Monitor multiple interfaces with a single EEM applet

Michael modified one of my EEM applets to monitor CRC errors on WAN interfaces and notify the operator (via e-mail) when an interface has more than two errors per minute. He wanted to monitor multiple interfaces and asked me whether it’s possible to modify the SNMP event detector somehow. I only had to point him to the event correlation feature of EEM version 2.4 and he sent me the following (tested) applet a few days later.

event manager environment _email_server 10.10.10.10
event manager environment _email_to [email protected]
event manager environment _info_routername Router
!
event manager applet multiple_if
event tag if_1 interface name Serial0/0/0 parameter input_errors_crc →
entry-op ge entry-val 2 entry-type increment poll-interval 60
event tag if_2 interface name Serial0/0/1 parameter input_errors_crc →
entry-op ge entry-val 2 entry-type increment poll-interval 60
event tag if_3 interface name Serial0/0/2 parameter input_errors_crc →
entry-op ge entry-val 2 entry-type increment poll-interval 60
event tag if_4 interface name Serial0/0/3 parameter input_errors_crc →
entry-op ge entry-val 2 entry-type increment poll-interval 60
event tag if_5 interface name Serial0/1/0 parameter input_errors_crc →
entry-op ge entry-val 2 entry-type increment poll-interval 60
event tag if_6 interface name Serial0/1/1 parameter input_errors_crc →
entry-op ge entry-val 2 entry-type increment poll-interval 60
trigger
correlate event if_1 or event if_2 or event if_3 or event if_4 or →
event if_5 or event if_6
action 1.0 syslog msg "CRC failure leased line $_interface_name"
action 2.0 mail server "$_email_server" to "$_email_to" →
from "[email protected]" →
subject "CRC problems on $_info_routername interface $_interface_name" →
body "CRC failures have exceeded the threshold"

Great job and thanks for sharing, Michael!

8 comments:

  1. Hi Ivan,

    I'm writing an EEM script and I would like to know, is it possible to catch and store some "non-interactive" output in EEM, such as, ping output?

    Regards,
    Zoey
  2. Search my blog and wiki.nil.com for "action cli"
  3. Am using 6504 cisco Multilayer switch and would like to monitor all the interfaces on the each modules , as all connected to critical devices , in case for example Xmit-Err Rcv-Err counter exceed 2 error in 1 minutes to alerts me , do i need to do CLI for each interface , but its 48 port per module , I have 3 module which will be too much ,

    please advice . Thanks
    Replies
    1. You could also write your own Tcl policy, use an external agent to poll the 6504 (SolarWinds should be able to do something simple like what you need), or use RMON MIB.

      http://www.cisco.com/en/US/tech/tk961/technologies_configuration_example09186a0080094478.shtml
  4. All,

    Where can I find detailed information on what parameters like 'entry-type increment' exactly do? Does it mean that it 'watches' the CRC errors and after an increment of some value an e-mail is issued?
  5. Once again I find the answer on one of Ivan's web pages. Thanks again Ivan.
  6. Hello,
    Interesting. In case of a long time increase of CRC input errors, is-it possible to limit the number of mails emitted ?
  7. Hello,
    Interesting.
    In case of a long time period of Input errors, many mails could be emitted. Can the applet be stopped or something like rate-limited ?
    thanks.
Add comment
Sidebar