[cisco-voip] alert when PRI goes down

Tue Dec 4 15:19:38 EST 2012

Neal,

In RTMT you should be able to create custom alerts from the performance
counters that send you some better information. For example,

\\<your call manger IP>\Cisco MGCP PRI
Device(sda0002fcc21cec::S0_DS1-0\DatalinkInService is a counter I used to
poll for d channel status on a MGCP controlled gateway (6608 blade I
think). I just happen to still have it setup (disabled) still in my RTMT.

Could be monitored for a change, and then a email with a specific message
could be sent out based on how you want to trigger it.

I use splunk now to do alerting from syslog output instead, but RTMT worked
pretty good for this when I was using it for such.

On Tue, Dec 4, 2012 at 2:52 PM, Haas, Neal <nhaas at co.fresno.ca.us> wrote:

>  In RTMT you just get PRI down! I wish it would actually give more
> information like Which PRI is down****
>
> ** **
>
> ** **
>
> Neal Haas****
>
> ** **
>
> *From:* cisco-voip-bounces at puck.nether.net [mailto:
> cisco-voip-bounces at puck.nether.net] *On Behalf Of *Lelio Fulgenzi
> *Sent:* Tuesday, December 04, 2012 11:29 AM
> *To:* Tim Reimers
>
> *Cc:* Cisco VOIP
> *Subject:* Re: [cisco-voip] alert when PRI goes down****
>
>  ** **
>
> These are great Tim! Thanks for sharing.
>
> ---
> Lelio Fulgenzi, B.A.
> Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
> (519) 824-4120 x56354 (519) 767-1060 FAX (ANNU)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Cooking with unix is easy. You just sed it and forget it.
>                               - LFJ (with apologies to Mr. Popeil)
>
> ****
>  ------------------------------
>
> *From: *"Tim Reimers" <treimers at ashevillenc.gov>
> *To: *"Shaihan Jaffrey" <schaehan at gmail.com>
> *Cc: *"Cisco VOIP" <cisco-voip at puck.nether.net>
> *Sent: *Friday, November 30, 2012 9:16:55 AM
> *Subject: *Re: [cisco-voip] alert when PRI goes down
>
>
> ****
>
> Here’s a few sample EEM scripts:****
>
>  ****
>
> Notice that EEM is watching for specific syslog messages****
>
> -           for the T1 controller****
>
> -          for a Serial Interface changing state****
>
> -          for EIGRP creating/dropping ajacencies****
>
>  ****
>
> I usually do an applet for down and up, or recovery and failure..****
>
> That way you know when something was brief…****
>
>  ****
>
> I’m running 12.3 and 12.4 code on these guys… older stuff, so EEM should
> be available to you.****
>
> You may have to enable some stuff under SNMP traps to start seeing it in
> buffered logfiles on the routers for EEM to catch it.****
>
>  ****
>
> Start with just enabling the SNMP in local logging, watch for the messages
> you want to trigger an EEM on, and go from there.****
>
>  ****
>
>  ****
>
> event manager applet T1Control_0-0-0_Down****
>
> event syslog pattern "%CONTROLLER-5-UPDOWN: Controller T1 0/0/0, changed
> state to down"****
>
> action email mail server "my-mailservers-ip-addr" to "
> voip-alerts at yourdomain.com" from "
> MyVoiceGateway-C2821-VOIPRtr at yourdomain.com" subject "T1 controller 0/0/0
> on C2821 10.53.2.5 is DOWN " body "The T1 controller 0/0/0 has gone down on
> 10.53.2.5"****
>
>  ****
>
> event manager applet T1Control_0-0-0_Up****
>
> event syslog pattern "%CONTROLLER-5-UPDOWN: Controller T1 0/0/0, changed
> state to up"****
>
> action email mail server "my-mailservers-ip-addr" to "
> voip-alerts at yourdomain.com" from "
> MyVoiceGateway-C2821-VOIPRtr at yourdomain.com" subject "T1 controller 0/0/0
> on C2821 10.53.2.5 is BACK UP " body "The T1 controller 0/0/0 is up up on
> 10.53.2.5"****
>
>  ****
>
> event manager applet RemoteSite-EIGRP-up****
>
> event syslog pattern "%DUAL-5-NBRNetworkCoreANGE: IP-EIGRP(0) 12: Neighbor
> 10.25.43.5 (Serial0/3/0) is up: new adjacency"****
>
> action email mail server "your-mailserver-addr" to "
> netalerts at yourdomain.com" from "NetworkCore_MSPRtr at yourdomain.com"
> subject "EIGRP adjacency created between NetworkCore and RemoteSite" body
> "The EIGRP adjacency between NetworkCore and RemoteSite has been created"*
> ***
>
>  ****
>
> event manager applet MySite-Serial010-down****
>
> event syslog pattern "%LINK-3-UPDOWN: Interface Serial0/1/0,
> NetworkCoreanged state to down"****
>
> action email mail server "your-mailserver-addr" to "
> netalerts at yourdomain.com,a-user at yourdomain.com" from "
> NetworkCore_MSPRtr at yourdomain.com" subject "Interface Serial0/1/0,
> NetworkCoreanged state to down - MY SITE T1 DOWN" body "Ser0/1/0 --  MY
> SITE down"****
>
>  ****
>
>  ****
>
> Tim Reimers****
>
> Systems Analyst II****
>
> Information Technology Services****
>
> City of Asheville****
>
> 70 Court Plaza****
>
> Asheville, NC 28801****
>
> Direct phone - 828-259-5512****
>
> IT Services main front desk - 828-259-5510****
>
> treimers at ashevillenc.gov <timreimers at ashevillenc.gov>****
>
>  ****
>
>  ****
>
>  ****
>
> *From:* cisco-voip-bounces at puck.nether.net
> [mailto:cisco-voip-bounces at puck.nether.net] *On Behalf Of *Shaihan Jaffrey
> *Sent:* Thursday, November 29, 2012 10:01 AM
> *To:* Erick B.
> *Cc:* Cisco VOIP
> *Subject:* Re: [cisco-voip] alert when PRI goes down****
>
>  ****
>
> Yes PRI setup for MGCP.****
>
>  ****
>
> On Wed, Nov 28, 2012 at 11:26 PM, Erick B. <erickbee at gmail.com> wrote:****
>
> The RTMT MGCP alert will only be useful if your PRI is setup for MGCP.  If
> it is H323 then you need to use syslogs, snmp traps. You could also put
> together a EEM script that runs on the router to email you. ****
>
>  ****
>
> On Wed, Nov 28, 2012 at 1:20 AM, Abdul Salam . <salamka at gmail.com> wrote:*
> ***
>
> see attached counter****
>
>
>
>
> *---AS*****
>
>
>
>
> ****
>
> On Wed, Nov 28, 2012 at 12:42 PM, Abdul Salam . <salamka at gmail.com> wrote:
> ****
>
> I think you can look for RTMT alert D-channel oos ****
>
>
>
>
> *---AS*****
>
>
>
>
> ****
>
> On Wed, Nov 28, 2012 at 11:14 AM, Lelio Fulgenzi <lelio at uoguelph.ca>
> wrote:****
>
> Both the router and CUCM will send syslog messages to this affect. Once
> you configure syslog target, you can setup your syslog host with the
> appropriate software to send email. We use SEC in conjunction with a Linux
> based syslog daemon. There are other options like Solarwinds and Logzilla.
>
> I also believe RTMT can be configured to send email based on thresholds.
>
> Sent from my iPhone...
>
> "There's no place like 127.0.0.1"****
>
>
> On Nov 28, 2012, at 12:33 AM, Shaihan Jaffrey <schaehan at gmail.com> wrote:
>
> > Hi Team,
> > Is there any way to generate an alert on a specific email as soon  as
> the PRI goes down in cisco voice gateway.
> >
> > Regards,
> >****
>
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip****
>
>  ****
>
>  ****
>
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip****
>
>  ****
>
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip****
>
>  ****
>
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip****
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
>

-- 
Ed Leatherman
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20121204/ded70e14/attachment.html>