EEM Email setup for IP SLA

[howithink]

Hi,

I have setup an IP SLA on my cisco 3850 switch internally. Everything is working great! What i need to know is how can i setup an Embedded Event Manager (EEM) email alert on my 3850 so when the IP SLA does occur i want an email triggered informing me. Same goes for when IP SLA returns back to primary route.

Your help is appreciated immensely.

Saif

[Bilal Nawaz]

I think there is a dedicated section for EEM scripting, you will probably get better and more beneficial answers by moving your post from the right hand side of your post in the Actions section.

Please rate useful posts & remember to mark any solved questions as answered. Thank you.

[howithink]

Thank you. i have moved this discussion to EEM scripting.

[howithink]

OK i did some research and found the following script someone used.

event manager environment _email_server 192.168.1.10
event manager environment _email_from alerts@domain.local
event manager environment _email_to oncall@domain.local

event manager applet internet_down
event track 1 state down
action 1.0 syslog msg "Primary Internet Circuit Down"
action 1.1 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit Down" body "Primary Internet Circuit Down."

event manager applet internet_UP
event track 1 state up
action 2.0 syslog msg "Primary Internet Circuit UP"
action 2.1 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit UP" body "Primary Internet Circuit UP."

Will this work on a 3850? Because the 3850 uses IOS-XE and a lot of the commands are different. I am afraid to try anything on my live network.

thanks,

Saif

[Joe Clarke]

I believe the 3850 supports the track ED.  You can tell by running the command:

show event manager detector all

And look for "track" in the output.  If it's there, then this will work.  Note, you'd also need to configure your IP SLA collector and tracked object (I don't see that here).

I would also recommend you do find some way to test this.  Even if it works in theory, everyone's network is unique in some way, and it would be good to confirm it's going to work without issue in your environment.

[howithink]

I dont have track, but i do have IPSLA as one of the detectors. Not sure how i can use that. My only problem is that i cant test this.

[Joe Clarke · Accepted solution]

You can use the IP SLA detector.  You have to configure your IP SLA collector to have a reaction-config.  Assuming it's a timeout you want, you would configure the reaction-config to be for a timeout, then your EEM event will be:

event ipsla reaction-type timeout operation-id X

Where X is the IP SLA collector ID.  Then, within your applet, you'll need an if statement:

action 1.0 if $_ipsla_condition eq Occurred

action 1.1  syslog msg "Primary Internet Circuit Down"

action 1.2  mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit Down" body "Primary Internet Circuit Down."

action 1.3 else

action 1.4  syslog msg "Primary Internet Circuit UP"

action 1.5  mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit UP" body "Primary Internet Circuit UP."

action 1.6 end

This means you only need one applet.

[howithink]

Is the IP SLA collector ID the same as IP SLA ID?

exmaple:

ip sla 1

echo-icmp..............

thanks,

[Joe Clarke]

Yep, that's the one.  You'll also need a reaction-configuration for this same ID to get it to trigger when a condition occurs.

[howithink]

Joseph i'm sorry, but i am new to cisco and even more EEM. Given the script above what should my script look like?

I dont know what reaction-configuration is.

thanks

[Joe Clarke]

Something like this:

ip sla reaction-configuration 1 react timeout threshold-type immediate

ip sla enable reaction-alerts

[howithink]

Sorry to bother, but will this be my full script then:

event manager environment _email_server 192.168.x.x

event manager environment _email_from alerts@domain.local

event manager environment _email_to oncall@domain.local

event ipsla reaction-type timeout operation-id 1

ip sla reaction-configuration 1 react timeout threshold-type immediate

ip sla enable reaction-alerts

action 1.0 if $_ipsla_condition eq Occurred

action 1.1  syslog msg "Primary Internet Circuit Down"

action 1.2  mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit Down" body "Primary Internet Circuit Down."

action 1.3 else

action 1.4  syslog msg "Primary Internet Circuit UP"

action 1.5  mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit UP" body "Primary Internet Circuit UP."

action 1.6 end

Thanks

[Joe Clarke]

The IP SLA commands are not part of the EEM policy.  They are part of your IP SLA configuration.  You'll need to enter them before configuring the applet.  The rest of the EEM commands look okay.

[howithink]

Ok sorry for being late on this. I was awaiting my spare 3850 to arrive.

I have setup IP SLA on my spare switch and setup the script as we discused, but when i configured it, i get this error:

%HA_EM-4-FMPD_NO_EVENT: No event configured for applet ISPCheck

This is what i have inputted so far:

ip sla 1

icmp-echo 8.8.8.8 source-ip 192.168.10.1

frequency 5

ip sla schedule 1 life forever start-time now

ip sla reaction-configuration 1 react timeout threshold-type immediate

ip sla enable reaction-alerts

track 1 ip sla 1 reachability

delay down 90 up 90

event manager environment _email_server

event manager environment _email_from IPSLA@domain.local

event manager environment _email_to IPSLA@domain.local

event manager applet ISPCheck

action 1.0 if $_ipsla_condition eq "Occurred"

action 1.1  syslog msg "Primary Internet Circuit Down"

action 1.2  mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit Down" body "Primary Internet Circuit Down."

action 1.3 else

action 1.4  syslog msg "Primary Internet Circuit UP"

action 1.5  mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Circuit UP" body "Primary Internet Circuit UP."

action 1.6 end

[Joe Clarke · Accepted solution]

You're missing:

event manager applet ISPCheck

event ipsla reaction-type timeout operation-id 1