Syslogging routing table updates

[ckeithjones]

I have a stable network that rarely has any routing changes. I would like any routing table updates to be sent to a logging server or possibly generate a trap so I am aware of the changes. Currently I use a Debug ip routing command and get the output sent. Is there another way to accomplish this without using the debug command?

Keith

[Joe Clarke]

This will depend on your version of IOS.  Newer versions of IOS include the Embedded Event Manager version 3.0.  This version of EEM includes a route table event detector that can be used to spot routing updates.  You can try something like this:

event manager applet routing-changes
 event routing type all network 0.0.0.0/0 ge 1
 action 1.0 syslog msg "Routing table changed; Type: $_routing_type, Network: $_routing_network, Mask: $_routing_mask, Protocol: $_routing_protocol, Gateway: $_routing_lastgateway, Interface: $_routing_lastinterface"

[ckeithjones]

That's exactly what I need however on our Catalyst 6500 switches it appears the "routing" event is not an option. Is there another workaround for this or is it possibly just a limitation of our IOS ((s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(33)SXH8a)?

Keith

[Joe Clarke · Accepted solution]

Unfortunately, the routing event detector is only available in EEM 3.0 and higher.  This is only available on the new Sup 2T for the Cat6500.  Prior to that ED, you would need to periodically scan the routing table, look for differences, and notify on the differences.  Depending on the size of the routing table, this could be very CPU intensive.