09-23-2016 10:38 AM
Hi,
We currently have an issue with the EEM script.
We have tunnels from the ASR router to AWS.
There are 2 x tunnels to a VPC in AWS. We have a script to notify us when both tunnels to the VPC go down.
Once one of the tunnels go down a log is generated. Now when the second tunnel to the same VPC goes down, the EEM script sends an email and alert notifying that both tunnels to the VPC are down. However, there is no timer for this script. The second tunnel can go down hours later and the alert/email will still be generated.
Our script:
event manager applet VPC_Name
event tag tunnel_$$$ syslog pattern "neighbor 169.254.XX.XX Down"
event tag tunnel_$$$ syslog pattern "neighbor 169.254.XX.XX Down"
trigger
correlate event tunnel_$$$ and event tunnel_$$$
action 1.0 mail server "$_email_server" to "$_page_to" from "$_email_from" subject "Both VPC_Name VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> VPC_Name are down."
action 2.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Both VPC_Name VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> VPC_Name are down."
We need to put in a timer after it detects the first tunnel to go down. For example after the first tunnel goes down, if the 2nd tunnel also goes down in the next 5 minutes, then only send an alert.
Any assistance will be appreciated.
Thank you,
Sai
09-26-2016 07:41 AM
Seems like you could add:
trigger period 300
09-26-2016 11:17 AM
HI jclarke ,
Thanks for your response.
So my config would be:
event manager applet QA_VPC(US-WEST-2)
event tag tunnel_851 syslog pattern "neighbor 169.254.13.253 Down"
event tag tunnel_852 syslog pattern "neighbor 169.254.12.13 Down"
trigger period 300
correlate event tunnel_851 and event tunnel_852
action 1.0 mail server "$_email_server" to "$_page_to" from "$_email_from" subject "Both QA_VPC(US-WEST-2) VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> QA_VPC(US-WEST-2) are down."
action 2.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Both QA_VPC(US-WEST-2) VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> QA_VPC(US-WEST-2) are down."
!
Please let me know.
Thank you,
Sai
09-26-2016 01:32 PM
Yes.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide