Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

EEM Applet - email alert on syslog events -


Hi I have setup an EEM to send email alerts on syslog events.  This does a pattern search on :-

 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"

Question is how in the email being sent do you include which interface has gone down???  We have ports that ERR_DISABLE and would like these emailed as alerts.


Currently I am sending an "interface down" alert, but going forward need to add the following details to the email, so its more useful.


This is what I have so far:-

event manager environment email_server n.n.n.n
event manager environment email_from Communicate_PLC_SyslogMonitor@localhost
event manager environment email_to

event manager applet interface_down
 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"
 action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface is down"


Cheers and help!!!





  • EEM Scripting
Cisco Employee

You can add: action 1 regexp

You can add:


action 1 regexp "Interface ([^,]+)" $_syslog_msg match intf

action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface change" body" Interface $intf changed state"

New Member

hi joseph,i need your advise,

hi joseph,

i need your advise, i want get alert email if packet loss is greater than 20% and i want alert mail sent just once and for reset condition  i want get alert mail again. i don't know how to configure it condition. could you help me to verify my configuration below?

ip sla logging traps
ip sla 1 
 icmp-jitter source-ip num-packets 100 interval 40
 frequency 50
ip sla schedule 1 life forever start-time now
ip sla reaction-configuration 1 react Packetloss threshold-value 3 1 threshold-type immediate action-type trapOnly
ip sla enable reaction-alerts

event manager applet TEST 
 event syslog pattern "IP SLAs\(1\): Threshold exceeded"
 action 2.0 mail server "" to "" from "" subject "Alert for Intermittent Link" body "link intermittent in x %"


Cisco Employee

Please start a new thread for

Please start a new thread for your question.

New Member

hi joseph, i have created a

hi joseph, i have created a new question.

Please check in

New Member

Joseph,  Is it possible to




Is it possible to include the interface description in the e-mail?





Cisco Employee

Taking the extracted

Taking the extracted interface name, you could do:


cli command "show int $intf | inc Description:"


Then parse that output to get the description.

This widget could not be displayed.