EEM interface errors not matching

[steve22076]

I have the event applet configured below.  I test by changing the controller time-slots to 1-15 instead of 1-24 in order to generate errors on my Serial0/1/0:0 interface.  Errors are generated, but the eem applet does not match even though the errors are incrementing.  I've turned on all suggested eem debugging and it shows 0 matches while I can see that the interface is incrementing the errors that should be triggering the actions from the eem.  

configuration:

event manager applet multiple_if

event tag if_1 interface name Serial0/1/0:0 parameter input_errors_crc entry-op ge entry-val 2 entry-type increment poll-interval 60

event tag if_2 interface name Serial0/1/0:0 parameter input_errors entry-op ge entry-val 2 entry-type increment poll-interval 60

event tag if_3 interface name Serial0/1/0:0 parameter input_errors_frame entry-op ge entry-val 2 entry-type increment poll-interval 60

event tag if_4 interface name Serial0/1/0:0 parameter input_errors_overrun entry-op ge entry-val 2 entry-type increment poll-interval 60

event tag if_5 interface name Serial0/1/0:0 parameter output_errors entry-op ge entry-val 2 entry-type increment poll-interval 60

event tag if_6 interface name Serial0/1/0:0 parameter output_errors_underrun entry-op ge entry-val 2 entry-type increment poll-interval 60

trigger

action 100 cli command "enable"

action 200 cli command "config t"

action 300 cli command "int Serial0/1/0:0"

action 400 cli command "description script worked!"

action 500 syslog msg "CRC failure leased line $_interface_name"

action 600 mail server "$_mail_smtp" to "$_mail_rcpt" from "$_info_routername@$_mail_domain" subject "ALERT: Serial Interface $id shutdown due to excessive interface error rate" body "\n$_syslog_msg"

action 999 end

debug ouput:

Jun 20 14:20:48 EDT: fh_fd_syslog_event_match: num_matches = 0

Jun 20 14:20:48 EDT: fh_fd_data_syslog: num_matches = 0

Jun 20 14:20:48 EDT: fh_fd_syslog_event_match: num_matches = 0

Jun 20 14:20:48 EDT: fh_fd_data_syslog: num_matches = 0

Jun 20 14:21:00 EDT: fh_fd_timer_process_async

Jun 20 14:21:00 EDT: cron_tick: num_matches 0

Jun 20 14:21:22 EDT: %HSRP-5-STATECHANGE: FastEthernet0/0.4 Grp 4 state Standby -> Active

Jun 20 14:21:22 EDT: fh_fd_syslog_event_match: num_matches = 0

Jun 20 14:21:22 EDT: fh_fd_data_syslog: num_matches = 0

Jun 20 14:22:00 EDT: fh_fd_timer_process_async

Jun 20 14:22:00 EDT: cron_tick: num_matches 0

Jun 20 14:23:00 EDT: fh_fd_timer_process_async

Jun 20 14:23:00 EDT: cron_tick: num_matches 0

Jun 20 14:24:00 EDT: fh_fd_timer_process_async

Jun 20 14:24:00 EDT: cron_tick: num_matches 0

output showing interface errors:

csc-lab01#sh int s0/1/0:0

Serial0/1/0:0 is up, line protocol is up

  Hardware is GT96K Serial

  Internet address is x.x.x.x/30

  MTU 1500 bytes, BW 1536 Kbit/sec, DLY 20000 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation PPP, LCP Open

  Listen: CDPCP

  Open: IPCP, loopback not set

  Keepalive set (10 sec)

  CRC checking enabled

  Last input 00:00:00, output 00:00:00, output hang never

  Last clearing of "show interface" counters 02:44:23

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

  Queueing strategy: Class-based queueing

  Output queue: 0/1000/0 (size/max total/drops)

  30 second input rate 2000 bits/sec, 3 packets/sec

  30 second output rate 2000 bits/sec, 2 packets/sec

     9139 packets input, 1049231 bytes, 0 no buffer

     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

     224 input errors, 224 CRC, 117 frame, 95 overrun, 0 ignored, 81 abort

     10737 packets output, 1511507 bytes, 0 underruns

     0 output errors, 0 collisions, 15 interface resets

     0 unknown protocol drops

     0 output buffer failures, 0 output buffers swapped out

     0 carrier transitions

  Timeslot(s) Used:1-24, SCC: 0, Transmitter delay is 0 flags

[Joe Clarke]

It looks like you're missing a critical piece of configuration in your applet.  Namely:

trigger occurs 1

correlate event if_1 or event if_2 or event if_3 or event if_4 or event if_5 or event if_6

Try adding that, and see if it works.

[steve22076]

Thanks for the response!  That is a big oversight on my part.  Unfortunately, I added those lines, and caused many errors on my Serial interface, but it would not trigger the actions.  In a seperate test,  additionally tried changing the poll interval to 5 seconds just to make sure that the incrementing error would occur during the poll interval.   I still have debug event-manager turned on.   The only output message I received was the following:

"Jun 27 13:33:50 EDT: %HA_EM-6-FMPD_EEM_CONFIG: Serial_multiple_if: "end" action found outside of conditional block"

[Joe Clarke · Accepted solution]

A few other things I noticed.  Try this:

event manager applet multiple_if

event tag if_1 interface name  Serial0/1/0:0 parameter input_errors_crc entry-op ge entry-val 2  entry-type increment poll-interval 60

event tag if_2 interface  name Serial0/1/0:0 parameter input_errors entry-op ge entry-val 2  entry-type increment poll-interval 60

event tag if_3 interface  name Serial0/1/0:0 parameter input_errors_frame entry-op ge entry-val 2  entry-type increment poll-interval 60

event tag if_4 interface  name Serial0/1/0:0 parameter input_errors_overrun entry-op ge entry-val 2  entry-type increment poll-interval 60

event tag if_5 interface  name Serial0/1/0:0 parameter output_errors entry-op ge entry-val 2  entry-type increment poll-interval 60

event tag if_6 interface  name Serial0/1/0:0 parameter output_errors_underrun entry-op ge  entry-val 2 entry-type increment poll-interval 60

trigger occurs 1

correlate event if_1 or event if_2 or event if_3 or event if_4 or event if_4 or event if_5 or event if_6

action 100 cli command "enable"

action 200 cli command "config t"

action 300 cli command "int Serial0/1/0:0"

action 400 cli command "description script worked!"

action 401 set syslog_msg "CRC failure leased line $_interface_name"

action 500 syslog msg "$syslog_msg"

action 501 info type routername

action 600 mail server "$_mail_smtp" to "$_mail_rcpt" from  "$_info_routername@$_mail_domain" subject "ALERT: Serial Interface $_interface_name  shutdown due to excessive interface error rate" body "\n$syslog_msg"

[steve22076]

Missing the "type routername" and then referring to "routername" in my mail server line, was the cause of the entire script not running.  Thanks for the solution!