how to make a script to cellular connection problem

[Josiah Inubio]

The problem i'm encountering is  that the cellular interface is UP but as of "sh cell 0/2/0 rad" the  radio is off. That data is captured today. How am i going to do EEM  script for this one? The recent event i'm getting is "Apr 25  11:17:49.881 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/2 is DOWN"  .

Interface                    IP-Address       OK? Method Status           Protocol

Cellular0/2/0              10.49.180.173   YES IPCP     up                    up

PHILAM-SJA-BR01#sh cell 0/2/0 rad

Radio power mode = OFF, Reason = Unknown

Current Band = None, Channel Number = 0

Current RSSI = -0 dBm

Band Selected = not selected due to invalid band mask

Logs

Apr 24 07:39:56.884 MNL: %LINK-5-CHANGED: Interface Cellular0/2/0, changed state

to reset

Apr 24 07:40:01.884 MNL: %LINK-3-UPDOWN: Interface Cellular0/2/0, changed state

to down

Apr 24 07:40:10.516 MNL: %CELLWAN-2-MODEM_UP: Modem in HWIC slot 0/2 is now UP

Apr 24 07:40:15.896 MNL: %LINK-3-UPDOWN: Interface Cellular0/2/0, changed state

to up

Apr 25 11:17:49.881 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/2 is DOWN

[Joe Clarke]

It's very easy to react to this syslog message.  What do you want to do when you see this problem, though?

[Josiah Inubio]

is it possible to do 2 scripts on each syslog message like as stated below? or it can do it on a single script?

1. Apr 24 07:40:01.884 MNL: %LINK-3-UPDOWN: Interface Cellular0/2/0, changed state

to down

2. Apr 25 11:17:49.881 MNL: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/2 is DOWN

[Joe Clarke · Accepted solution]

You can do it using two applets or, if you are running EEM 2.4 or higher, do it with one multi-event applet.  If you use multi-events, you need at least EEM 3.0 if you want to add conditional logic.  If you want each syslog to cause the same events to happen, then you only need EEM 2.4.  To do things in two applets, any version of EEM 2.x will work.

[Josiah Inubio]

How to identify which version of EEM I have?

My router is

CISCO2911-SEC/K9    Cisco 2911 Security Bundle w/SEC license PAK

S29UK9-15104M    Cisco 2901-2921 IOS UNIVERSAL

Is there some guidelines on how to do multi-events? or to add conditional logic?

[Josiah Inubio]

Here it is btw, is it ok?

[Joe Clarke]

You have 3.2, so you can do multi-event applets:

event tag syslog1 syslog pattern "LINK-3-UPDOWN: Interface Cellular0/2/0, changed state to down"

event tag syslog2 syslog pattern "CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/2 is DOWN"

trigger

correlate event syslog1 or event syslog2

[Josiah Inubio]

For this case, how can i do multi-event applets? Its different from default format on the commands.

[Joe Clarke]

I don't understand what you're asking.  I already provided you the sample event config for multiple events.  If you replace your current "event syslog" config with what I posted previously, that will give you one policy that supports multiple events.