EEM version 2.x: send email 1 hour after some event

[danailpetrov]

Hello networkers,

I'm trying to do something with EEM, which I'm not quite sure is it possible to achieve with EEM version 2.3. So the basic idea is that I have two applets which role is to watch the EIGRP sessions and to take appropriate actions if some session going down. So the applet `N1` is starting up whenever EIGRP session which using tunnel0 is down. Applet `N2` starts once the EIGRP session is restored. My mission is to do what is need so when the N1 is executed to start a kind of timer for let's say 60 minutes, and when this timer got expired to send an email notification (of course if the N2 is executed premature and EIGRP is UP to discard the timer or sending the email). I tried whatever you can imagine (at least with my abilities and knowledge of EEM) but I'm can't manage to do it with EEM version 2.3 ! There are lot of features in 3.x which I can use to make it work, but not with 2.x. So any help is appreciated!

Kind regards,

Dani Petrov

[Joe Clarke]

Even with EEM 2.3 you have the Tcl option, so you're not really limited. However, what you want to do should be possible using applets. Post your existing applets, and I'll provide a solution.

[danailpetrov]

Here you are!

Thank you in advance!

event manager applet UNSHUT_ISDN_ON_RELOAD

event syslog occurs 1 pattern "%SYS-5-RESTART: System restarted"

action 1.0 cli command "enable"

action 1.1 cli command "conf t"

action 1.2 cli command "int bri0/0"

action 1.3 cli command "no shut"

action 1.4 syslog msg "Enabling BRI interface since router was reloaded"

event manager applet EIGRP_IS_DOWN

event syslog pattern "DUAL-5-NBRCHANGE:.*Tunnel0.*down"

action 1.0 info type routername

action 2.0 cli command "enable"

action 2.1 cli command "configure terminal"

action 2.2 cli command "interface BRI0/0"

action 2.3 cli command "no shut"

action 2.4 cli command "end"

action 4.0 mail server "172.16.31.9" to "isdn@mydomain.com" from "$_info_routername@mydomain.com" subject "Primary link went down: $_info_routername" body "Router works on ISDN"

action 4.1 syslog msg "Email was sent to notify for this outage!"

event manager applet EIGRP_IS_UP

event syslog pattern "DUAL-5-NBRCHANGE:.*Tunnel0.*up"

action 1.0 info type routername

action 2.0 cli command "enable"

action 2.1 cli command "configure terminal"

action 2.2 cli command "interface BRI0/0"

action 2.3 cli command "shutdown"

action 2.4 cli command "end"

action 3.0 syslog msg "We are shutting BRI interface as long as primary link is working fine"

action 5.0 mail server "172.16.31.9" to "isdn@mydomain.com" from "$_info_routername@mydomain.com" subject "Primary link became available: $_info_routername" body "Primary link became active! ISDN is now administratively down!"

I want to send a warning email every hour after EIGRP_IS_DOWN is started and stop counting/watching the timer once the EIGRP_IS_UP is executed!

[Joe Clarke]

So you want the email in EIGRP_IS_DOWN to be sent only after an hour has passed with EIGRP being down?

[danailpetrov]

Every hour after EIGRP_IS_DOWN is executed...

[danailpetrov]

Meanwhile I can share my thoughts with EEM version 3. My idea was to using a `set` action and set some variable - let's say "${VAR1}". Once the EIGRP_IS_DOWN is executed, the ${VAR1} variable is set to 1. Meanwhile a second applet - watchdog to check every 5 minutes for this variable and incrementing ${VAR1} 1 value with 1. Once the ${VAR1} reaches count of 12 - send an email and set it back to 1 (${VAR1} is reinitialized with 1) and so on. Once the EIGRP_IS_UP is executed this ${VAR1} is deleted and no more counting is required. Maybe this is possible using TCL, but I'm not so familiar with it.

Kind regards,

Dani Petrov

[Joe Clarke · Accepted solution]

These should work for you:

event manager environment quote "

event manager applet EIGRP_IS_DOWN

event syslog pattern "DUAL-5-NBRCHANGE:.*Tunnel0.*down"

action 1.0 info type routername

action 2.0 cli command "enable"

action 2.1 cli command "configure terminal"

action 2.2 cli command "interface BRI0/0"

action 2.3 cli command "no shut"

action 2.4 cli command "event manager applet EIGRP_WATCHDOG"

action 2.5 cli command "event timer watchdog time 3600"

action 2.6 cli command "action 1.0 mail server $quote 172.16.31.9$quote to $quote isdn@mydomain.com$quote from $quote $_info_routername@mydomain.com$quote subject $quote Primary link went down: $_info_routername$quote body $quote Router works on ISDN$quote"

action 2.7 cli command "action 2.0 syslog msg $quote Email was sent to notify for this outage!$quote"

action 2.8 cli command "end"

event manager applet EIGRP_IS_UP

event syslog pattern "DUAL-5-NBRCHANGE:.*Tunnel0.*up"

action 1.0 info type routername

action 2.0 cli command "enable"

action 2.1 cli command "configure terminal"

action 2.2 cli command "interface BRI0/0"

action 2.3 cli command "shutdown"

action 2.4 cli command "no event manager applet EIGRP_WATCHDOG"

action 2.5 cli command "end"

action 3.0 syslog msg "We are shutting BRI interface as long as primary link is working fine"

action 5.0 mail server "172.16.31.9" to "isdn@mydomain.com" from "$_info_routername@mydomain.com" subject "Primary link became available: $_info_routername" body "Primary link became active! ISDN is now administratively down!"

[danailpetrov]

I've also thought to make it this way, but I decided that isn't so clear and tried to find another way ;-)

Thank you for your time and willing to share your experience with me!

P.s. Can you provide me with a good documentation regarding TCL and EEM scripting in Cisco's IOS?

Thank you once again!

Kind regards,

Dani Petrov

[Joe Clarke]

Even with Tcl, you would need multiple policies like this to accomplish what you want. EEM 3.0 and higher would be much nicer as you could use a timer subscriber policy which could be configured at all times. The EIGRP down policy could arm the timer, and the EIGRP up policy could cancel it. It would look a lot cleaner, but it would require Tcl.

More on programming EEM with Tcl can be found at:

https://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_eem_policy_tcl_ps6441_TSD_Products_Configuration_Guide_Chapter.html

[danailpetrov]

Yes, you're right. As I said, it's quite easy with EEM 3.x but here we should find an other way (like this one)

Thank you for your time!

Kind regards,

Dani Petrov

[patrick.taylor]

Hi JC,

was reading through this and have a need for a similar config so was thinking I could take this and revamp mine. My question is you are bringing up a EIGRP_Watchdog appelate but there is none defined. not sure how its supposed to work.

[Joe Clarke]

EIGRP_IS_DOWN defines the EIGRP_Watchdog applet.