cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2582
Views
0
Helpful
3
Replies
Highlighted
Beginner

eem script monitor routing table - multiple entries into 1 email

I have the following script running to report on routing table changes

event manager applet route-table-monitor

event routing network 0.0.0.0/0 ge 1

action 0.5 set msg "Route changed: Type: $_routing_type, Network: $_routing_network, Mask/Prefix: $_routing_mask, Protocol: $_routing_protocol, GW: $_routing_lastgateway, Intf: $_routing_lastinterface"

action 1.0 syslog msg "$msg"

action 2.0 cli command "enable"

action 4.0 info type routername

action 5.0 mail server "10.*.*.*" to "roger.perkin@****" from "Switch1" subject "Routing Table Change" body "$msg  $_cli_result"

It works perfectly however if multiple routes change I get multiple emails.

Last night we had a site go out and I got about 20 separate email for each subnet change.

What I would like to do is get this script to take all routes changed in a 1 minute interval and then output them into an email.

Not quite sure how I would go about that?

Thanks

Roger

Currently studying for my CCIE and just started on EEM, have not done much scripting before so this is all good stuff to know.

3 REPLIES 3
Highlighted
Hall of Fame Cisco Employee

You can't do this with one policy.  However, you could accomplish this with a timer policy that will batch up the pending updates, though.  Something like this would work.

event manager applet route-table-monitor

event routing network 0.0.0.0/0 ge 1

action 0.5 set msg "Route changed: Type: $_routing_type, Network:  $_routing_network, Mask/Prefix: $_routing_mask, Protocol:  $_routing_protocol, GW: $_routing_lastgateway, Intf:  $_routing_lastinterface"

action 0.6 syslog msg "$msg"

action 1.0 handle-error type ignore

action 2.0 context retrieve key RTRCTXT variable msgs

action 3.0 if $_error ne FH_EOK

action 4.0  set msgs "$msg\n"

action 5.0 else

action 6.0  append msgs "$msg\n"

action 7.0 end

action 8.0 handle-error type exit

action 9.0 context save key RTRCTXT variable msgs

!

event manager applet route-table-batcher

event timer watchdog time 60

action 1.0 handle-error type ignore

action 2.0 context retrieve key RTRCTXT variable msgs

action 3.0 if $_error eq FH_EOK

action 4.0  info type routername

action 5.0  mail server "10.*.*.*" to "roger.perkin@****" from "$_info_routername" subject "Routing Table Change" body "$msgs"

action 6.0 end

action 7.0 handle-error type exit

Highlighted

Hi Joseph,

We implemented the above policies on an ASR 1001 and sometimes we receive the below error :

002284: Aug 23 12:11:53.534 GMT: %HA_EM-6-FMPD_CONTEXT_SAVE: Failed to save variable context for key RTRCTXT: 'Embedded Event Manager' detected the 'fatal' condition 'duplicate application info key'

002285: Aug 23 12:11:53.534 GMT: %HA_EM-3-FMPD_ERROR: Error executing applet EEM_route-table-monitor statement 9.0

This seems to happen only when there are more than one route changes in a very short time interval (miliseconds).

If there is only one route change the script works as expected.

Please advise if you have seen this behavior before and what could be the cause of it.

Many thanks,

Adrian

Highlighted
Hall of Fame Cisco Employee

Since multiple applets can run at the same time, this kind of race can happen.  One thing you can do is keep the error handling set to "ignore" and check the results of "context save".  If it isn't FH_EOK, then retrieve the new value, append your msgs to it, and try the save again.  Do this in a loop and you should be able to reduce the race (thought not eliminate it).

Content for Community-Ad