CRC's question

Unanswered Question
Jun 6th, 2007

Is there a way to put in the router log the date and time when a CRC appears in an interface?

for example:

I cleared the counters and one day after I see that there are 10 CRC's in the interface.

How can I know at what time the CRC appeared?

Regards and thanks

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)
Paolo Bevilacqua Wed, 06/06/2007 - 10:10

Sorry, it not possible.

The most you can do is poll periodically the specialized MIB that has the error counters, and build a table with the times the errors occurs.

Hope this helps, please rate post if it does!

Joe Clarke Mon, 06/11/2007 - 11:43

Depending on your IOS version, you may be able to do this with the Embedded Event Manager. Here is a sample EEM applet that will poll for input CRC errors every 60 seconds on interface FastEthernet0/0, and log them using syslog:

event manager applet crc_check

event interface name FastEthernet0/0 parameter input_errors_crc poll-interval 60 entry-op ge entry-val-is-increment true entry-val 1

action 1.0 syslog msg "CRC found on interface $_interface_name : $_interface_value"

See for more details on EEM.

Paolo Bevilacqua Mon, 06/11/2007 - 13:16

This is nice, the router polls itself and do things depending on what is happening. One wonders what cisco will invent next :)

guruprasadr Tue, 06/12/2007 - 00:03

HI Clarke,

I understand it is a Good Tool to Track. I would like to implement in my Network.

Can you please let me know how to start-up this implementation.

Is there any User manuals to Implement this EEM.

Thanks in Advance

Best Regards,

Guru Prasad R

Joe Clarke Tue, 06/12/2007 - 04:52

See the URL I sent in my previous post. That is the guide for which versions of IOS support which EEM features, and how you configure EEM. If you want to use the applet I posted, just copy it into your device's configuration (after modifying the interface name).

guruprasadr Tue, 06/12/2007 - 20:17


I have implemented the same Applet given by you in the previous Post. Below shows the Output.

Its working but something strange----When you see the show output of Serial Interface the CRC value is "2348 CRC".

But when i execute the show command for event manager i get the output as below::

Its shows TRUE Value 587 & TRUE Value 13. It doesn't match with the CRC of Interface.

What is TRUE Value & how to calculate ? ? ?

#show event manager history events detailed

No. Time of Event Event Type Name

1 Tue Jun12 22:03:56 2007 interface applet: crc_check name {Serial2/1} parameter {input_errors_crc} is_increment TRUE value 587

2 Tue Jun12 22:13:56 2007 interface applet: crc_check name {Serial2/1} parameter {input_errors_crc} is_increment TRUE value 13

#show int Serial2/1

Serial2/1 is up, line protocol is up

Hardware is M4T

Description: VSNL 2Mbps

Internet address is XXX.XXX.XXX.XXX/XX

MTU 1500 bytes, BW 1984 Kbit, DLY 20000 usec,

reliability 255/255, txload 6/255, rxload 69/255 Encapsulation HDLC, crc 16, loopback not set Keepalive set (10 sec) Restart-Delay is 0 secs

Last input 00:00:02, output 00:00:00, output hang never

Last clearing of "show interface" counters 02:35:20

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 9

Queueing strategy: weighted fair

Output queue: 0/1000/64/9 (size/max total/threshold/drops)

Conversations 0/3/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1488 kilobits/sec

5 minute input rate 543000 bits/sec, 75 packets/sec

5 minute output rate 47000 bits/sec, 47 packets/sec

961981 packets input, 912655384 bytes, 0 no buffer

Received 1084 broadcasts, 0 runts, 0 giants, 0 throttles

3995 input errors, 2348 CRC, 0 frame, 8 overrun, 0 ignored, 1639 abort

746732 packets output, 222572204 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 output buffer failures, 0 output buffers swapped out

1 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

Joe Clarke Tue, 06/12/2007 - 20:38

The applet tracks increments to the CRC counter. The value shown will be the number of new CRCs counted since the last run of the applet. So, the first time the applet ran, there were an additional 587 CRC errors. The second time it ran, the interface had accumulated 13 new CRC errors. With a counter, you do not want to do absolute measurements as they have no meaning. Increment is the way to go.

guruprasadr Wed, 06/13/2007 - 01:26


If my understanding is not wrong (pls correct me), this Applet can be used to identify the increament of CRC Error in the Interface.

Whereas comparing to the actual value in Interface has no meaning - pls advice

Also, if i reduce the Poll Interval from 60secs to 1-10secs means will this increase the Load on the CPU process--pls advice

Best Regards,

Guru Prasad R

Joe Clarke Wed, 06/13/2007 - 08:04

Correct, this will just show you the delta, and not the actual count. The purpose is to know when CRC errors are occurring on the given interface. Getting reminded every 60 seconds that there is (perhaps the same) non-zero value is not very useful.

You cannot decrease the poll-interval from 60 seconds. If you specify a smaller number, IOS will tell you it's increasing it to 60.

P4046978195 Thu, 08/02/2007 - 12:20

I had a similar but different twist. I just started exploring eem and tcl. My question, is it possible to poll another device's interface (say, up/down status) and generate an action event from that result? Like say, changing a static route? I?m pretty sure I can put together the necessary script to change the static route, but was wondering if polling another device was possible from eem and if someone can point me in the right direction? (env variable, applet or script, etc?)

Kind Regards,

Pavel Bykov Fri, 08/03/2007 - 00:45

You can do it using SNMP syslog loop. Based on syslog message, SNMP changes configuration useing write.

P4046978195 Fri, 08/03/2007 - 04:15

Thank you for that information, however, I don?t quite follow you. How would an SNMP syslog loop tell me if an interface goes down on another router? I guess I should have said that they aren?t directly connected. My apologies for that!

For example, say you have router A and B with s0/0 and F0/0 each. (A switch and a firewall?ASA5000 in between) Router A has a static route pointing to Router B?s serial interface; I want router A to change it?s static route if Router B?s s0/0 interface went down.

Can EEM and/or TCL handle such a scenario?

Thank You and Kind Regards,

U?Thai Palmer

Joe Clarke Fri, 08/03/2007 - 08:55

Absolutely. You can use one of an interface event detector, syslog event detector, timer event detector, or SNMP event detector to do this. Here is an example of a syslog event detector:

event manager applet int_status_test

event syslog pattern "%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to down"

action 1.0 cli command enable

action 2.0 cli command "config t"

action 3.0 cli command "ip route Serial0/1"

action 4.0 cli command end

This is a very trivial example. You might want to tweak it further to prevent problems with flapping, and add another applet to handle the case when Serial0/0 comes back up.


This Discussion