Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

EEM Applet - email alert on syslog events -

 

Hi I have setup an EEM to send email alerts on syslog events.  This does a pattern search on :-

 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"

Question is how in the email being sent do you include which interface has gone down???  We have ports that ERR_DISABLE and would like these emailed as alerts.

 

Currently I am sending an "interface down" alert, but going forward need to add the following details to the email, so its more useful.

Device(hostname)/interface

This is what I have so far:-

event manager environment email_server n.n.n.n
event manager environment email_from Communicate_PLC_SyslogMonitor@localhost
event manager environment email_to email@test.com

event manager applet interface_down
 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"
 action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface is down"

 

Cheers and help!!!

 

S.

 

 

  • EEM Scripting
6 REPLIES
Cisco Employee

You can add: action 1 regexp

You can add:

 

action 1 regexp "Interface ([^,]+)" $_syslog_msg match intf

action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface change" body" Interface $intf changed state"

New Member

hi joseph,i need your advise,

hi joseph,

i need your advise, i want get alert email if packet loss is greater than 20% and i want alert mail sent just once and for reset condition  i want get alert mail again. i don't know how to configure it condition. could you help me to verify my configuration below?


ip sla logging traps
ip sla 1 
 icmp-jitter 10.216.0.105 source-ip 10.216.0.107 num-packets 100 interval 40
 frequency 50
ip sla schedule 1 life forever start-time now
ip sla reaction-configuration 1 react Packetloss threshold-value 3 1 threshold-type immediate action-type trapOnly
ip sla enable reaction-alerts

event manager applet TEST 
 event syslog pattern "IP SLAs\(1\): Threshold exceeded"
 action 2.0 mail server "10.240.0.10" to "x.x.x.x@domain.com" from "router@domain.com" subject "Alert for Intermittent Link" body "link intermittent in x %"

 

Cisco Employee

Please start a new thread for

Please start a new thread for your question.

New Member

hi joseph, i have created a

hi joseph, i have created a new question.

Please check in https://supportforums.cisco.com/discussion/12225606/eem-email-alert-ip-sla-based-packet-loss

New Member

Joseph,  Is it possible to

Joseph,

 

 

Is it possible to include the interface description in the e-mail?

 

 

Thanks,

 

Cisco Employee

Taking the extracted

Taking the extracted interface name, you could do:

 

cli command "show int $intf | inc Description:"

 

Then parse that output to get the description.

1292
Views
10
Helpful
6
Replies
This widget could not be displayed.