This example won't yield desired results. The queue drop objects are counters, and an absolute counter value doesn't tell you much. You would want to use delta.

However, I mush prefer the EEM approach. EEM allows you to watch interface drops without needing to know the ifIndex. For example, to watch interface drops on FastEthernet0/0:

event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped entry-op ge entry-val 1 entry-type increment exit-op lt exit-val 1 exit-type increment poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

This particular example assumes a recent version of IOS, but the entry-type and exit-type parameters can be changed to entry-val-is-increment true and exit-val-is-increment true for earlier versions of IOS.

Hi jclarke,

Thank you so much for the information.

Even after all this, my question is can it be handled by a syslog or a SNMP trap so I get the notification after a packet drop.

Thanks

My EEM example will send an SNMP trap. If you need a syslog, you can add:

action 2.0 syslog msg "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

Hi Jclarke,

Thanks for this wonderful suggestion.

But, unfortunately, I guess EEM will not work for us because our standard IOS is 12.2(18) SXF9. So any other solutions/suggestions you can send my way are greatly appreciated.

Thanks a lot.

EEM will work in IOS 12.2(18)SXF9. The applet I provided you will work fine. You will just need to use the older "entry-val-is-increment" notation.

Hi Jclarke,

Thankd for all your help.

Can you please clarify the syntax for me with this one?

Is this correct for our IOS?

event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped

entry-val-is-increment true exit-val-is-increment true poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw

$_interface_delta_value $_interface_parameter over the last 60 seconds"

Thank you.

The syntax would be:

event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped entry-val 1 entry-op ge entry-val-is-increment true exit-val 1 exit-op lt exit-val-is-increment true poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

Hi Jclarke,

Thanks for all the wonderful information.

As per the EEM you told me a script for the interface. is there a way we can configure EEM on global config to have it applied on all the interfaces automatically.

Thanks

Unfortunately, no. However, if you wanted to convert the applet policy to a Tcl policy, you could run a script periodically to check all interfaces for errors. With your version of IOS, in order to keep using applets, you'd have to add one applet per interface.

Hi,

I went to apply this for multiple interfaces and the last entry overwrites the previous entry. So my question is, do I need to create a new event manager applet interface-drops for each interface I want to monitor?

Thanks

You will need to use unique names for your applets. For example:

interface-drops-fa1/1

interface-drops-fa1/2

...