Showing results for 
Search instead for 
Did you mean: 

Script to Determine When Routes Removed from Table

Hello Community,

Can someone please help me compile a script that will alert me when routes have vanished from the a routing table?



John Blakley


This one is a little easier

You could track the route with tracking and then create an event based on that. If you were watching route, you could do something like the following:

track 1 ip route reachability

event manager applet RouteIsGone

     event track 1 state down

*** Below is the mail you could send if you wanted to be alerted via email ***

action 1.0 cli command "enable"

action 2.0 mail server "" to "" from "" subject "Route is down" body "Route is down."

The above is very brutal but gets the job done. I found another post from Joseph that gives a couple of other solutions.


*** Please rate all useful posts ***

HTH, John *** Please rate all useful posts ***

You can use the routing event detector for that:

event manager applet ROUTES-ALERT

event routing network type all protocol all le 24

action 1.0 syslog msg "Network $_routing_network Mask $_routing_mask Using $_routing_protocol: $_routing_type"

Other parameters available:








You can see all the variables populated by an event detector by looking at this command:

show event manager detector routing detailed


I've been curious....where can I get a listing of the variables that Cisco has? Like the others you posted: $_routing_xxx

HTH, John *** Please rate all useful posts ***

There is a bunch of global ones which are in the general docs:

For some of the event detectors the easiest way would be to use a show command on the router:

"show event manager detector detailed"

Thank you!


*** Please rate all useful posts ***

HTH, John *** Please rate all useful posts ***


I have just glanced over the responses and can't thank you enough for you're replies. I have just got home, so not had time to view the replies in detail.

I will review the responses and let you know how I've got on.

Thanks again, gents.....

Joe Clarke
Hall of Fame Cisco Employee

Take a look at "show event manager detector DETECTOR detail" for all of the ED variables.  For the action variables, I created this doc to spell them all out:


I tried to apply your EEM but the device is 3600 and there isn't an IOS available to allow me to run any EEM other than 2.1.

I'm very surprised I can't download an IOS such as 12.4(22)T for 3600's to enable me take advantage of the benefits of EEM 3.0? Can someone explain why that is?


Well, the 3600 routers hit the last day of support milestone in 2008.

Cisco stopped selling them in 2003.

This is the EOL announcement:


Would you happen to if I can load IOS 12.4(22)T on 2691 or any of the 2600's?


If the image fits the flash and loads without crashing, then you are fine for lab and playing around scenarios.

I would not recommend running offically unsupposrted images as you would not be able to get official support

Joe Clarke
Hall of Fame Cisco Employee

As Arie previously pointed out, these are very old devices.  They don't have the memory for such new images.  The 2691 can only run up to 12.4(15)T, so that gives you EEM 2.3.  The same goes for all the 2600 series.  If you want EEM 3.0, you will need to move to an ISR router (e.g., 1800 or 2800).


Its great knowing that I can get EEM 2.3 on 2691 with 12.4(15)T, however I'm sure I tried in the past and I was only able to get EEM 2.1 even with 12.4(15)T - I will try again....


Joe Clarke
Hall of Fame Cisco Employee

Yes, 12.4(15)T contains EEM 2.3.  The differences between 2.1 and 2.3 are small, though.  You get the "pattern" keyword on CLI actions for applets, the track event detector, the resource (ERM) ED, and the RF ED.

Content for Community-Ad