Tuesday, 11 March 2014

SIP-UA Registration Alarm EEM Script Thing

Today I had yet another instance of EEM script saving the day - or at least proposing a solution which might one day save the day.  I desperately want to monitor a sip-ua registration on a Cisco gateway, something was up with one of my gateways and it would spontaneously stop registering.  And not start again, which is deeply not funny when you are on call GMT-time and they are in Australia.  The only solution was to remove reapply the sip-ua config, which turned out to be an IOS bug, I believe.

However going forward and moving on to the brighter, less-buggy future how could we monitor the trunk going down if this happened again?  As it stood we relied on irate punters to sound the alarm - as we all know being forewarned of an impending angry caller is far more preferable to ignorance as you can magic up brilliant sounding diagnostic measures in advance (reboot it).  Was there a MIB to show this status however so we could beat them to it?  I couldn't find one.  Enter EEM.

Step1.  Use event manager to run the “show sip-ua register status” command and run over each line looking for a regex match.  The output would be:

XX-XX-2911#show sip-ua register status
Line                             peer       expires(sec) reg survival P-Associ-URI
================================ ========== ============ === ======== ============
1XX437                           -1         2194         yes normal

So our script could look like this (if like me you have hashed it together from far more intelligent posts than this):

event manager applet trunk
event none
action 100 cli command "en"
action 200 cli command "show sip-ua register status"
action 250 foreach line "$_cli_result" "\n"
action 300  regexp "1XX437(.*) no " $line
action 400  if $_regexp_result eq "1"
action 600   syslog msg "The trunk is down"
action 700  end
action 800 end

Note the white spaces in action 300, unless you want to match the "no" of  "normal" you are going to need them".  I would change the event to a cron timer running every so often, 5 minutes or so should do it.  To test the reverse, say the trunk is up, change action 300 to “yes” and see the result,:

Mar 12 06:27:20.812 WST: %HA_EM-6-LOG: trunk: The trunk is down ßreally means up

Finally add in an action 601 to send the monitoring solution of your choice a custom trap, if the result is positive, and yes we have an alarm should SIP trunk not be registered.  Happy days.