I'm looking to be notified of interface state changes on my Arista switches without my manual polling of the logs. For example, tailing var/log/messages, I might see something like:

un 29 19:10:48 switch-min2203 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet33 (server-min2239 p3p2), changed state to up
Jun 29 19:11:23 switch-min2203 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet33(server-min2239 p3p2), changed state to down

I'd like to be emailed or alerted via Slack if say an interface changes state on one of the Arista switches.

I am uncertain how best to go about alerting on these sometimes sub-second changes. Has anyone attempted this with Graylog? Or monitoring the transition counter on the interface and alerting if it's change X many times since the last poll?

  • Cisco calls it EEM. ...if that helps. Sep 16 '16 at 20:06
  • Arista switches have XMPP support. They can send you messages on jabber about this. Myself I use a software called observium to monitor my switches. It can report things like this by email, slack and a number of other channels.
    – Peter
    Oct 16 '16 at 20:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14 '17 at 11:28

You could use an event-handler for this I guess, but the easier way to do this is by using a syslog analyser, XMPP client and/or snmptrapd daemon which handles these messages sent from the switch.

Two downsides on the event-handler approach:

  1. Arista switches seem to lack the mail command, so you would need to install a custom script to send an email (but hey, it's Linux, it's not that hard to install a small python script which allows you to send an email)
  2. event-handlers on interface changes are linked to specific interfaces, so if you want to monitor interface changes for all interfaces, you'd need a lot of handlers.

But something like this should do the trick:

event-handler test
   trigger on-intf Ethernet1 operstatus
   action bash /path/to/my/mailscript

We use Solarwinds in our environment for this Ron, but I'm not sure how sensitive it is I will look when i return from lunch. Im fairly sure it posseses what you are looking for as we run a large amount of arista switches for aggregation along with our Juniper environment.


If I were you I'd take a different approach and poll the interface from a remote point/box. If the interface dies, the Arista may then have no means of sending any data, so you got not email/alert.

So, Maybe you poll it. Look in their documentation for a RESTapi to poll. If you find one, have a look at my opensource intREST product. It's still in the oven but should be ready in a few weeks. I'd love to adapt it to Arista. Should be easy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.