I'm troubleshooting a LACP port-channel which randomly gets unbundled. At this point, I don't know if it is due to a hardware error (switch of SFP) or bad fiber. When I do a "show etherchannel detail", I can view the time since it was last unbundled. I know which of the two ports is causing the unbundling to occur. So while I am still troubleshooting, I would like to write an EEM script to shut this port down if it has recently become unbundled since the flapping is causing significant performance issues.
My first thought was to use a syslog pattern such as:
event syslog pattern "%EC-5-UNBUNDLE"
But I'm not even sure if this is the correct syslog message. When I shutdown one of the interfaces to this port-channel, I'm not seeing anything in syslog other than that interface was shut down. (I don't get the unbundle syslog message).
Short of using a syslog event, is there another event I can trigger off of to accomplish this? Thanks.