html#GUID-48CB6E8C-F456-4398-8B66-CC499331CB49

For some of the event detectors the easiest way would be to use a show command on the router:

"show event manager detector detailed"

John Blakley · ‎12-07-2012

Thank you!

HTH,
John

*** Please rate all useful posts ***

HTH, John *** Please rate all useful posts ***

Carlton Patterson · ‎12-07-2012

Chaps,

I have just glanced over the responses and can't thank you enough for you're replies. I have just got home, so not had time to view the replies in detail.

I will review the responses and let you know how I've got on.

Thanks again, gents.....

Joe Clarke · ‎12-07-2012

Take a look at "show event manager detector DETECTOR detail" for all of the ED variables. For the action variables, I created this doc to spell them all out:

https://supportforums.cisco.com/docs/DOC-24901

Carlton Patterson · ‎12-07-2012

Arie,

I tried to apply your EEM but the device is 3600 and there isn't an IOS available to allow me to run any EEM other than 2.1.

I'm very surprised I can't download an IOS such as 12.4(22)T for 3600's to enable me take advantage of the benefits of EEM 3.0? Can someone explain why that is?

Cheers

avayner · ‎12-07-2012

Well, the 3600 routers hit the last day of support milestone in 2008.

Cisco stopped selling them in 2003.

This is the EOL announcement:

http://www.cisco.com/en/US/prod/collateral/routers/ps274/prod_end-of-life_notice09186a0080184884.html

Carlton Patterson · ‎12-07-2012

Arie,

Would you happen to if I can load IOS 12.4(22)T on 2691 or any of the 2600's?

Cheers

avayner · ‎12-07-2012

If the image fits the flash and loads without crashing, then you are fine for lab and playing around scenarios.

I would not recommend running offically unsupposrted images as you would not be able to get official support

Joe Clarke · ‎12-08-2012

As Arie previously pointed out, these are very old devices. They don't have the memory for such new images. The 2691 can only run up to 12.4(15)T, so that gives you EEM 2.3. The same goes for all the 2600 series. If you want EEM 3.0, you will need to move to an ISR router (e.g., 1800 or 2800).

Carlton Patterson · ‎12-08-2012

Joseph,

Its great knowing that I can get EEM 2.3 on 2691 with 12.4(15)T, however I'm sure I tried in the past and I was only able to get EEM 2.1 even with 12.4(15)T - I will try again....

Cheers

Joe Clarke · ‎12-08-2012

Yes, 12.4(15)T contains EEM 2.3. The differences between 2.1 and 2.3 are small, though. You get the "pattern" keyword on CLI actions for applets, the track event detector, the resource (ERM) ED, and the RF ED.