Monitoring EIGRP using EEM

Question

Hi,
I'm trying to create an EEM script to monitor the status of some EIGRP peers on a specific interface.  The failure detection works, the problems I have are:
- The applet trigger is syslog, unfortunately there are two peers on the interface, so I get two syslogs, and thus the applet runs twice sending two traps.  I only want one.
- I want the applet to wait for 10 minutes after it is triggered before checking the EIGRP neighbor status (in case the peer comes back up right away).  The wait 600 seconds command doesn't seem to work as the trap is sent immediately.
Any help would be greatly appreciated!
snmp-server enable traps event-manager
event manager session cli username myuserid
event manager scheduler applet thread class default number 1
event manager applet backup-link-status
event syslog pattern "%DUAL-5-NBRCHANGE"
action  90 wait 600
action 100 cli command "show ip eigrp nei | inc Tu150"
action 110 regexp " [0-9.]+ " $_cli_result result
action 120 if $_regexp_result eq 0
action 130  syslog msg "Backup path down"
action 136 end
action 140 exit

Answer 1

This will not work since the EEM policy will terminate after 20 seconds.  What you should do is have the first policy configure a second timer policy to do the actual check of the EIGRP neighbor state:
event manager environment q "!event manager applet backup-link-change event syslog pattern "DUAL-5-NBRCHANGE" action 001 handle-error type ignore action 002 context retrieve key EIGRPCTX variable mutex action 003 if $_error eq FH_EOK action 004  exit 0 action 005 end action 006 set mutex 1 action 007 context save key EIGRPCTX variable mutex action 008 handle-error type exit action 009 cli command "enable" action 010 cli command "config t" action 011 cli command "event manager applet backup-link-status" action 012 cli command "event timer countdown time 600" action 013 cli command "action 1.0 cli command $q enable$q" action 014 cli command "action 2.0 cli command $q show ip eigrp nei | inc Tu150$q" action 015 cli command "action 3.0 regexp $q ^V?[0-9.]+$q \$_cli_result" action 016 cli command "action 4.0 if \$_regexp_result eq 0" action 017 cli command "action 5.0 syslog msg $q Backup path is down$q" action 018 cli command "action 6.0 end" action 019 cli command "action 7.0 cli command $q config t$q" action 020 cli command "action 7.1 context retrieve key EIGRPCTX variable mutex" action 021 cli command "action 7.2 cli command $q no event manager applet backup-link-status$q" action 022 cli command "action 7.3 cli command end" action 023 cli command "end"
On action 015, that ^V? sequence is "Control+V,Control+V,?".  You will need to type that in manually.
Depending on the timing of the two syslog messages, this may not defeat the double syslog.  If not, you could change the first event line to:
event syslog pattern "DUAL-5-NBRCHANGE" occurs 2 period X
Where X is the number of seconds between messages.