EEM Script to identify and email BGP Flap

Unanswered Question
Mar 9th, 2017
User Badges:
  • Bronze, 100 points or more

Hi Experts,

I wrote a small EEM script to identify and email when a BGP neighbor goes down.

This is the relevant portion of that script:

event manager applet BGP-FLAP
event syslog pattern " %BGP-5-NBR_RESET:"
action 1.0 syslog msg "BGP-FLAP"
action 9.2 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "BGP Flap" body "$_cli_result"

action 9.4 cli command "exit"

This script works perfectly. But the problem is, since the script monitor the syslog pattern " %BGP-5-NBR_RESET:" , when 15 neighbors go down, it will trigger 15 different emails.

Is there any way to customize this script the trigger just one email even if 1 neighbors flapps OR 10 neighbor flaps. Even if 10 neighbor goes down, this script should trigger just one email.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Cisco Freak Fri, 03/10/2017 - 09:38
User Badges:
  • Bronze, 100 points or more

Any help would be appreciated.

Cisco Freak Tue, 03/14/2017 - 11:38
User Badges:
  • Bronze, 100 points or more

Any help would be appreciated.

Frank Durham Thu, 04/06/2017 - 12:30
User Badges:

Good Afternoon...

I am interested in seeing your complete EEM script to identify BGP flaps and email them my PAgerDuty service.  Are you able to provide your script?



Joe Clarke Sat, 04/22/2017 - 11:42
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

To do what you want, you could write the flaps to a file on flash (you can do this with applets if you have EEM 4.0).  Then, have another applet that periodically checks this file, and if it has contents, send an email with the contents.  This second policy could be done using a cron or watchdog timer.  For example, if you wanted emails no more frequently than every five minutes, have a watchdog run every 300 seconds.


This Discussion