cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3010
Views
10
Helpful
6
Replies
sblackman68
Beginner

EEM Applet - email alert on syslog events -

 

Hi I have setup an EEM to send email alerts on syslog events.  This does a pattern search on :-

 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"

Question is how in the email being sent do you include which interface has gone down???  We have ports that ERR_DISABLE and would like these emailed as alerts.

 

Currently I am sending an "interface down" alert, but going forward need to add the following details to the email, so its more useful.

Device(hostname)/interface

This is what I have so far:-

event manager environment email_server n.n.n.n
event manager environment email_from Communicate_PLC_SyslogMonitor@localhost
event manager environment email_to email@test.com

event manager applet interface_down
 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"
 action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface is down"

 

Cheers and help!!!

 

S.

 

 

6 REPLIES 6
Joe Clarke
Hall of Fame Cisco Employee

You can add:

 

action 1 regexp "Interface ([^,]+)" $_syslog_msg match intf

action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface change" body" Interface $intf changed state"

hi joseph,

i need your advise, i want get alert email if packet loss is greater than 20% and i want alert mail sent just once and for reset condition  i want get alert mail again. i don't know how to configure it condition. could you help me to verify my configuration below?


ip sla logging traps
ip sla 1 
 icmp-jitter 10.216.0.105 source-ip 10.216.0.107 num-packets 100 interval 40
 frequency 50
ip sla schedule 1 life forever start-time now
ip sla reaction-configuration 1 react Packetloss threshold-value 3 1 threshold-type immediate action-type trapOnly
ip sla enable reaction-alerts

event manager applet TEST 
 event syslog pattern "IP SLAs\(1\): Threshold exceeded"
 action 2.0 mail server "10.240.0.10" to "x.x.x.x@domain.com" from "router@domain.com" subject "Alert for Intermittent Link" body "link intermittent in x %"

 

Joe Clarke
Hall of Fame Cisco Employee

Please start a new thread for your question.

hi joseph, i have created a new question.

Please check in https://supportforums.cisco.com/discussion/12225606/eem-email-alert-ip-sla-based-packet-loss

Joseph,

 

 

Is it possible to include the interface description in the e-mail?

 

 

Thanks,

 

Joe Clarke
Hall of Fame Cisco Employee

Taking the extracted interface name, you could do:

 

cli command "show int $intf | inc Description:"

 

Then parse that output to get the description.