Script to Determine When Routes Removed from Table

[Carlton Patterson]

Hello Community,

Can someone please help me compile a script that will alert me when routes have vanished from the a routing table?

Cheers

Carlton

[John Blakley]

Carlton,

This one is a little easier

You could track the route with tracking and then create an event based on that. If you were watching route 10.10.10.0/24, you could do something like the following:

track 1 ip route 10.10.10.0 255.255.255.0 reachability

event manager applet RouteIsGone

     event track 1 state down

*** Below is the mail you could send if you wanted to be alerted via email ***

action 1.0 cli command "enable"

action 2.0 mail server "" to "user@somewhere.com" from "anotherUser@somewhere.com" subject "Route is down" body "Route is down."

The above is very brutal but gets the job done. I found another post from Joseph that gives a couple of other solutions.

https://supportforums.cisco.com/thread/2122275

HTH,
John

*** Please rate all useful posts ***

[avayner]

You can use the routing event detector for that:

event manager applet ROUTES-ALERT

event routing network 10.0.0.0/8 type all protocol all le 24

action 1.0 syslog msg "Network $_routing_network Mask $_routing_mask Using $_routing_protocol: $_routing_type"

Other parameters available:

        $_routing_lastgateway

        $_routing_distance

        $_routing_time

        $_routing_time_sec

        $_routing_time_msec

        $_routing_metric

        $_routing_lastinterface

You can see all the variables populated by an event detector by looking at this command:

show event manager detector routing detailed

[John Blakley]

Arie,

I've been curious....where can I get a listing of the variables that Cisco has? Like the others you posted: $_routing_xxx

[avayner]

There is a bunch of global ones which are in the general docs:

http://www.cisco.com/en/US/docs/ios-xml/ios/eem/configuration/15-1mt/eem-policy-cli.html#GUID-48CB6E8C-F456-4398-8B66-CC499331CB49

For some of the event detectors the easiest way would be to use a show command on the router:

"show event manager detector detailed"

[John Blakley]

Thank you!

HTH,
John

*** Please rate all useful posts ***

[Carlton Patterson]

Chaps,

I have just glanced over the responses and can't thank you enough for you're replies. I have just got home, so not had time to view the replies in detail.

I will review the responses and let you know how I've got on.

Thanks again, gents.....

[Joe Clarke]

Take a look at "show event manager detector DETECTOR detail" for all of the ED variables.  For the action variables, I created this doc to spell them all out:

https://supportforums.cisco.com/docs/DOC-24901

[Carlton Patterson]

Arie,

I tried to apply your EEM but the device is 3600 and there isn't an IOS available to allow me to run any EEM other than 2.1.

I'm very surprised I can't download an IOS such as 12.4(22)T for 3600's to enable me take advantage of the benefits of EEM 3.0? Can someone explain why that is?

Cheers

[avayner]

Well, the 3600 routers hit the last day of support milestone in 2008.

Cisco stopped selling them in 2003.

This is the EOL announcement:

http://www.cisco.com/en/US/prod/collateral/routers/ps274/prod_end-of-life_notice09186a0080184884.html

[Carlton Patterson]

Arie,

Would you happen to if I can load IOS 12.4(22)T on 2691 or any of the 2600's?

Cheers

[avayner]

If the image fits the flash and loads without crashing, then you are fine for lab and playing around scenarios.

I would not recommend running offically unsupposrted images as you would not be able to get official support

[Joe Clarke]

As Arie previously pointed out, these are very old devices.  They don't have the memory for such new images.  The 2691 can only run up to 12.4(15)T, so that gives you EEM 2.3.  The same goes for all the 2600 series.  If you want EEM 3.0, you will need to move to an ISR router (e.g., 1800 or 2800).

[Carlton Patterson]

Joseph,

Its great knowing that I can get EEM 2.3 on 2691 with 12.4(15)T, however I'm sure I tried in the past and I was only able to get EEM 2.1 even with 12.4(15)T - I will try again....

Cheers

[Joe Clarke]

Yes, 12.4(15)T contains EEM 2.3.  The differences between 2.1 and 2.3 are small, though.  You get the "pattern" keyword on CLI actions for applets, the track event detector, the resource (ERM) ED, and the RF ED.