"show ip arp/show mac-address-table" vs. SNMPwalk

Answered Question
Apr 29th, 2009

Ok, so we're not liking the +20% CPU spike from our SNMP-based data collection. I have a fairly ugly TCL script that puts the output of "show ip arp" and "show mac-address-table" in a file, then copies the file to a TFTP server. At this point, instead of using SNMP to read the data from the switch, we process the output file and get the same data.

My TCL script:

set SC [exec "show startup-config"]

regexp {hostname ([A-Za-z0-9\-\.]*)} $SC match hostname

regexp {ip domain-name ([A-Za-z0-9\-\.]*)} $SC match domain

set FQDN "$hostname.$domain"

set FILENAME "nosnmp-$FQDN"

set DATASRV "tftp://dropbox"

set FH [open "disk0:/$FILENAME" w]

# CLI commands will output to the filehandle

puts $FH [exec "show ip arp"]

puts $FH [exec "show mac-address-table"]

close $FH

puts [exec "copy disk0:/$FILENAME $DATASRV/$FILENAME"]

Is there a better way to write this using the EEM TCL interpreter directly??

Correct Answer by Joe Clarke about 7 years 9 months ago

I was the one that said this chaining should be converted to a pure EEM Tcl policy. You are less likely to see problems if you do not chain together two heavy weight subsystems.

As for the issue with the timeout, that was unrelated. You could still be seeing a bug there.

In any event, here is a policy which should do what you want. You will need to set some environment variables first. For example:

event manager environment mac_arp_period 25,58 * * * *

event manager environment mac_arp_file nosnmp

event manager environment mac_arp_server tftp://dropbox

event manager environment mac_arp_fs disk0:

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Wed, 04/29/2009 - 09:29

Are you triggering this script from EEM now? If so, what does your EEM policy look like?

andrew.brennan Wed, 04/29/2009 - 10:25

event manager directory user policy "disk0:/tcl"

event manager applet NOSNMP

event timer cron cron-entry "28,58 * * * *"

action 0.9 cli command "enable"

action 1.0 cli command "tclsh disk0:/tcl/nosnmpcli.tcl"

!

Worked on 4 6500s, recently broke on one 6500 with some bizarre timeout errors. I've been advised to upgrade IOS, but this is my core switch and I'm waiting for a good downtime to schedule the upgrade.

After adding "maxrun 200" to the cron line, my applet takes longer to timeout and give up. If I manually run the script, it completes within 15 seconds, so the timeout is likely related to CSCsq32432 (or another bug) and not my code. TAC said that the developers considered my script problematic and advised against chaining EEM and tclsh -- hence my post here.

Correct Answer
Joe Clarke Wed, 04/29/2009 - 17:43

I was the one that said this chaining should be converted to a pure EEM Tcl policy. You are less likely to see problems if you do not chain together two heavy weight subsystems.

As for the issue with the timeout, that was unrelated. You could still be seeing a bug there.

In any event, here is a policy which should do what you want. You will need to set some environment variables first. For example:

event manager environment mac_arp_period 25,58 * * * *

event manager environment mac_arp_file nosnmp

event manager environment mac_arp_server tftp://dropbox

event manager environment mac_arp_fs disk0:

Actions

This Discussion