Routers can email you when they go down

Cisco IOS tips and tricks had a great post on how to use EEM to send emails when interfaces go down.

By Ivan Pepelnjak

John S. Pumphrey recently asked an interesting question: “Can the router send an e-mail when an interface goes down?” The enterprisey solution is obvious: deploy a high-end EMS to collect SNMP traps and use its API to write a custom module that would use a MQ interface to alert the operator. Fortunately, Event Manager applets in Cisco IOS provide action mail command (available in 12.3(14)T and 12.4) that can send an e-mail to a SMTP server straight from the router.

There are two ways you can detect that an interface went down with EEM: either you track the interface status with a track object and start an EEM applet when the track object changes state or you catch the syslog messages reporting that the interface line protocol changed state to down. The second approach is obviously more generic, as a single applet can act on multiple interfaces.

event manager applet MailOnIfDown 
event syslog occurs 1 
    pattern "LINEPROTO-5-UPDOWN.*to down" 
    period 1

Notes:

• If you want to limit the applet to serial interfaces only, you could change the pattern to LINEPROTO-5-UPDOWN.*Serial.*to down.
• The → continuation character is used to indicate that a single configuration line has been split to increase readability.

The action mail command specifies the mail server’s address (use a hostname and DNS lookup or ip host configuration command to make the EEM applet more generic), from and to address, message subject and body. In each of these fields, you can use EEM environment variables that you can define with the event manager environment configuration command. Each EEM event also defines a few environment variables that you can use. For example, you can define the e-mail recipient in the router’s configuration and use the _syslog_msg variable to include the syslog message in the e-mail body:

event manager environment _ifDown_rcpt admin@lab.com
event manager applet MailOnIfDown 
event syslog occurs 1 
    pattern "LINEPROTO-5-UPDOWN.*to down" 
    period 1 
action 1.0 mail server "mail-gw" 
    to "$_ifDown_rcpt" from "R1@lab.com" 
    subject "Interface down on R1" 
    body "$_syslog_msg"

You can make the applet even more generic with the help of action info type routername command, which stores the current router’s name into the $_info_routername environment variable:

event manager environment _ifDown_rcpt admin@lab.com
event manager applet MailOnIfDown 
event syslog occurs 1 
    pattern "LINEPROTO-5-UPDOWN.*to down" 
    period 1 
action 1.0 info type routername 
action 2.0 mail server "mail-gw" 
    to "$_ifDown_rcpt" from "$_info_routername@lab.com" 
    subject "Interface down on $_info_routername" 
    body "$_syslog_msg"


export const _frontmatter = {"title":"Routers can email you when they go down","date":"2007-10-28T00:00:00.000Z","author":"Colin McNamara","category":"Technology & Innovation","thumbnailText":"A practical guide to configuring Cisco routers to send automated email notifications when interfaces go down using Event Manager applets, providing real-time network monitoring capabilities.","tags":["cisco","networking","automation","EEM","monitoring"],"keywords":["cisco EEM","network automation","router monitoring","email notifications","network management","IOS scripting"]}