EEM to shutdown unbundled LACP etherchannel

[mjohnson3150]

Hi,

I'm troubleshooting a LACP port-channel which randomly gets unbundled. At this point, I don't know if it is due to a hardware error (switch of SFP) or bad fiber. When I do a "show etherchannel detail", I can view the time since it was last unbundled. I know which of the two ports is causing the unbundling to occur. So while I am still troubleshooting, I would like to write an EEM script to shut this port down if it has recently become unbundled since the flapping is causing significant performance issues. 

My first thought was to use a syslog pattern such as:

event syslog pattern "%EC-5-UNBUNDLE"

But I'm not even sure if this is the correct syslog message. When I shutdown one of the interfaces to this port-channel, I'm not seeing anything in syslog other than that interface was shut down. (I don't get the unbundle syslog message). 

Short of using a syslog event, is there another event I can trigger off of to accomplish this? Thanks.

[Georg Pauwen · Accepted solution]

Hello,

if you turn on debugging:

Switch#debug etherchannel event

whenever the port channel changes, the below messages (in bold) will be generated. You could use those in an EEM script:

event manager applet SHUT_LACP_PORT
event syslog pattern "FEC: lacp_switch_delete_port_from_agport_internal: removing Gi0/0 from Po1"
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "interface port-channel 1"
action 4.0 cli command "shut"
action 5.0 cli command "end"

event manager applet UNSHUT_LACP_PORT
event syslog pattern "FEC: lacp_switch_add_port_to_agport_internal: Gi0/0 added to aggregator Po1 list"
action 1.0 cli command "enable"
action 2.0 cli command "conf t"
action 3.0 cli command "interface port-channel 1"
action 4.0 cli command "no shut"
action 5.0 cli command "end"

[mjohnson3150]

That worked like a charm! Thanks, Georg!