Use ansible or other platform to shutdown int in err-disable via track

[neteng_11]

Scenario:

I want to use track object utilizing rtr reachability with an ipsla object to set an interface to err-disable.  Unfortunately (at least on the code version we're currently on (6.5.3)) you can't err-disable a sub-interface, only a physical interface.  

This log message comes in when the track goes down:

object_tracking[373]: %PKT_INFRA-ERRDIS-6-ERROR_DISABLE : Bundle-Ether355.3081: Error disabling due to reason: ot-track-state-change

the err-disable just doesn't actually happen to the subinterface (be355.3081)

I'd like to have an off box automation that could intake this log message, parse out the interface and log in and shut down the referenced interface.  I'm open to this being ansible or python, or anything really.  I do have some familiarity with ansible and python, so those would be preferred.

I'm pretty new to automation, so any assistance is very much appreciated on how to get started on this.

[bigevilbeard]

In order to do that, you would need to have the logs/alerts go into say Teams or monitoring platform, then based on that message login and shut the interface. What are you using for this? Ive done this with BGP and shutting neighbours which flap too many times per X amount of time over exchanges. It might be easier to have on-box code instead such as EEM or on-box python perform such task. What platform is this XR, NX, XE?

[neteng_11]

This is on XR - from the research we've done, it seems that python on box is barely supported on 6.5.3.  If possible I'd like this to be off box, so I can use the same centralized platform for multiple routers - I suppose that does make it a bit more complicated.

[bigevilbeard]

Something simple like this with Netmiko would work, which would be easy to put into a event based CI workflows in GitLab

log_message = "[add]"
log_error = "[add]"

log_command = "show logging | include '{}'".format(log_message)
error_command = "show logging | include '{}'".format(log_error)
shutdown_command = "interface {} ; shutdown"

 There is a good blog post (few years old now) which has a whole solution for  Event-driven Automation https://pynet.twb-tech.com/blog/stackstorm-nagios-event-driven-automation-part-1.html

[neteng_11]

Is there a good way to do this on the router vs having something off box execute?  Maybe with EEM/TCL?  Reading around it seems like this might be possible, just not sure how to go about getting started.

[bigevilbeard]

Yes, but check your version support for this, here is an example https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r7-3/programmability/configuration/guide/b-programmability-cg-asr9000-73x/m-ops-eem-scripts.html