EEM route monitor not working

[roger perkin]

I am trying to get an email when our routing table changes, running ospf and I have put the EEM script on a 3750 switch which is our main WAN routing point.

Questions:

How can I test the script? Check any logs etc?

We added some routes today and nothing happend. The email bit is fine as I have it running to email me when a config changes.

Route Monitor Script

event manager applet route-table-monitor

event routing network 0.0.0.0/0 ge 1

action 0.5 set msg "Route changed: Type: $_routing_type, Network: $_routing_network, Mask/Prefix: $_routing_mask, Protocol: $_routing_protocol, GW: $_routing_lastgateway, Intf: $_routing_lastinterface"

action 1.0 syslog msg "$msg"

action 1.3 mail server "10.251.136.31" to "roger.perkin@******.com" from "switch1@******.com" subject "Routing Table Change" body "$msg $_cli_result"

action 2.0 cli command "enable"

action 3.0 cli command "show ip route ospf"

action 4.0 info type routername

For reference this script is also on the switch and works perfectly and emails me when a config changes.

event manager applet mail_cfg_chg

event syslog pattern ".*%SYS-5-CONFIG_I.*"

action 1.0 info type routername

action 1.1 cli command "enable"

action 1.2 cli command "show archive log config all"

action 1.3 mail server "10.251.136.31" to "roger.perkin@*****.com" from "switch1@******.com" subject "Config change on switch1" body "$_cli_result"

action 1.4 cli command "clear archive log config force"

Any help appreciated as this is another language to me!

Roger

[yjdabear]

Is the route-table-monitor applet registered? If affirmative, do you happen to be running an IOS with the bug that renders "0.0.0.0/0" non-working, as mentioned in the following thread: https://supportforums.cisco.com/thread/2122275?

[Joe Clarke]

Your actions are out of order.  The action tags are executed in lexicographical order.  What you really want is:

event manager applet route-table-monitor
  event routing network 0.0.0.0/0 ge 1
  action 0.5 set msg "Route changed: Type: $_routing_type, Network: $_routing_network, Mask/Prefix: $_routing_mask, Protocol: $_routing_protocol, GW: $_routing_lastgateway, Intf: $_routing_lastinterface"
  action 1.0 syslog msg "$msg" 
  action 2.0 cli command "enable"
  action 3.0 cli command "show ip route ospf"
  action 4.0 info type routername
  action 5.0 mail server "10.251.136.31" to "roger.perkin@******.com" from  "switch1@******.com" subject "Routing Table Change" body "$msg  $_cli_result"

[roger perkin]

Thanks Joseph,

What checking options do you have with EEM or do you just create an event and see what happens?

I will add a route in and see what happens?

Thanks

Roger

[Joe Clarke]

That's what we have to do today, yes.  Add or remove a route, and see if the event fires.