eem script monitor routing table - multiple entries into 1 email

[roger perkin]

I have the following script running to report on routing table changes

event manager applet route-table-monitor

event routing network 0.0.0.0/0 ge 1

action 0.5 set msg "Route changed: Type: $_routing_type, Network: $_routing_network, Mask/Prefix: $_routing_mask, Protocol: $_routing_protocol, GW: $_routing_lastgateway, Intf: $_routing_lastinterface"

action 1.0 syslog msg "$msg"

action 2.0 cli command "enable"

action 4.0 info type routername

action 5.0 mail server "10.*.*.*" to "roger.perkin@****" from "Switch1" subject "Routing Table Change" body "$msg  $_cli_result"

It works perfectly however if multiple routes change I get multiple emails.

Last night we had a site go out and I got about 20 separate email for each subnet change.

What I would like to do is get this script to take all routes changed in a 1 minute interval and then output them into an email.

Not quite sure how I would go about that?

Thanks

Roger

Currently studying for my CCIE and just started on EEM, have not done much scripting before so this is all good stuff to know.

[Joe Clarke]

You can't do this with one policy.  However, you could accomplish this with a timer policy that will batch up the pending updates, though.  Something like this would work.

event manager applet route-table-monitor
 event routing network 0.0.0.0/0 ge 1
 action 0.5 set msg "Route changed: Type: $_routing_type, Network:  $_routing_network, Mask/Prefix: $_routing_mask, Protocol:  $_routing_protocol, GW: $_routing_lastgateway, Intf:  $_routing_lastinterface"
 action 0.6 syslog msg "$msg"
 action 1.0 handle-error type ignore
 action 2.0 context retrieve key RTRCTXT variable msgs
 action 3.0 if $_error ne FH_EOK
 action 4.0  set msgs "$msg\n"
 action 5.0 else
 action 6.0  append msgs "$msg\n"
 action 7.0 end
 action 8.0 handle-error type exit
 action 9.0 context save key RTRCTXT variable msgs
!
event manager applet route-table-batcher
 event timer watchdog time 60
 action 1.0 handle-error type ignore
 action 2.0 context retrieve key RTRCTXT variable msgs
 action 3.0 if $_error eq FH_EOK
 action 4.0  info type routername
 action 5.0  mail server "10.*.*.*" to "roger.perkin@****" from "$_info_routername" subject "Routing Table Change" body "$msgs"
 action 6.0 end
 action 7.0 handle-error type exit

[Adrian Lazar]

Hi Joseph,

We implemented the above policies on an ASR 1001 and sometimes we receive the below error :

002284: Aug 23 12:11:53.534 GMT: %HA_EM-6-FMPD_CONTEXT_SAVE: Failed to save variable context for key RTRCTXT: 'Embedded Event Manager' detected the 'fatal' condition 'duplicate application info key'

002285: Aug 23 12:11:53.534 GMT: %HA_EM-3-FMPD_ERROR: Error executing applet EEM_route-table-monitor statement 9.0

This seems to happen only when there are more than one route changes in a very short time interval (miliseconds).

If there is only one route change the script works as expected.

Please advise if you have seen this behavior before and what could be the cause of it.

Many thanks,

Adrian

[Joe Clarke]

Since multiple applets can run at the same time, this kind of race can happen.  One thing you can do is keep the error handling set to "ignore" and check the results of "context save".  If it isn't FH_EOK, then retrieve the new value, append your msgs to it, and try the save again.  Do this in a loop and you should be able to reduce the race (thought not eliminate it).