IP SLA rrt threshold not logging to syslog

[gavinspost]

I'm not sure if I have entered this questions into the correct disscusion group

I have created an IP SLA using Jitter-Path for an MPLS link, I have also created a reaction-configuration entry with a threshold of 1 5 for the round trip time(rtt). I have scheduled the IP SLA to run continuously. When I do the 'Show IP SLA 1 Statistics' the rtt does rise above 5ms at times however I never recieve an event in the syslog, actually that's a lie I see one random threshold entry and then nothing, once the IP SLA has reached do I need to schedule a reset or something?. That brings me to my second question, I would like to match the threshold pattern in the syslog and send out an email with the  'Show IP SLA 1 Statistics' results in the body of the email. Any advice would be greatly appreciated.

Thanks in advance

Gavin

[gavinspost]

ok, I eventually worked out what I was doing wrong, the thresholds were incorrectly configured and I didn't understand fully how they worked. I now have another query - I have configured a event manager command to run a cli action and email the results based on a syslog pattern. When I use the follwoing command it works:

event syslog pattern "%RTT-3-IPSLATHRESHOLD"

However I'm going to be running multiple SLAs and I want to send an email out for each one. When I try the following command it fails to match the syslog pattern and the emails doesn't get sent.

event syslog pattern "%RTT-3-IPSLATHRESHOLD: IP SLAs(1): Threshold exceeded for rtt"

Debug

May  4 12:28:28.155: %RTT-3-IPSLATHRESHOLD: IP SLAs(1): Threshold exceeded for rtt
May  4 12:28:28.163: fh_fd_syslog_event_match: num_matches = 0
May  4 12:28:28.163: fh_fd_data_syslog: num_matches = 0

[uranthaci]

Hi gavinspost ,

I had the same issue as you with matching the pattern, you need to use wildcards to escape the brackets as it gets parsed as a command otherwise i think.

Here is how i've done it:

event syslog pattern "%RTT-3-IPSLATHRESHOLD: IP SLAs.*3.*.*Threshold exceeded.*"