Event Policies and Event Notifications Overview

Benefits of Event Policies

Event policies provide the following benefits:

• Improve network reliability and maximize network uptime by automatically responding to system events, including system log messages, SNMP traps, chassis alarms, and internal timers

• Shorten troubleshooting time and speed time to resolution for network issues by automating troubleshooting tasks

• Reduce the time required for manual system monitoring and intervention

Understanding Event Policies and Event Notifications

To diagnose a fault or error condition on a device, you need relevant information about the state of the platform. You can derive state information from event notifications. Event notifications are system log messages and SNMP traps. A Junos process called the event process (eventd) receives event notifications—henceforth simply called events—from other Junos processes.

Timely diagnosis and intervention can correct error conditions and keep a device in operation. When the eventd process receives events, it can trigger an event policy. Event policies are if-then-else constructs that instruct the eventd process to select specific events, correlate the events, and perform a set of actions upon receipt of the events. These actions can help you diagnose a fault as well as take corrective action. For example, the eventd process can create log files, upload device files to a given destination, issue operational mode commands, modify the configuration, or invoke an event script. When the system invokes an event script, it passes the event details to the script in the form of XML inputs.

You can configure multiple policies to be processed for an event. The device executes the policies in the order in which they appear in the configuration. For each policy, you can configure multiple actions. The device also executes the actions in the order in which they appear in the configuration.

Note:

Junos OS Evolved might not execute policies in the order in which they appear. Therefore, we've changed the behavior so that if one policy has the ignore option, Junos OS Evolved does not execute any policies that are associated with the event.

Note:

In Junos OS, eventd throws commit time warning messages if there are duplicate policies. In Junos OS Evolved, eventd will not throw any warning messages. It will accept the policy on a first-come, first-serve basis.

Defining Events

Events can originate as SNMP traps or system log messages. The event process receives event messages from other Junos processes, such as the routing protocol process (rpd) and the management process (mgd). Figure 1 shows how the event process (eventd) interacts with other Junos processes.

When you create an event policy, you define one or more events that trigger the policy. You can determine the events to use in a policy in a number of ways. You can explore events by using the following resources:

• System Log Explorer

• help syslog operational mode command in the CLI

• Context sensitive help when you configure an event policy in the CLI

The System Log Explorer application enables you to search the standard system log messages supported for a given operating system and release. The application provides information about each system log message, including its type and severity, a description of the message, the general output text, and any associated attributes.

In the CLI, you can use the help syslog ? operational mode command to list the events that you can reference in an event policy.

You can filter the output of a search by using the pipe (|) symbol. The following example lists pipe symbol filters:

For more information about using the pipe symbol, see the CLI User Guide .

You can also list events as you configure an event policy. To view a partial list of the events that you can reference in an event policy, issue the set event-options policy policy-name events ? configuration mode command.

Some of the system log messages that you can reference in an event policy are not listed in the output of the set event-options policy policy-name events ? command. For information about referencing these system log messages in your event policies, see Use Nonstandard System Log Messages to Trigger Event Policies.

In addition, you can generate internal events at specific times or time intervals and reference those events in an event policy. For example, you might want to run a specific task each day at midnight. For more information, see Generate Internal Events to Trigger Event Policies.

You can also configure an event policy to trigger for a single event or for two or more correlated events. For information about correlating events, see Use Correlated Events to Trigger an Event Policy.

Note:

In lab environments, you can the Junos logger utility to simulate one or more events that are difficult to reproduce for a given setup. By simulating the events, you can trigger and test event policies that might be difficult to test otherwise. For more information, see Junos Logger Utility.

Event Policy Actions

You can configure an event policy to execute specific actions in response to events. The event policy can perform one or more of the following actions:

• Ignore the event—Do not generate a system log message for this event and do not process any further policy instructions for this event.

• Upload a file—Upload a file to a specified destination. You can specify a transfer delay, so that, on receipt of an event, the file upload begins after the configured delay. For example, to upload a core file, a transfer delay can ensure that the system has completely generated the core file before the upload begins.

• Execute operational mode commands—Execute commands on receipt of an event. The device executes the commands in the order you configure them. The XML or text output of these commands is stored in a file, which is then uploaded to a specified URL. You can include variables in the command that allow data from the triggering event to be automatically included in the command syntax.

• Execute configuration mode commands—You can configure an event policy to use configuration mode commands to modify the configuration and commit the updated configuration.

• Execute an event script—Event scripts are Python, SLAX, or XSLT scripts that you write to perform any function available through Junos XML or Junos XML protocol remote procedure calls (RPCs). For example, an event script can run an operational mode command, inspect the command output, and then determine the next appropriate action. This process can be repeated until the source of the problem is determined and corrected. You can include variables in the script arguments that allow data from the triggering event to be incorporated into the script. Additionally, you can define your own set of arguments to pass to an event script when it is invoked. The event script output can be written to a file that is uploaded to a specified URL.

• Raise an SNMP trap.