React to excessive jitter with EEM

William Chu sent me a working configuration he uses to measure jitter with the IP SLA tool and react to excessive jitter on the primary link. First you have to create the jitter probe with the IP SLA commands:

ip sla monitor 3000
 type jitter →
   dest-ipaddr dest-port 12333 →
   source-ipaddr codec g729a →
   codec-numpackets 100
 tos 184
 frequency 10

Note: The continuation character (→) indicates that the configuration command spans multiple lines

Next you have to define the IP SLA reaction to excessive jitter. William configured his router to react when the jitter exceeds 300 milliseconds and returns back to normal when the jitter falls below 290 milliseconds (some hysteresis is always a good thing).

ip sla monitor reaction-configuration 3000 →
  react MOS threshold-value 300 290 →
  threshold-type consecutive →
  action-type trapOnly

As the last step in the SLA configuration, you have to start the probe:

ip sla monitor schedule 3000 →
  life forever start-time now

After the SLA probe and out-of-bounds reaction have been configured, the router will generate syslog messages whenever the jitter gets above the threshold as well as when it falls below the second threshold. You can then use the EEM applets to act on the syslog messages:

event manager applet MOS-Below
 event syslog occurs 1 period 120 →
   pattern "Threshold below for MOS"
 ... actions ...
event manager applet MOS-Above
 event syslog occurs 1 period 120 →
   pattern "Threshold exceeded for MOS"
 ... actions ...


  1. One minor note - you must have:

    ip sla monitor logging traps

  2. This isn't monitoring Jitter, it's monitoring MOS- VOIP Mean Opinion score.
  3. Hi Ivan,
    First of all thanks for a great Blog.Even though this post is old,I still want to comment on it the same,because I spent a few hours trying to figuring out why I was getting any syslog


    1. The MOS threshold-value is the MOS score (5.0 - 1.0) an not milliseconds.
    2. IP sla "reaction-configuration" send SNMP traps mainly but strangely, to send traps you will need this command "ip sla monitor logging traps" and get syslog messages this

    command "snmp-server enable traps syslog"

    Keep up the good work and best regards
  4. I know this is an old post, but I hoping someone could help. I've configured my router this same way but am not having success with the reaction-configuration working more than once. For example, once the threshold is exceeded, I get a syslog message. But after that one time, I can no longer get them to generate. To generate the message, on the far end responder, I simply put up an inbound acl to block the udp packets coming in from the probe. This generates the message on the probe. Removing the ACL allows the probe to read jitter again, but regardless of how many times i use the ACL to block/unblock, i no get any more messages.

    --message i get
    *Sep 13 15:07:56.299: %RTT-3-IPSLATHRESHOLD: IP SLAs(12): Threshold exceeded for jitterSDAvg

Add comment