Michael modified one of my EEM applets to monitor CRC errors on WAN interfaces and notify the operator (via e-mail) when an interface has more than two errors per minute. He wanted to monitor multiple interfaces and asked me whether it’s possible to modify the SNMP event detector somehow. I only had to point him to the event correlation feature of EEM version 2.4 and he sent me the following (tested) applet a few days later.

event manager environment _email_server 10.10.10.10
event manager environment _email_to [email protected]
event manager environment _info_routername Router
!
event manager applet multiple_if 
 event tag if_1 interface name Serial0/0/0 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_2 interface name Serial0/0/1 parameter input_errors_crc → 
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_3 interface name Serial0/0/2 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_4 interface name Serial0/0/3 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_5 interface name Serial0/1/0 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 event tag if_6 interface name Serial0/1/1 parameter input_errors_crc →
  entry-op ge entry-val 2 entry-type increment poll-interval 60
 trigger
  correlate event if_1 or event if_2 or event if_3 or event if_4 or →
   event if_5 or event if_6
 action 1.0 syslog msg "CRC failure leased line $_interface_name"
 action 2.0 mail server "$_email_server" to "$_email_to" →
  from "[email protected]" →
  subject "CRC problems on $_info_routername interface $_interface_name" →
  body "CRC failures have exceeded the threshold"

Great job and thanks for sharing, Michael!