Packet drop

Unanswered Question
Aug 5th, 2009
User Badges:

Hi,


Is there a way a SNMP trap can be generated with a packet drop on an interface.


Can RMON handle a packet drop notification. Also, is there any syslog message which is generated for this.


Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
Lucien Avramov Wed, 08/05/2009 - 17:20
User Badges:
  • Red, 2250 points or more

Check to see if your device support this old mib, that would be way to get the queue drops:


From OLD-CISCO-INTERFACES-MIB

locIfInputQueueDrops = .1.3.6.1.4.1.9.2.2.1.1.26

locIfOutputQueueDrops = .1.3.6.1.4.1.9.2.2.1.1.27


If those OID are on your router, then as you said, you can try to use rmon with it.


example:

mon alarm 1 1.3.6.1.4.1.9.2.2.1.1.26.2 1 absolute rising-threshold 1 falling-threshold 1 1


Then you use an rmon event to trigger the trap, as per the standard configuration guide:

http://www.cisco.com/en/US/partner/tech/tk648/tk362/tk560/tsd_technology_support_sub-protocol_home.html


Now, you have to add the interface index to it at the end :1.3.6.1.4.1.9.2.2.1.1.26.X where X is the interface index, you can get that by doing an snmpwalk on ifname to match it.

Joe Clarke Wed, 08/05/2009 - 18:02
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

This example won't yield desired results. The queue drop objects are counters, and an absolute counter value doesn't tell you much. You would want to use delta.


However, I mush prefer the EEM approach. EEM allows you to watch interface drops without needing to know the ifIndex. For example, to watch interface drops on FastEthernet0/0:


event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped entry-op ge entry-val 1 entry-type increment exit-op lt exit-val 1 exit-type increment poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"


This particular example assumes a recent version of IOS, but the entry-type and exit-type parameters can be changed to entry-val-is-increment true and exit-val-is-increment true for earlier versions of IOS.

georgeef1 Thu, 08/06/2009 - 12:50
User Badges:

Hi jclarke,


Thank you so much for the information.


Even after all this, my question is can it be handled by a syslog or a SNMP trap so I get the notification after a packet drop.


Thanks

Joe Clarke Thu, 08/06/2009 - 12:55
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

My EEM example will send an SNMP trap. If you need a syslog, you can add:


action 2.0 syslog msg "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

georgeef1 Mon, 08/10/2009 - 09:36
User Badges:

Hi Jclarke,


Thanks for this wonderful suggestion.


But, unfortunately, I guess EEM will not work for us because our standard IOS is 12.2(18) SXF9. So any other solutions/suggestions you can send my way are greatly appreciated.


Thanks a lot.

Joe Clarke Mon, 08/10/2009 - 09:41
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

EEM will work in IOS 12.2(18)SXF9. The applet I provided you will work fine. You will just need to use the older "entry-val-is-increment" notation.

georgeef1 Mon, 08/10/2009 - 17:08
User Badges:

Hi Jclarke,


Thankd for all your help.


Can you please clarify the syntax for me with this one?

Is this correct for our IOS?

event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped

entry-val-is-increment true exit-val-is-increment true poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw

$_interface_delta_value $_interface_parameter over the last 60 seconds"


Thank you.

Joe Clarke Mon, 08/10/2009 - 20:07
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

The syntax would be:


event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped entry-val 1 entry-op ge entry-val-is-increment true exit-val 1 exit-op lt exit-val-is-increment true poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

georgeef1 Thu, 08/13/2009 - 13:59
User Badges:

Hi Jclarke,


Thanks for all the wonderful information.


As per the EEM you told me a script for the interface. is there a way we can configure EEM on global config to have it applied on all the interfaces automatically.


Thanks

Joe Clarke Thu, 08/13/2009 - 14:10
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Unfortunately, no. However, if you wanted to convert the applet policy to a Tcl policy, you could run a script periodically to check all interfaces for errors. With your version of IOS, in order to keep using applets, you'd have to add one applet per interface.

georgeef1 Thu, 08/20/2009 - 07:07
User Badges:

Hi,


I went to apply this for multiple interfaces and the last entry overwrites the previous entry. So my question is, do I need to create a new event manager applet interface-drops for each interface I want to monitor?


Thanks

Joe Clarke Thu, 08/20/2009 - 07:10
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You will need to use unique names for your applets. For example:


interface-drops-fa1/1

interface-drops-fa1/2

...

Actions

This Discussion