[cisco-voip] alert when PRI goes down

Tue Dec 4 14:52:47 EST 2012

In RTMT you just get PRI down! I wish it would actually give more information like Which PRI is down

Neal Haas

From: cisco-voip-bounces at puck.nether.net [mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Lelio Fulgenzi
Sent: Tuesday, December 04, 2012 11:29 AM
To: Tim Reimers
Cc: Cisco VOIP
Subject: Re: [cisco-voip] alert when PRI goes down

These are great Tim! Thanks for sharing.

---
Lelio Fulgenzi, B.A.
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Cooking with unix is easy. You just sed it and forget it.
                              - LFJ (with apologies to Mr. Popeil)

________________________________
From: "Tim Reimers" <treimers at ashevillenc.gov<mailto:treimers at ashevillenc.gov>>
To: "Shaihan Jaffrey" <schaehan at gmail.com<mailto:schaehan at gmail.com>>
Cc: "Cisco VOIP" <cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>>
Sent: Friday, November 30, 2012 9:16:55 AM
Subject: Re: [cisco-voip] alert when PRI goes down

Here’s a few sample EEM scripts:

Notice that EEM is watching for specific syslog messages

-           for the T1 controller

-          for a Serial Interface changing state

-          for EIGRP creating/dropping ajacencies

I usually do an applet for down and up, or recovery and failure..
That way you know when something was brief…

I’m running 12.3 and 12.4 code on these guys… older stuff, so EEM should be available to you.
You may have to enable some stuff under SNMP traps to start seeing it in buffered logfiles on the routers for EEM to catch it.

Start with just enabling the SNMP in local logging, watch for the messages you want to trigger an EEM on, and go from there.

event manager applet T1Control_0-0-0_Down
event syslog pattern "%CONTROLLER-5-UPDOWN: Controller T1 0/0/0, changed state to down"
action email mail server "my-mailservers-ip-addr" to "voip-alerts at yourdomain.com<mailto:voip-alerts at yourdomain.com>" from "MyVoiceGateway-C2821-VOIPRtr at yourdomain.com<mailto:MyVoiceGateway-C2821-VOIPRtr at yourdomain.com>" subject "T1 controller 0/0/0 on C2821 10.53.2.5 is DOWN " body "The T1 controller 0/0/0 has gone down on 10.53.2.5"

event manager applet T1Control_0-0-0_Up
event syslog pattern "%CONTROLLER-5-UPDOWN: Controller T1 0/0/0, changed state to up"
action email mail server "my-mailservers-ip-addr" to "voip-alerts at yourdomain.com<mailto:voip-alerts at yourdomain.com>" from "MyVoiceGateway-C2821-VOIPRtr at yourdomain.com<mailto:MyVoiceGateway-C2821-VOIPRtr at yourdomain.com>" subject "T1 controller 0/0/0 on C2821 10.53.2.5 is BACK UP " body "The T1 controller 0/0/0 is up up on 10.53.2.5"

event manager applet RemoteSite-EIGRP-up
event syslog pattern "%DUAL-5-NBRNetworkCoreANGE: IP-EIGRP(0) 12: Neighbor 10.25.43.5 (Serial0/3/0) is up: new adjacency"
action email mail server "your-mailserver-addr" to "netalerts at yourdomain.com<mailto:netalerts at yourdomain.com>" from "NetworkCore_MSPRtr at yourdomain.com<mailto:NetworkCore_MSPRtr at yourdomain.com>" subject "EIGRP adjacency created between NetworkCore and RemoteSite" body "The EIGRP adjacency between NetworkCore and RemoteSite has been created"

event manager applet MySite-Serial010-down
event syslog pattern "%LINK-3-UPDOWN: Interface Serial0/1/0, NetworkCoreanged state to down"
action email mail server "your-mailserver-addr" to "netalerts at yourdomain.com,a-user at yourdomain.com<mailto:netalerts at yourdomain.com,a-user at yourdomain.com>" from "NetworkCore_MSPRtr at yourdomain.com<mailto:NetworkCore_MSPRtr at yourdomain.com>" subject "Interface Serial0/1/0, NetworkCoreanged state to down - MY SITE T1 DOWN" body "Ser0/1/0 --  MY SITE down"

Tim Reimers
Systems Analyst II
Information Technology Services
City of Asheville
70 Court Plaza
Asheville, NC 28801
Direct phone - 828-259-5512
IT Services main front desk - 828-259-5510
treimers at ashevillenc.gov<mailto:timreimers at ashevillenc.gov>

From: cisco-voip-bounces at puck.nether.net<mailto:cisco-voip-bounces at puck.nether.net> [mailto:cisco-voip-bounces at puck.nether.net]<mailto:[mailto:cisco-voip-bounces at puck.nether.net]> On Behalf Of Shaihan Jaffrey
Sent: Thursday, November 29, 2012 10:01 AM
To: Erick B.
Cc: Cisco VOIP
Subject: Re: [cisco-voip] alert when PRI goes down

Yes PRI setup for MGCP.

On Wed, Nov 28, 2012 at 11:26 PM, Erick B. <erickbee at gmail.com<mailto:erickbee at gmail.com>> wrote:
The RTMT MGCP alert will only be useful if your PRI is setup for MGCP.  If it is H323 then you need to use syslogs, snmp traps. You could also put together a EEM script that runs on the router to email you.

On Wed, Nov 28, 2012 at 1:20 AM, Abdul Salam . <salamka at gmail.com<mailto:salamka at gmail.com>> wrote:
see attached counter

---AS

On Wed, Nov 28, 2012 at 12:42 PM, Abdul Salam . <salamka at gmail.com<mailto:salamka at gmail.com>> wrote:
I think you can look for RTMT alert D-channel oos

---AS

On Wed, Nov 28, 2012 at 11:14 AM, Lelio Fulgenzi <lelio at uoguelph.ca<mailto:lelio at uoguelph.ca>> wrote:
Both the router and CUCM will send syslog messages to this affect. Once you configure syslog target, you can setup your syslog host with the appropriate software to send email. We use SEC in conjunction with a Linux based syslog daemon. There are other options like Solarwinds and Logzilla.

I also believe RTMT can be configured to send email based on thresholds.

Sent from my iPhone...

"There's no place like 127.0.0.1"

On Nov 28, 2012, at 12:33 AM, Shaihan Jaffrey <schaehan at gmail.com<mailto:schaehan at gmail.com>> wrote:

> Hi Team,
> Is there any way to generate an alert on a specific email as soon  as the PRI goes down in cisco voice gateway.
>
> Regards,
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
> https://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20121204/846f4c79/attachment.html>