Monitor multiple interfaces with a single EEM applet

Michael modified one of my EEM applets to monitor CRC errors on WAN interfaces and notify the operator (via e-mail) when an interface has more than two errors per minute. He wanted to monitor multiple interfaces and asked me whether it’s possible to modify the SNMP event detector somehow. I only had to point him to the event correlation feature of EEM version 2.4 and he sent me the following (tested) applet a few days later.

event manager environment _email_server 10.10.10.10
event manager environment _email_to lan_admin@example.com
event manager environment _info_routername Router
!
event manager applet multiple_if 
 event tag if_1 interface name Serial0/0/0 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_2 interface name Serial0/0/1 parameter input_errors_crc → 
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_3 interface name Serial0/0/2 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_4 interface name Serial0/0/3 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_5 interface name Serial0/1/0 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_6 interface name Serial0/1/1 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 trigger
  correlate event if_1 or event if_2 or event if_3 or event if_4 or →
   event if_5 or event if_6
 action 1.0 syslog msg "CRC failure leased line $_interface_name"
 action 2.0 mail server "$_email_server" to "$_email_to" →
  from "$_info_routername@example.com" →
  subject "CRC problems on $_info_routername interface $_interface_name" →
  body "CRC failures have exceeded the threshold"

Great job and thanks for sharing, Michael!

5 comments:

  1. Hi Ivan,

    I'm writing an EEM script and I would like to know, is it possible to catch and store some "non-interactive" output in EEM, such as, ping output?

    Regards,
    Zoey

    ReplyDelete
  2. Ivan Pepelnjak24 August, 2011 20:33

    Search my blog and wiki.nil.com for "action cli"

    ReplyDelete
  3. Am using 6504 cisco Multilayer switch and would like to monitor all the interfaces on the each modules , as all connected to critical devices , in case for example Xmit-Err Rcv-Err counter exceed 2 error in 1 minutes to alerts me , do i need to do CLI for each interface , but its 48 port per module , I have 3 module which will be too much ,

    please advice . Thanks

    ReplyDelete
    Replies
    1. You could also write your own Tcl policy, use an external agent to poll the 6504 (SolarWinds should be able to do something simple like what you need), or use RMON MIB.

      http://www.cisco.com/en/US/tech/tk961/technologies_configuration_example09186a0080094478.shtml

      Delete
  4. Frank Wetzels02 July, 2013 10:21

    All,

    Where can I find detailed information on what parameters like 'entry-type increment' exactly do? Does it mean that it 'watches' the CRC errors and after an increment of some value an e-mail is issued?

    ReplyDelete

You don't have to log in to post a comment, but please do provide your real name/URL. Anonymous comments might get deleted.

Ivan Pepelnjak, CCIE#1354, is the chief technology advisor for NIL Data Communications. He has been designing and implementing large-scale data communications networks as well as teaching and writing books about advanced technologies since 1990. See his full profile, contact him or follow @ioshints on Twitter.