cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2512
Views
0
Helpful
4
Replies

"show ip arp/show mac-address-table" vs. SNMPwalk

andrew.brennan
Level 1
Level 1

Ok, so we're not liking the +20% CPU spike from our SNMP-based data collection. I have a fairly ugly TCL script that puts the output of "show ip arp" and "show mac-address-table" in a file, then copies the file to a TFTP server. At this point, instead of using SNMP to read the data from the switch, we process the output file and get the same data.

My TCL script:

set SC [exec "show startup-config"]

regexp {hostname ([A-Za-z0-9\-\.]*)} $SC match hostname

regexp {ip domain-name ([A-Za-z0-9\-\.]*)} $SC match domain

set FQDN "$hostname.$domain"

set FILENAME "nosnmp-$FQDN"

set DATASRV "tftp://dropbox"

set FH [open "disk0:/$FILENAME" w]

# CLI commands will output to the filehandle

puts $FH [exec "show ip arp"]

puts $FH [exec "show mac-address-table"]

close $FH

puts [exec "copy disk0:/$FILENAME $DATASRV/$FILENAME"]

Is there a better way to write this using the EEM TCL interpreter directly??

1 Accepted Solution

Accepted Solutions

I was the one that said this chaining should be converted to a pure EEM Tcl policy. You are less likely to see problems if you do not chain together two heavy weight subsystems.

As for the issue with the timeout, that was unrelated. You could still be seeing a bug there.

In any event, here is a policy which should do what you want. You will need to set some environment variables first. For example:

event manager environment mac_arp_period 25,58 * * * *

event manager environment mac_arp_file nosnmp

event manager environment mac_arp_server tftp://dropbox

event manager environment mac_arp_fs disk0:

View solution in original post

4 Replies 4

Joe Clarke
Cisco Employee
Cisco Employee

Are you triggering this script from EEM now? If so, what does your EEM policy look like?

event manager directory user policy "disk0:/tcl"

event manager applet NOSNMP

event timer cron cron-entry "28,58 * * * *"

action 0.9 cli command "enable"

action 1.0 cli command "tclsh disk0:/tcl/nosnmpcli.tcl"

!

Worked on 4 6500s, recently broke on one 6500 with some bizarre timeout errors. I've been advised to upgrade IOS, but this is my core switch and I'm waiting for a good downtime to schedule the upgrade.

After adding "maxrun 200" to the cron line, my applet takes longer to timeout and give up. If I manually run the script, it completes within 15 seconds, so the timeout is likely related to CSCsq32432 (or another bug) and not my code. TAC said that the developers considered my script problematic and advised against chaining EEM and tclsh -- hence my post here.

I was the one that said this chaining should be converted to a pure EEM Tcl policy. You are less likely to see problems if you do not chain together two heavy weight subsystems.

As for the issue with the timeout, that was unrelated. You could still be seeing a bug there.

In any event, here is a policy which should do what you want. You will need to set some environment variables first. For example:

event manager environment mac_arp_period 25,58 * * * *

event manager environment mac_arp_file nosnmp

event manager environment mac_arp_server tftp://dropbox

event manager environment mac_arp_fs disk0:

HA! Ok, so it's a small world. Thanks for the help!!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: