cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Bookmark
|
Subscribe
|
1303
Views
0
Helpful
3
Replies

EEM script timer

saichands
Level 1
Level 1

Hi,

We currently have an issue with the EEM script.

We have tunnels from the ASR router to AWS.

There are 2 x tunnels to a VPC in AWS. We have a script to notify us when both tunnels to the VPC go down.

Once one of the tunnels go down a log is generated. Now when the second tunnel to the same VPC goes down, the EEM script sends an email and alert notifying that both tunnels to the VPC are down. However, there is no timer for this script. The second tunnel can go down hours later and the alert/email will still be generated.

Our script:

event manager applet VPC_Name

event tag tunnel_$$$ syslog pattern "neighbor 169.254.XX.XX Down"

event tag tunnel_$$$ syslog pattern "neighbor 169.254.XX.XX Down"

trigger

 correlate event tunnel_$$$ and event tunnel_$$$

   action 1.0 mail server "$_email_server" to "$_page_to" from "$_email_from" subject "Both VPC_Name VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> VPC_Name are down."

action 2.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Both VPC_Name VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> VPC_Name are down."

We need to put in a timer after it detects the first tunnel to go down. For example after the first tunnel goes down, if the 2nd tunnel also goes down in the next 5 minutes, then only send an alert.

Any assistance will be appreciated.

Thank you,

Sai

3 Replies 3

Joe Clarke
Cisco Employee
Cisco Employee

Seems like you could add:

trigger period 300

HI jclarke ,

Thanks for your response.

So my config would be: 

event manager applet QA_VPC(US-WEST-2)
event tag tunnel_851 syslog pattern "neighbor 169.254.13.253 Down"
event tag tunnel_852 syslog pattern "neighbor 169.254.12.13 Down"


trigger period 300
correlate event tunnel_851 and event tunnel_852


action 1.0 mail server "$_email_server" to "$_page_to" from "$_email_from" subject "Both QA_VPC(US-WEST-2) VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> QA_VPC(US-WEST-2) are down."


action 2.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Both QA_VPC(US-WEST-2) VPC Tunnels are down on $_info_routername" body "Both Tunnels from SJC <-> QA_VPC(US-WEST-2) are down."


!

Please let me know.

Thank you,

Sai

Yes.