Multiple Tracked States in EEM

[Carlton Patterson]

Hello Community,

Sorry for the confusing heading...

I'm trying to establish if its possible to have a EEM or Tcl that can monitor multiple tracking states and send an email and syslog alert depending on the state of a tracked state. I took the following EEM as demonstration of what I mean:

event manager applet S1 Firewall ISP interfaces
event tag SLA1 track 1 state down
event tag SLA2 track 2 state down
event tag SLA3 track 3 state down

track 1 ip sla 1 reachability

track 2 ip sla 2 reachability
track 3 ip sla 3 reachability

ip sla 1
icmp-echo 2.2.2.1 source-ip 10.10.10.10
frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 3.3.3.1 source-ip 10.10.10.10
frequency 5
ip sla schedule 2 life forever start-time now
ip sla 3
icmp-echo 4.4.4.1 source-ip 10.10.10.10
frequency 5

So in the above I would an seperate alert should any of the tracked states went down.

Is that possible?

Cheers

Carlton

[Joe Clarke]

This applet will work.  You just need to correlate your events and generate your action:

trigger

correlate event SLA1 or event SLA2 or event SLA3

action 1.0 syslog msg "Track $_track_number is down"

[Carlton Patterson]

Joseph,

If I can get this work I'll buy you a beer if you should ever come to London :-)

Cheers

Sent from Cisco Technical Support iPad App

[GSCiscoSP]

Joseph,

Is there a doc that explains all the conditional/programming comands that can be used with eventmanager?

I'm needing to do something simular with multiple sla's and a nested If statement like

IF IPsla 1 occured THEN

    IF IPsla 2 occured THEN

        cli command xyz

        IF command result = x THEN

           cli command a

        Else

           cli command b

     Else

        cli command c

     End If

End if

[Carlton Patterson]

Hi Shannon,

It will interesting if your nested statements work.

Lets see what Joseph thinks

[Joe Clarke]

Sure, you could do this by using $_track_number to represent your IPSla X notation.  The command results can be processed with regexp.  For example:

regexp "pattern" $_cli_result

if $_regexp_result eq 1

! Do something

[GSCiscoSP]

I'm not following how that would tie to my SLA's in a nested syntax, so I decided to try setting a varible with the first two if states, and then compare the value of the varible with the third..

My Issue now is how to get the third If statement to inspect my varible named Route below?

My applet..

event manager applet CheckPrivateRoute_z1

event track 2 state any

action 1.2 set Route "none"

action 2.1 syslog msg "PrivateRoute took hit, Checking Route"

action 2.2 cli command "sh ip route | inc 10.xx"

action 2.3 regexp "(.*) (ww\.xx\.yy\.z1) (.*)" "$_cli_result"

action 2.4 if $_regexp_result eq 0

action 2.42 set Route "unknow"

action 2.43 else

action 2.44 set Route "Ok"

action 2.45 syslog msg "PrivateRoute took hit, still on z1"

action 2.46 end

action 2.5 regexp "(.*) (ww\.xx\.yy\.z2) (.*)" "$_cli_result"

action 2.62 if $_regexp_result eq 0

action 2.63 set Route "unknow"

action 2.64 syslog msg "PrivateRoute Route Unknown"

action 2.65 else

action 2.66 set Route "Ok"

action 2.67 syslog msg "PrivateRoute Failed to z2"

action 2.68 end

action 3 if Route eq "unknow"

action 3.2 cli command "ping 10.xx.yy.z source gi0/0.2"

action 3.3 regexp "(*) (Success) (*)" "$_cli_result"

action 3.4 if $_regexp_result eq 1

action 3.42 syslog msg "PrivateRoute Must have failed to DialBackup"

action 3.43 else

action 3.44 syslog msg "PrivateRoute Wrong, Refreshing Routes"

action 3.45 cli command "clear crypto sess remote ww.xx.yy.z1"

action 3.46 cli command "clear crypto sess remote ww.xx.yy.z2"

action 3.47 syslog msg "Routes Rebuilding"

action 3.48 end

action 3.5 end

[Joe Clarke]

Please start a new thread for your question.

[Carlton Patterson]

Hi Joseph,

This does appear to work, see below:

R3#

*Jul 16 22:34:29.191: %TRACKING-5-STATE: 2 ip sla 2 reachability Up->Down

*Jul 16 22:34:29.231: %HA_EM-6-LOG: object: Track 2 is down

*Jul 16 22:34:34.207: %TRACKING-5-STATE: 3 ip sla 3 reachability Up->Down

*Jul 16 22:34:34.231: %HA_EM-6-LOG: object: Track 3 is down

However, I was hoping that I could change the action to something like

action 1.0 syslog msg "Track $_tag is down"

This way, if I called the tag 'windsor' if the the link went down I would get an alert like:

*Jul 16 22:34:34.231: %HA_EM-6-LOG: object: windsor 3 is down

Is that possible?

Cheers

[Carlton Patterson]

Hi Joseph,

Glad to see you're around before I head to bed.

To be honest I don't understand regular expressions. Hence why I was hoping that I could generate a simple syslog message with something like:

action 1.0 syslog msg "Track $_tag is down"

Bu that won't work.

Got any suggestions?

Cheers

[Joe Clarke · Accepted solution]

You can use $_event_tag1 to get the first event triggered.  However, if multiple events occur at the same time, you'd need more logic to show all applicable events.  Such as:

handle-error type ignore

set test $_event_track2

if $_error eq FH_EOK

syslog msg "Track $test is down"

else

exit 0

end

[Carlton Patterson]

Joseph,

That is just what I needed.

Thanks ever-so-much mate.

Cheers