Log IP SLA failures

The IP Service Level Agreement (SLA) measurement feature of Cisco IOS is extremely SNMP-oriented. For example, there is no easy way to generate a logging message when an SLA operation fails (or exceeds the threshold). However, Embedded Event Manager reading SNMP variables can help you get there. Before checking the status of an SLA operation, you need to schedule it (remember the SLA entry#, you'll need it when forming the SNMP object ID). For example:
ip sla 42
icmp-echo source-interface Serial0/0/0.100
timeout 500
threshold 100
frequency 1
ip sla schedule 42 life forever start-time now
When the SLA measurement has been defined, create an EEM applet to monitor the status of the rttMonCtrlOperTimeoutOccured variable in the CISCO-RTT-MON MIB (note that the SLA entry# is the last number in the OID). The EEM applet triggers on value 1 (true: timeout) and re-arms on value 2 (false: no timeout).
event manager applet SLA_Timeout
event snmp oid get-type exact entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 5
action 1.0 syslog msg "Ping to timeout"
Similarly, you can write an applet that triggers on SLA response time being over threshold by monitoring SNMP OID (the rttMonCtrlOperOverThresholdOccurred variable).
Note: this article is part of You've asked for it series.


  1. Hi Ivan:

    I read all your posts about EEM and they were great.

    I would like to know if you have ever tried to use EEM to monitor a MOS score of an IP SLA UDP-Jitter instance. For example, if the MS score has fallen below certain number (say 2.50), some actions will be taken by the router to re-route traffic. I know OER is another option, but doing so will require the latest greatest IOS and meeting all the prereqs as defined by OER.

    If you have any hints on using EEM to monitor MOS score I would certainly appreciate it. I am thinking about monitoring SNMP OID value of rttMonLatestJitterOperMOS, but didn't know how to tie it to an IP SLA instance #.


    William Chu
  2. This is really great. But what about if I define a trigger, for example when 2 icmp packets get timeout. Do you know the OID that monitors this?

    Thanks very much.
  3. Here is a much easier way to accomplish auto logging using EEM. Used object tracking.

    ip sla 45
    icmp-echo source-interface Vlan1
    frequency 30
    ip sla schedule 45 life forever start-time now

    track 600 ip sla 45 reachability

    event manager applet track-600-down
    event track 600 state down
    action 1.0 syslog msg "Ping to sourcing vlan1 timeout"
    event manager applet track-600-up
    event track 600 state up
    action 1.0 syslog msg "Ping to sourcing vlan1 working"
    1. Working very fine and easy to implement
Add comment