EEM script to alert on IP SLA failures

[KarandeepChana]

Hi ,

I have configured IP sla and EEM on catalyst 3850 to send an email alert when ip sla gets triggered. But, It's frequently keep sending email alerts even the ip sla is not triggered.

Please see below the configuration,

IP sla

------
ip sla 1
icmp-echo 8.8.8.8 source-interface vlan1
threshold 100
timeout 100
frequency 2
ip sla schedule 1 life forever start-time now

EEM Script

----------

event manager environment email_server name@domain.com
event manager environment email_to name@domain.com
event manager environment email_from hname@domain.com
event manager applet ISP_Check
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.1 get-type exact entry-op eq entry-val "1" entry-type value exit-op eq exit-val "2" exit-type value poll-interval 2
action 1.0 syslog msg "Primary Internet Circuit Down - Start"
action 2 info type routername
action 3 mail server "$email_server" to "$email_to" from "$email_from" subject "Circuit Down - Syslog seen on $_info_routername" body "Primary Internet Circuit Down."
event manager applet ISP_Check_UP
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.1 get-type exact entry-op eq entry-val "2" entry-type value exit-op eq exit-val "1" exit-type value poll-interval 2
action 1.0 syslog msg "EEM script ISP_Check_UP - Start"
action 2 info type routername
action 3 mail server "$email_server" to "$email_to" from "$email_from" subject "Circuit UP - Syslog seen on $_info_routername" body "Primary Internet Circuit UP."

thanks

Anton

[Joe Clarke]

Some SNMP variables do not update quicker than every 5 seconds.  I typically recommend people go no lower than 10.  You're at 2.  Can you try increasing this interval to see if the emails stop?

Alternatively, you could consider moving over to the IP SLA or track EDs to avoid the issue with SNMP.

[KarandeepChana]

Thanks for your reply.

I have increased the poll-interval by 4 now to see if the emails stop.

And also the IP sla and EDs are not available in 16.3.5b version.

Thanks

[Joe Clarke]

I'm surprised the track ED is not present.  But even if it's not, you can use the syslog trigger generated when a tracked object goes up/down.

[KarandeepChana]

HI Joe,

Could you tell me how to use syslog instead  snmp oid?

thanks

[Joe Clarke]

You need to configure a tracked object:

track 1 ip sla 1 state

Then configure your event to be "event syslog pattern ..." and specify a regex to match your syslog messages.  I don't have the exact message.

[KarandeepChana]

Thanks Joe!