I need some support if you can help me
We enabled IPSLA icmp echo operation to measure the RTT values between the sites. the goal is to trigger the alarm when the RTT exceeds the set threshold. Currently, the frequency of the IPSLA operation set to 5mins and because of this when the threshold violation condition appears in the system, we will have to wait for the next operation to run to see of the condition is still appear in the system. in other words, the RTT is exceeds the threshold just for a sec or two when this test runs, the ipsla status shows over threshold.
What we are trying
1. We would like to trigger the another operation or kind of reaction trigger to run the IPSLA operation again to see if the RTT value back to normal rather than waiting next 5mins
2. We can use the EEM script as well if that is solution but i don't anything that can detect RTT condition using event manager. This is what i am seeing in my router
hostname(config)#ip sla ?
<1-2147483647> Entry Number
enable Enable Event Notifications
endpoint-list Endpoint list configuration
ethernet-monitor IP SLAs Auto Ethernet Configuration
group Group Configuration or Group Scheduling
key-chain Use MD5 Authentication for IP SLAs Control Messages
logging Enable Syslog
low-memory Configure Low Water Memory Mark
reaction-configuration IP SLAs Reaction-Configuration
reaction-trigger IP SLAs Trigger Assignment
reset IP SLAs Reset
responder Enable IP SLAs Responder
restart Restart An Active Entry
schedule Entry Scheduling
server IPPM server configuration
Here is the config that I am running in my Router:
track 10 ip sla 10 reachability
ip sla 10
icmp-echo X.X.X.X source-ip X.X.X.X
owner TELX-Mt.Holly round-trip detection DST: X.X.X.X
ip sla schedule 10 life forever start-time now
here is the system and running version.
ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.3(3)S3, RELEASE SOFTWARE (fc1)
This would be really help if you can provide me some guidance.
You could have EEM configure another operation when it detects the first one has transitioned. In addition to configuring the other operation, you can confirm another, transient EEM policy to watch that other operation. This seems rather complex, and I'm wondering if another threshold type wouldn't suit you better. You could do "consecutive" or "x-of-y" instead of an immediate threshold. Yes, you would have to wait for multiple full polling cycles, but it may reduce your false positives.
Another though, since you're using ICMP, is to have EEM react to the immediate threshold violation, and then run a ping command directly to see if the problem still exists. If it does, then have the EEM policy send a syslog, trap, email, etc. It wouldn't be two IP SLA operations, but it should achieve the same result.