03-13-2018 07:06 AM - edited 03-01-2019 06:27 PM
Hi ,
I have configured IP sla and EEM on catalyst 3850 to send an email alert when ip sla gets triggered. But, It's frequently keep sending email alerts even the ip sla is not triggered.
Please see below the configuration,
IP sla
------
ip sla 1
icmp-echo 8.8.8.8 source-interface vlan1
threshold 100
timeout 100
frequency 2
ip sla schedule 1 life forever start-time now
EEM Script
----------
event manager environment email_server name@domain.com
event manager environment email_to name@domain.com
event manager environment email_from hname@domain.com
event manager applet ISP_Check
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.1 get-type exact entry-op eq entry-val "1" entry-type value exit-op eq exit-val "2" exit-type value poll-interval 2
action 1.0 syslog msg "Primary Internet Circuit Down - Start"
action 2 info type routername
action 3 mail server "$email_server" to "$email_to" from "$email_from" subject "Circuit Down - Syslog seen on $_info_routername" body "Primary Internet Circuit Down."
event manager applet ISP_Check_UP
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.1 get-type exact entry-op eq entry-val "2" entry-type value exit-op eq exit-val "1" exit-type value poll-interval 2
action 1.0 syslog msg "EEM script ISP_Check_UP - Start"
action 2 info type routername
action 3 mail server "$email_server" to "$email_to" from "$email_from" subject "Circuit UP - Syslog seen on $_info_routername" body "Primary Internet Circuit UP."
thanks
Anton
03-14-2018 06:32 AM
Some SNMP variables do not update quicker than every 5 seconds. I typically recommend people go no lower than 10. You're at 2. Can you try increasing this interval to see if the emails stop?
Alternatively, you could consider moving over to the IP SLA or track EDs to avoid the issue with SNMP.
03-14-2018 08:05 AM
Thanks for your reply.
I have increased the poll-interval by 4 now to see if the emails stop.
And also the IP sla and EDs are not available in 16.3.5b version.
Thanks
03-14-2018 09:35 AM
I'm surprised the track ED is not present. But even if it's not, you can use the syslog trigger generated when a tracked object goes up/down.
03-14-2018 09:48 AM
HI Joe,
Could you tell me how to use syslog instead snmp oid?
thanks
03-14-2018 10:13 AM
You need to configure a tracked object:
track 1 ip sla 1 state
Then configure your event to be "event syslog pattern ..." and specify a regex to match your syslog messages. I don't have the exact message.
03-14-2018 10:19 AM
Thanks Joe!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide