[cisco-voip] alert when PRI goes down

Tue Dec 4 14:28:43 EST 2012

These are great Tim! Thanks for sharing. 

--- 
Lelio Fulgenzi, B.A. 
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1 
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU) 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
Cooking with unix is easy. You just sed it and forget it. 
- LFJ (with apologies to Mr. Popeil) 

----- Original Message -----
From: "Tim Reimers" <treimers at ashevillenc.gov> 
To: "Shaihan Jaffrey" <schaehan at gmail.com> 
Cc: "Cisco VOIP" <cisco-voip at puck.nether.net> 
Sent: Friday, November 30, 2012 9:16:55 AM 
Subject: Re: [cisco-voip] alert when PRI goes down 

Here’s a few sample EEM scripts: 

Notice that EEM is watching for specific syslog messages 

- for the T1 controller 

- for a Serial Interface changing state 

- for EIGRP creating/dropping ajacencies 

I usually do an applet for down and up, or recovery and failure.. 

That way you know when something was brief… 

I’m running 12.3 and 12.4 code on these guys… older stuff, so EEM should be available to you. 

You may have to enable some stuff under SNMP traps to start seeing it in buffered logfiles on the routers for EEM to catch it. 

Start with just enabling the SNMP in local logging, watch for the messages you want to trigger an EEM on, and go from there. 

event manager applet T1Control_0-0-0_Down 

event syslog pattern "%CONTROLLER-5-UPDOWN: Controller T1 0/0/0, changed state to down" 

action email mail server "my-mailservers-ip-addr" to "voip-alerts at yourdomain.com" from "MyVoiceGateway-C2821-VOIPRtr at yourdomain.com" subject "T1 controller 0/0/0 on C2821 10.53.2.5 is DOWN " body "The T1 controller 0/0/0 has gone down on 10.53.2.5" 

event manager applet T1Control_0-0-0_Up 

event syslog pattern "%CONTROLLER-5-UPDOWN: Controller T1 0/0/0, changed state to up" 

action email mail server "my-mailservers-ip-addr" to "voip-alerts at yourdomain.com" from "MyVoiceGateway-C2821-VOIPRtr at yourdomain.com" subject "T1 controller 0/0/0 on C2821 10.53.2.5 is BACK UP " body "The T1 controller 0/0/0 is up up on 10.53.2.5" 

event manager applet RemoteSite-EIGRP-up 

event syslog pattern "%DUAL-5-NBRNetworkCoreANGE: IP-EIGRP(0) 12: Neighbor 10.25.43.5 (Serial0/3/0) is up: new adjacency" 

action email mail server "your-mailserver-addr" to "netalerts at yourdomain.com" from "NetworkCore_MSPRtr at yourdomain.com" subject "EIGRP adjacency created between NetworkCore and RemoteSite" body "The EIGRP adjacency between NetworkCore and RemoteSite has been created" 

event manager applet MySite-Serial010-down 

event syslog pattern "%LINK-3-UPDOWN: Interface Serial0/1/0, NetworkCoreanged state to down" 

action email mail server "your-mailserver-addr" to "netalerts at yourdomain.com,a-user at yourdomain.com" from "NetworkCore_MSPRtr at yourdomain.com" subject "Interface Serial0/1/0, NetworkCoreanged state to down - MY SITE T1 DOWN" body "Ser0/1/0 -- MY SITE down" 

Tim Reimers 

Systems Analyst II 

Information Technology Services 

City of Asheville 

70 Court Plaza 

Asheville, NC 28801 

Direct phone - 828-259-5512 

IT Services main front desk - 828-259-5510 

treimers at ashevillenc.gov 

From: cisco-voip-bounces at puck.nether.net [mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Shaihan Jaffrey 
Sent: Thursday, November 29, 2012 10:01 AM 
To: Erick B. 
Cc: Cisco VOIP 
Subject: Re: [cisco-voip] alert when PRI goes down 

Yes PRI setup for MGCP. 

On Wed, Nov 28, 2012 at 11:26 PM, Erick B. < erickbee at gmail.com > wrote: 

The RTMT MGCP alert will only be useful if your PRI is setup for MGCP. If it is H323 then you need to use syslogs, snmp traps. You could also put together a EEM script that runs on the router to email you. 

On Wed, Nov 28, 2012 at 1:20 AM, Abdul Salam . < salamka at gmail.com > wrote: 

see attached counter 

---AS 

On Wed, Nov 28, 2012 at 12:42 PM, Abdul Salam . < salamka at gmail.com > wrote: 

I think you can look for RTMT alert D-channel oos 

---AS 

On Wed, Nov 28, 2012 at 11:14 AM, Lelio Fulgenzi < lelio at uoguelph.ca > wrote: 

Both the router and CUCM will send syslog messages to this affect. Once you configure syslog target, you can setup your syslog host with the appropriate software to send email. We use SEC in conjunction with a Linux based syslog daemon. There are other options like Solarwinds and Logzilla. 

I also believe RTMT can be configured to send email based on thresholds. 

Sent from my iPhone... 

"There's no place like 127.0.0.1" 

On Nov 28, 2012, at 12:33 AM, Shaihan Jaffrey < schaehan at gmail.com > wrote: 

> Hi Team, 
> Is there any way to generate an alert on a specific email as soon as the PRI goes down in cisco voice gateway. 
> 
> Regards, 
> 

> _______________________________________________ 
> cisco-voip mailing list 
> cisco-voip at puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-voip 

_______________________________________________ 
cisco-voip mailing list 
cisco-voip at puck.nether.net 
https://puck.nether.net/mailman/listinfo/cisco-voip 

_______________________________________________ 
cisco-voip mailing list 
cisco-voip at puck.nether.net 
https://puck.nether.net/mailman/listinfo/cisco-voip 

_______________________________________________ 
cisco-voip mailing list 
cisco-voip at puck.nether.net 
https://puck.nether.net/mailman/listinfo/cisco-voip 

_______________________________________________ 
cisco-voip mailing list 
cisco-voip at puck.nether.net 
https://puck.nether.net/mailman/listinfo/cisco-voip 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20121204/f137e4ef/attachment.html>