OSPF Dead Timer Expiration Trap

[WMA Hell]

Hi

Once a month I have my OSPF hello packets eaten by the router or upstream ISP prompting dead timer expiration, which is set for 8 seconds instead of the default of 40 seconds. This upstream ISP has a 8 second acceptable outage written into the signed SLA. This impacts our VoIP and Video services. I would like to create a trap that catches that specific error message as our buffered sys log is filled up with silly SSH authentication notifications. 

Note: We have SolarWinds setup. 

Note: I am not changing the timers as they are on NHRP DMVPN and there not static routes to keep the tunnel up when OSPF parameters are changed, which isolates my branch sites. 

So, how do I alert on OSPF dead timer expiration and create a trap for a network monitoring tool to capture. Do I need to use NetFlow or EEM? Our SolarWinds has a Netflow snapin. 

[Ramblin Tech · Accepted solution]

One possible solution (I am sure there are many others)... use XE's Embedded Syslog Manager to match on the dead-timer messages. You could then either send them to an alternate syslog collector or escalate the severity level and send to the same collector where you could filter on the escalated sev level. I am, of course, assuming your router is using XE, but other NOSes may have similar utilities.