I have the following eem script running on an asr1002 running 15.5(3)2s (The script monitors our Internet interface for high and low receive load threshold values and generates a corresponding syslog message). The problem is that the generated syslog message does not route out the management vrf on gig 0:
event manager applet INTERNET-UTILIZATION
event tag GIG003-RX-LOAD interface name GigabitEthernet0/0/3 parameter rxload entry-op ge entry-val 190 entry-type value exit-op le exit-val 127 exit-type value exit-event true poll-interval 60
action 1.0 set i "100"
action 2.0 set j "255"
action 2.5 multiply $_interface_value $i
action 2.7 divide $_result $j
action 3.0 if $_interface_exit_event eq "0"
action 5.0 syslog priority alerts msg "Internet circuit utilization exceeds $_result % on $_interface_name. Possible DDOS attack underway. Check Netflow."
action 5.5 else
action 6.0 syslog priority notifications msg "Internet link utilization normal: $_interface_name $_interface_parameter now at $_result %."
action 7.0 end
The logging interface for the asr is gig0 in the mgmt-intf vfr:
logging source-interface GigabitEthernet0 vrf Mgmt-intf
ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.48.28.1
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
ip address 10.48.28.11 255.255.255.0
negotiation auto
end
When the eem event is generated, it uses gi 00/2 (192.168.40.11) to send the syslog message instead of the configured gig 0.
First question would be why doesn't it use the configured logging interface and the second question would be what would I need to do to the script
to make the event message route over the gig 0 interface?
thanks
Ken
