Showing results for 
Search instead for 
Did you mean: 

EEM Applet - email alert on syslog events -

Level 1
Level 1


Hi I have setup an EEM to send email alerts on syslog events.  This does a pattern search on :-

 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"

Question is how in the email being sent do you include which interface has gone down???  We have ports that ERR_DISABLE and would like these emailed as alerts.


Currently I am sending an "interface down" alert, but going forward need to add the following details to the email, so its more useful.


This is what I have so far:-

event manager environment email_server n.n.n.n
event manager environment email_from Communicate_PLC_SyslogMonitor@localhost
event manager environment email_to

event manager applet interface_down
 event syslog severity-notification pattern "%LINEPROTO-5-UPDOWN:"
 action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface is down"


Cheers and help!!!





6 Replies 6

Joe Clarke
Cisco Employee
Cisco Employee

You can add:


action 1 regexp "Interface ([^,]+)" $_syslog_msg match intf

action 2 mail server "$email_server" to "$email_to" from "$email_from" subject "Interface change" body" Interface $intf changed state"

hi joseph,

i need your advise, i want get alert email if packet loss is greater than 20% and i want alert mail sent just once and for reset condition  i want get alert mail again. i don't know how to configure it condition. could you help me to verify my configuration below?

ip sla logging traps
ip sla 1 
 icmp-jitter source-ip num-packets 100 interval 40
 frequency 50
ip sla schedule 1 life forever start-time now
ip sla reaction-configuration 1 react Packetloss threshold-value 3 1 threshold-type immediate action-type trapOnly
ip sla enable reaction-alerts

event manager applet TEST 
 event syslog pattern "IP SLAs\(1\): Threshold exceeded"
 action 2.0 mail server "" to "" from "" subject "Alert for Intermittent Link" body "link intermittent in x %"


Please start a new thread for your question.

hi joseph, i have created a new question.

Please check in




Is it possible to include the interface description in the e-mail?





Taking the extracted interface name, you could do:


cli command "show int $intf | inc Description:"


Then parse that output to get the description.