EEM Applet - email alert on syslog events -

[sblackman68]

Hi I have setup an EEM to send email alerts on syslog events.  This does a pattern search on :-

 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"

Question is how in the email being sent do you include which interface has gone down???  We have ports that ERR_DISABLE and would like these emailed as alerts.

Currently I am sending an "interface down" alert, but going forward need to add the following details to the email, so its more useful.

Device(hostname)/interface

This is what I have so far:-

event manager environment email_server n.n.n.n
event manager environment email_from Communicate_PLC_SyslogMonitor@localhost
event manager environment email_to email@test.com

event manager applet interface_down
 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"
 action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface is down"

Cheers and help!!!

S.

[Joe Clarke]

You can add:

action 1 regexp "Interface ([^,]+)" $_syslog_msg match intf

action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface change" body" Interface $intf changed state"

[bonjovcisco]

hi joseph,

i need your advise, i want get alert email if packet loss is greater than 20% and i want alert mail sent just once and for reset condition  i want get alert mail again. i don't know how to configure it condition. could you help me to verify my configuration below?

ip sla logging traps
ip sla 1 
 icmp-jitter 10.216.0.105 source-ip 10.216.0.107 num-packets 100 interval 40
 frequency 50
ip sla schedule 1 life forever start-time now
ip sla reaction-configuration 1 react Packetloss threshold-value 3 1 threshold-type immediate action-type trapOnly
ip sla enable reaction-alerts

event manager applet TEST 
 event syslog pattern "IP SLAs\(1\): Threshold exceeded"
 action 2.0 mail server "10.240.0.10" to "x.x.x.x@domain.com" from "router@domain.com" subject "Alert for Intermittent Link" body "link intermittent in x %"

[Joe Clarke]

Please start a new thread for your question.

[bonjovcisco]

hi joseph, i have created a new question.

Please check in https://supportforums.cisco.com/discussion/12225606/eem-email-alert-ip-sla-based-packet-loss

[erbraga]

Joseph,

Is it possible to include the interface description in the e-mail?

Thanks,

[Joe Clarke]

Taking the extracted interface name, you could do:

cli command "show int $intf | inc Description:"

Then parse that output to get the description.