Home > CISCO, EEM Scripts > EEM Script to check log messages and trigger email

EEM Script to check log messages and trigger email

June 15th, 2017

Here’s a tip to become alerted when an interface is down (in this case a VPN tunnel). The script can be adapted to look for any pattern in the syslog and send a triggered email message:

event manager environment _ifDown_rcpt somebody@somewhere.com
event manager session cli username “admin”
event manager applet MailOnIfDown
event syslog occurs 1 pattern “%LINEPROTO-5-UPDOWN.* Tunnel” period 1
action 1.0 mail server “smtp-server@somewhere.com” to “$_ifDown_rcpt” from “router-hostname@somewhere.com” subject “DON’T PANIC – Tunnel Changed State!” body “$_syslog_msg”
!
end

Verify that the EEM script has been registered:

ROUTER#show event manager policy registered
No. Class Type Event Type Trap Time Registered Name
1 applet user syslog Off Thu Jun 15 13:53:04 2017 MailOnIfDown
occurs 1 period 1.000 pattern {%LINEPROTO-5-UPDOWN.* Tunnel}
maxrun 20.000
action 1.0 mail server “smtp-server@somewhere.com” to “$_ifDown_rcpt” from “router-hostname@somewhere.com” subject “DON’T PANIC – Tunnel Changed State!” body “$_syslog_msg”

ROUTER#

Categories: CISCO, EEM Scripts Tags:
Comments are closed.