Michael modified one of my EEM applets to monitor CRC errors on WAN interfaces and notify the operator (via e-mail) when an interface has more than two errors per minute. He wanted to monitor multiple interfaces and asked me whether it’s possible to modify the SNMP event detector somehow. I only had to point him to the event correlation feature of EEM version 2.4 and he sent me the following (tested) applet a few days later.
event manager environment _email_server 10.10.10.10 event manager environment _email_to lan_admin@example.com event manager environment _info_routername Router ! event manager applet multiple_if event tag if_1 interface name Serial0/0/0 parameter input_errors_crc → entry-op ge entry-val 2 entry-type increment poll-interval 60 event tag if_2 interface name Serial0/0/1 parameter input_errors_crc → entry-op ge entry-val 2 entry-type increment poll-interval 60 event tag if_3 interface name Serial0/0/2 parameter input_errors_crc → entry-op ge entry-val 2 entry-type increment poll-interval 60 event tag if_4 interface name Serial0/0/3 parameter input_errors_crc → entry-op ge entry-val 2 entry-type increment poll-interval 60 event tag if_5 interface name Serial0/1/0 parameter input_errors_crc → entry-op ge entry-val 2 entry-type increment poll-interval 60 event tag if_6 interface name Serial0/1/1 parameter input_errors_crc → entry-op ge entry-val 2 entry-type increment poll-interval 60 trigger correlate event if_1 or event if_2 or event if_3 or event if_4 or → event if_5 or event if_6 action 1.0 syslog msg "CRC failure leased line $_interface_name" action 2.0 mail server "$_email_server" to "$_email_to" → from "$_info_routername@example.com" → subject "CRC problems on $_info_routername interface $_interface_name" → body "CRC failures have exceeded the threshold"
Great job and thanks for sharing, Michael!

Hi Ivan,
ReplyDeleteI'm writing an EEM script and I would like to know, is it possible to catch and store some "non-interactive" output in EEM, such as, ping output?
Regards,
Zoey
Search my blog and wiki.nil.com for "action cli"
ReplyDeleteAm using 6504 cisco Multilayer switch and would like to monitor all the interfaces on the each modules , as all connected to critical devices , in case for example Xmit-Err Rcv-Err counter exceed 2 error in 1 minutes to alerts me , do i need to do CLI for each interface , but its 48 port per module , I have 3 module which will be too much ,
ReplyDeleteplease advice . Thanks
You could also write your own Tcl policy, use an external agent to poll the 6504 (SolarWinds should be able to do something simple like what you need), or use RMON MIB.
Deletehttp://www.cisco.com/en/US/tech/tk961/technologies_configuration_example09186a0080094478.shtml