hi

snmp-server enable traps cpu threshold
process cpu threshold type total rising 90 interval 3

event manager applet CPU
event syslog pattern "CPURISINGTHRESHOLD"
action 1.0 cli command "enable"
action 1.1 cli command "show process cpu sorted 5min | include ^_[1-9]|^| append flash:cpu_info"

i am trying it on GNS3 - IOS is  12.4(25b) - 3600 series router. Not sure if this is not supposed to work on GNS3.

but i m sure i am doing mistake in my regular expresion since above command gives me everything instead of 1st 5 lines.

HI

I tried some thing else which partially worked

event manager applet CPU1
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.8.1 get-type exact entry-op ge entry-val "10" poll-interval 30
actiona 1.0 cli command "enable"
action 2.0 cli command "show process cpu | include ^__[1-9]|^__5|"
action 3.0 syslog priority warning msg "high cpu usage"

But this gives me all output of show process cpu, and i want only 1st few lines.

How do i achive this?

What you want to do cannot be done using applets (at least not in your version of code).  You need to use a Tcl policy.  Attached is a policy which should do what you want.  The resulting flash:cpu_info file will contain the current date and time, the two "show proc cpu" header lines, and the first five processes.

Thanks Joe

Honestly i am finding it difficult since this is a new topic for me..

is there any easy way.

You mentioned this can't be done using regexp in my version of IOS... can this be done in other IOS, if yes then how? And which IOS do i need?

Getting the first five lines can be done easily using applets in IOS 12.4(22)T and higher.  However, writing that data to a file on flash is where it gets difficult.  You could easily print the lines, email them, or send them in a syslog message, but to write them out to a file, you need Tcl.  The reason for this is that IOS does not support the double pipe syntax.  That is, the following command line is invalid:

show proc cpu | exc 0.00 | append flash:/file

The second pipe is not interpreted the way you think it should be.

Thanks

Can you give me Sample config for sending mail and sending to Syslog for 1st 5 lines.

Regards

Lokesh

event manager applet dump-procs
 event syslog pattern "CPURISINGTHRESHOLD"
 action 001 cli command "enable"
 action 002 cli command "show proc cpu sorted 5min"
 action 003 set lines 0
 action 004 foreach line "$_cli_result" "\n"
 action 005   if $lines gt 6
 action 006     break
 action 007   end
 action 008   append output $line
 action 009   increment lines
 action 010 end
 action 011 mail to user@company.com from user@company.com server 10.1.1.1 subject "Top five processes" body "$output"
 action 012 syslog msg "Top five processes: $output"

Thanks Joe

What does increment lines do here?

And Which IOS must i have to run this?

Regards

Lokesh

The "increment" command increments the value of the lines counter variable by one.  The idea is that after the first two header lines, and first five processes are captured, the loop should be exited.

This applet requires 12.4(22)T or higher (i.e. EEM 3.0 or higher).  You currently have EEM 2.1.

Hi,

I tried your solution in both IOS 12.4T-22 & IOS 15.0 in C7206VXR platform, it doesn't work!

You may need to add:

event manager session cli username USER

If you are using AAA command authorization.  If that does not work, start a new thread for your specific problem with the output of "debug event manager action cli".

Hi Joseph,

vent manager applet dump-procs
 event syslog pattern "CPURISINGTHRESHOLD"
 action 001 cli command "enable"
 action 002 cli command "show proc cpu sorted 5min"
 action 003 set lines 0
 action 004 foreach line "$_cli_result" "\n"
 action 005   if $lines gt 6
 action 006     break
 action 007   end
 action 008   append output $line
 action 009   increment lines
 action 010 end
 action 011 mail to user@company.com from user@company.com server 10.1.1.1 subject "Top five processes" body "$output"
 action 012 syslog msg "Top five processes: $output"

Instead of using the programming logic for sending 10 lines via email, can i do some thing like  this

action 003 cli command "terminal width 100"<--since it has longer width for some process and to accomodate it in 1 line

action 004 cli command "terminal len 13" <-- it will count --more-- and 2 line after command

action 005  cli command "sh process cpu sorted 5min"

and then mail configuration.

Regards

Ahmed...

No, this will not work.  The terminal used by EEM is specially designed to to disable the pager.  Plus, you need to be able to find the device prompt when the command finishes executing.  If you want to add more lines, just adjust the "$lines gt 6" piece.  Specify a line count of 10 or higher.  If you cannot use programmatic applets, then you will need to switch to Tcl to control the output.