EEM- Email alert with IP SLA Based on Packet Loss

Question

hi joseph,
i need your advise, i want to get alert email based on IP SLA Packet loss
the scenarion as below :
1. If the traffic hit threshold packet loss greater than 20% as long 15 minutes --> send email
2. If reset condition packet loss eq 0% as long 15 minutes --> send email again
 I don't know how to configure it condition. could you help me to verify my configuration below?
ip sla logging traps
ip sla 1 
 icmp-jitter 10.216.0.105 source-ip 10.216.0.107 num-packets 100 interval 40
 frequency 50
ip sla schedule 1 life forever start-time now
ip sla reaction-configuration 1 react Packetloss threshold-value 3 1 threshold-type immediate action-type trapOnly
ip sla enable reaction-alerts
event manager applet TEST 
 event syslog pattern "IP SLAs\(1\): Threshold exceeded"
 action 2.0 mail server "10.240.0.10" to "[email protected]" from "[email protected]" subject "Alert for Intermittent Link" body "link intermittent in x %"
thank you

Answer 1

What's you have could work with a few modifications.  First, increase that threshold-value of 3 to 20.  You can leave the falling threshold value of 1.  You'll need to add another applet to match the falling threshold syslog message.  Not sure exactly what that one will look like.
The first applet will look like this:
event manager environment q "
event manager applet ipsla-threshold-exceeded
 event syslog pattern "IP SLAs\(1\): Threshold exceeded"
 action 001 cli command "enable"
 action 002 cli command "config t"
 action 003 cli command "no event manager applet ipsla-healthy"
 action 004 cli command "event manager applet ipsla-unhealthy"
 action 005 cli command "event timer countdown time 900"
 action 006 cli command "action 1.0 mail server $q 10.240.0.10$q to $q [email protected]$q from $q [email protected]$q subject $q Alert for Intermittent Link$q body $q link intermittent in 20 %$q"
 action 007 cli command "action 2.0 cli command enable"
 action 008 cli command "action 3.0 cli command $q config t$q"
 action 009 cli command "action 4.0 cli command $q no event manager applet ipsla-unhealthy$q"
 action 010 cli command "action 5.0 cli command end"
 action 011 cli command "end"
And the second applet (the one where you'll need to fill in the appropriate syslog pattern) will look like:
event manager applet ipsla-threshold-normal
 event syslog pattern "FALLING THRESHOLD PATTERN HERE"
 action 001 cli command "enable"
 action 002 cli command "config t"
 action 003 cli command "no event manager applet ipsla-unhealthy"
 action 004 cli command "event manager applet ipsla-healthy"
 action 005 cli command "event timer countdown time 900"
 action 006 cli command "action 1.0 mail server $q 10.240.0.10$q to $q [email protected]$q from $q [email protected]$q subject $q Link is stable$q body $q Link has been stable for 15 minutes$q"
 action 007 cli command "action 2.0 cli command enable"
 action 008 cli command "action 3.0 cli command $q config t$q"
 action 009 cli command "action 4.0 cli command $q no event manager applet ipsla-healthy$q"
 action 010 cli command "action 5.0 cli command end"
 action 011 cli command "end"