Cisco IOS tips and tricks had a great post on how to use EEM to send emails when interfaces go down.
”
John S. Pumphrey recently asked an interesting question: “Can the router send an e-mail when an interface goes down?” The enterprisey solution is obvious: deploy a high-end EMS to collect SNMP traps and use its API to write a custom module that would use a MQ interface to alert the operator. Fortunately, Event Manager applets in Cisco IOS provide action mail command (available in 12.3(14)T and 12.4) that can send an e-mail to a SMTP server straight from the router.
There are two ways you can detect that an interface went down with EEM: either you track the interface status with a track object and start an EEM applet when the track object changes state or you catch the syslog messages reporting that the interface line protocol changed state to down. The second approach is obviously more generic, as a single applet can act on multiple interfaces.
event manager applet MailOnIfDown event syslog occurs 1 → pattern "LINEPROTO-5-UPDOWN.*to down" → period 1
Notes:
- If you want to limit the applet to serial interfaces only, you could change the pattern to LINEPROTO-5-UPDOWN.*Serial.*to down.
- The → continuation character is used to indicate that a single configuration line has been split to increase readability.
The action mail command specifies the mail server‘s address (use a hostname and DNS lookup or ip host configuration command to make the EEM applet more generic), from and to address, message subject and body. In each of these fields, you can use EEM environment variables that you can define with the event manager environment configuration command. Each EEM event also defines a few environment variables that you can use (see the table of EEM system-defined variables on CCO). For example, you can define the e-mail recipient in the router’s configuration and use the _syslog_msg variable to include the syslog message in the e-mail body:
event manager environment _ifDown_rcpt admin@lab.com!event manager applet MailOnIfDown event syslog occurs 1 → pattern "LINEPROTO-5-UPDOWN.*to down" → period 1 action 1.0 mail server "mail-gw" → to "$_ifDown_rcpt" from "R1@lab.com" → subject "Interface down on R1" → body "$_syslog_msg"
You can make the applet even more generic with the help of action info type routername command, which stores the current router’s name into the $_info_routername environment variable:
event manager environment _ifDown_rcpt admin@lab.com!event manager applet MailOnIfDown event syslog occurs 1 → pattern "LINEPROTO-5-UPDOWN.*to down" → period 1 action 1.0 info type routername action 2.0 mail server "mail-gw" → to "$_ifDown_rcpt" from "$_info_routername@lab.com" → subject "Interface down on $_info_routername" → body "$_syslog_msg"
"
http://www.2cups.com
“The difficult we do immediately, the impossible just takes a little longer.”
Similar Posts:
- Zone based IOS firewalls
- What should I do this thanksgiving break?
- Cool new features in 12.2(33)SXH
- Application Extension API notes – Cisco Live 2008
- Interesting TechWise TV episode on virtualization
- Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It
No Comments so far ↓
There are no comments yet...Kick things off by filling out the form below.