IPSLA ICMP-Echo operation and react trigger

[anil87babu]

Hello All,

I need some support if you can help me

Situation:

We enabled IPSLA icmp echo operation to measure the RTT values between the sites. the goal is to trigger the alarm when the RTT exceeds the set threshold. Currently, the frequency of the IPSLA operation set to 5mins and because of this when the threshold violation condition appears in the system, we will have to wait for the next operation to run to see of the condition is still appear in the system. in other words, the RTT is exceeds the threshold just for a sec or two when this test runs, the ipsla status shows over threshold. 

What we are trying

1. We would like to trigger the another operation or kind of reaction trigger to run the IPSLA operation again to see if the RTT value back to normal rather than waiting next 5mins

2. We can use the EEM script as well if that is solution but i don't anything that can detect RTT condition using event manager. This is what i am seeing in my router

hostname(config)#ip sla ?
<1-2147483647>          Entry Number
enable                            Enable Event Notifications
endpoint-list                Endpoint list configuration
ethernet-monitor         IP SLAs Auto Ethernet Configuration
group                          Group Configuration or Group Scheduling
key-chain                     Use MD5 Authentication for IP SLAs Control Messages
logging                         Enable Syslog
low-memory                 Configure Low Water Memory Mark
reaction-configuration     IP SLAs Reaction-Configuration
reaction-trigger               IP SLAs Trigger Assignment
reset                                IP SLAs Reset
responder                        Enable IP SLAs Responder
restart                             Restart An Active Entry
schedule                         Entry Scheduling
server                              IPPM server configuration

Here is the config that I am running in my Router:

track 10 ip sla 10 reachability

ip sla 10
icmp-echo X.X.X.X source-ip X.X.X.X
request-data-size 1400
owner TELX-Mt.Holly round-trip detection DST: X.X.X.X
frequency 300
timeout 10000
threshold 125
ip sla schedule 10 life forever start-time now

here is the system and running version.

ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.3(3)S3, RELEASE SOFTWARE (fc1)

This would be really help if you can provide me some guidance.

[Joe Clarke]

You could have EEM configure another operation when it detects the first one has transitioned.  In addition to configuring the other operation, you can confirm another, transient EEM policy to watch that other operation.  This seems rather complex, and I'm wondering if another threshold type wouldn't suit you better.  You could do "consecutive" or "x-of-y" instead of an immediate threshold.  Yes, you would have to wait for multiple full polling cycles, but it may reduce your false positives.

Another though, since you're using ICMP, is to have EEM react to the immediate threshold violation, and then run a ping command directly to see if the problem still exists.  If it does, then have the EEM policy send a syslog, trap, email, etc.  It wouldn't be two IP SLA operations, but it should achieve the same result.