Hello,
Wondering if you can help me here.
I have a DMVPN tunnel that flaps occasionally on the remote end, and a 'clear crypto sa' on the remote fixes it, looking a the logs on the remote, its always the same error message received -
%DUAL-5-NBRCHANGE: EIGRP-IPv4 60: Neighbor 192.168.201.254 (Tunnel3) is down: holding time expired
I have created an Event applet to run the 'clear crypto sa' command if this syslog message is seen, but I cannot get it to trigger.
My Event manager applet is as follows -
event manager applet Tunnel3Down
event syslog pattern ".*EIGRP-IPv4 60.*"
action 1.0 cli command "enable"
action 2.0 cli command "clear crypto sa"
action 3.0 syslog msg "Tunnel 3 is down, clearing crypto isakmp"
I tried with the full sting that is displayed in the syslog as my syslog pattern but that did not work so I then trimmed down the pattern and included wildcards of .* at beginning and end to try and catch it, but that is also not triggering,
I've just had the syslog message occur and there is no sign of the Event Manager Applet triggering (or I would see the Tunnel 3 is down lessage
000854: Oct 26 08:11:22.489 PCTime: %DUAL-5-NBRCHANGE: EIGRP-IPv4 55: Neighbor 192.168.205.254 (Tunnel2) is down: holding time expired
000855: Oct 26 08:12:26.405 PCTime: %DUAL-5-NBRCHANGE: EIGRP-IPv4 60: Neighbor 192.168.201.254 (Tunnel3) is down: holding time expired
000856: Oct 26 08:13:04.545 PCTime: %DUAL-5-NBRCHANGE: EIGRP-IPv4 55: Neighbor 192.168.205.254 (Tunnel2) is up: new adjacency
000857: Oct 26 08:14:34.901 PCTime: %DUAL-5-NBRCHANGE: EIGRP-IPv4 60: Neighbor 192.168.201.254 (Tunnel3) is up: new adjacency
Can anyone advise what I am doing wrong? its driving me crazy.
Just to add its on a Cisco 1921 -
Version 15.4(3)M3, RELEASE SOFTWARE (fc2)
Thanks in advance.
