cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1439
Views
0
Helpful
6
Replies

IP SLA unexpected result

Bob Greer
Level 4
Level 4

Hi there,

Thanks for reading!

 

I'm looking to track an ISPs availability so that I'm the first to know they're having issues.  Here's my SLA configs:

 

ip sla 8888
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0/0
 timeout 8000
 frequency 10
ip sla schedule 8888 life forever start-time now
ip sla reaction-configuration 20 react timeout action-type trapOnly
ip sla reaction-configuration 8888 react rtt threshold-value 19 17 threshold-type immediate action-type trapAndTrigger
ip sla logging traps
ip sla enable reaction-alerts
logging host 10.150.2.192

 

track 8 ip sla 8888 reachability
 default-state up

 

ip route 8.8.8.8 255.255.255.255 GigabitEthernet0/0/0 name COX_VPN_TEST

 

The 8.8.8.8 IP answers pings.  My logging server isn't getting alerts but is reachable from the router.  Once the SLA fires, I want it to return to a state of ready-to-fire again.  Not sure which timeout/threshold I need to adjust for a return to OK state and also unsure why the logging server isn't getting traps.

 

Thanks again for reading!

Bob

1 Accepted Solution

Accepted Solutions

Hi guys,

 

Thanks again for writing.

 

The fix is in: my problem was described here:

Notifications are not issued for every occurrence of a threshold violation. The figure below illustrates the sequence for a triggered reaction that occurs when the monitored element exceeds the upper threshold. An event is sent and a notification is issued when the rising threshold is exceeded for the first time. Subsequent threshold-exceeded notifications are issued only after the monitored value falls below the falling threshold before exceeding the rising threshold again .

 

My testing circuit has been performing steadily (round-trip min/avg/max = 18/19/34 ms) so my configuration was too forgiving and the SLA was never falling below the lower threshold.

ip sla reaction-configuration 8888 react rtt threshold-value 18 17 threshold-type immediate action-type trapOnly

 

Once I changed the threshold-values to 20 19, I started seeing the alerts arriving in the manner I was expecting: frequently.

 

Thanks again for weighing in!

Bob

View solution in original post

6 Replies 6

Francesco Molino
VIP Alumni
VIP Alumni
Hi

Just to be sure, you want to know how to get traps when status is up ?
Ip sla will generate traps when your rtt threshold is reached.

Also what do you mean by logging server? Are you talking about syslog kind server? If so, it won't because the command ip sla monitor logging traps is to send snmp trap.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

Hi Francisco,

 

Thanks for writing.

 

Yes, it's a syslog server.  What I'm looking for is to get an alert when my ISP circuit goes down but I don't want a one-and-done alert.  I need to get a message each time the SLA ping fails.

 

My router is running IOS XE 15.5.  I'm not finding an ip sla logging monitor or ip sla monitor logging commands.  Logging monitor also goes in another direction.

 

Thanks again for writing!

Bob

Threshold violation are generating syslog level 6 messages. What config do you have for syslog? What type of messages are you forwarding to your syslog server?

 

When a violation occurs, a message is sent and following violations don't generate any messages. After the ip sla is back up and a violation occurs again, a new message is sent.

 

The logging conf is intended for snmp. What type of syslog do you have? I'm asking this question because some of them can receive syslog and snmp traps.

 

If you want to get syslog messages every x minutes when an ip sla is down, you have no choice than creating a EEM or TCL script for checking ip sla status and keep generating syslog messages. This script has to run frequently, every x minutes depending on your expectations.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

Hello Bob,

 

do you see something similar to the line below at all ?

 

*Jun 20 08:15:00.329: %RTT-3-IPSLATHRESHOLD: IP SLAs(8888): Threshold exceeded for rtt

 

What do you use as syslog server ?

 

The line:

 

ip sla reaction-configuration 20 react timeout action-type trapOnly

 

looks odd...change that to:

 

ip sla reaction-configuration 8888 react timeout action-type trapOnly

Hi Georg,

Thank you for writing also!

 

You are correct about the #20 reference.  That command is unrelated to the sla in question.  I've since added this line for reaction alert configuration:

ip sla reaction-configuration 8888 react rtt threshold-value 18 17 threshold-type immediate action-type trapOnly

 

With my strict upper-limit/lower-limit of 18ms & 17ms, I'm not getting the expected below threshold/exceeded threshold for testing.  I only have one logged down/up and my configuration isn't sending to my syslog server.

 

Jun 20 16:54:01.275: %RTT-3-IPSLATHRESHOLD: IP SLAs(8888): Threshold below for rtt
Jun 20 16:54:51.275: %RTT-3-IPSLATHRESHOLD: IP SLAs(8888): Threshold exceeded for rtt

Hi guys,

 

Thanks again for writing.

 

The fix is in: my problem was described here:

Notifications are not issued for every occurrence of a threshold violation. The figure below illustrates the sequence for a triggered reaction that occurs when the monitored element exceeds the upper threshold. An event is sent and a notification is issued when the rising threshold is exceeded for the first time. Subsequent threshold-exceeded notifications are issued only after the monitored value falls below the falling threshold before exceeding the rising threshold again .

 

My testing circuit has been performing steadily (round-trip min/avg/max = 18/19/34 ms) so my configuration was too forgiving and the SLA was never falling below the lower threshold.

ip sla reaction-configuration 8888 react rtt threshold-value 18 17 threshold-type immediate action-type trapOnly

 

Once I changed the threshold-values to 20 19, I started seeing the alerts arriving in the manner I was expecting: frequently.

 

Thanks again for weighing in!

Bob

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco