Solved: EEM applet to run when the CPU usage is greater than 50%

Sergio Gaytan · ‎02-04-2010

Hi

I have configured EEM applet to run when the CPU usage is greater than 50% and an e-mail containing the result of the "show cpu processes" command was sent to an engineer, I'm sure that I filled with valid mail information but I did not receive anything.

I have based on this document (SNMP Event Detector -page 62) to configure the EEM applet

Writing Embedded Event Manager Policies Using the Cisco IOS CLI

http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_eem_policy_cli.html

Addition I have attached some files where you can find the results that I got, I tried with different OID's (CISCO-PROCESS-MIB) but I did not get anything.

Here is link for OIDs

http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/mibcli_f.html

I tried to do with other alternatives

a) Load the outputs in a text file in memory and RMON but I did not get a successful result (I am not an expert in EEM and RMON).

Do you know any idea how can I resolve or re-configure the EEM applet ¿?

Regards,

Joe Clarke · ‎02-05-2010

Okay, this is what you want:

event manager applet highcpu

event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.10.1" get-type exact entry-op ge entry-val 50 exit-op le exit-val 5 poll-interval 5

action 1.0 cli command "enable"
action 2.0 cli command "show proc cpu sorted"
action 3.0 mail server "172.18.24.31" to "engineer1@domain.com" from "tester@domain.com" subject "High CPU Alert" body "$_cli_result"

This will poll the five second CPU utilization of the route processor every five seconds. If the utilization is at or above 50%, the event will fire. The event will not fire again until the CPU drops below 5%, then goes back to 50%.

Note: if you have AAA command authorization enabled, you will need to add:

event manager session cli username USER

To the config. Here, USER is the username of a user who is authorized to run the "enable" and "show proc cpu sorted" commands.

View solution in original post

rtuttle · ‎02-04-2010

Sergio,

Quick question.

I can only assume you are configuring a 65XX EEM script to alert when CPU is >50%.

However are your trying to do this for a fwsm context cpu %?

If so you will have to do this from the firewall and I dont believe the EEM is applicable to FWSM's.

If not and you are looking for the Cat 65XX EEM script to run when the system CPU is <50%. Then you will need to use the oid for the chassis and not from the fwsm oid list. Not the same. And you probably will get nothing.

If you could clarify while I take a look at the attached....

yjdabear · ‎02-04-2010

One possible source of problem that stands out to me (in your EventManagerAppletHighCPU.txt) is the SNMP OID you're using:

event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.3" get-type exact entry-op ge entry-val "50" poll-interval 0.500

Contrast that with the example in "Writing Embedded Event Manager Policies Using the Cisco IOS CLI"

http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_eem_policy_cli.html

event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge entry-val 75 poll-interval 10

Your applet is missing the trailing ".1" which is the SNMP index number of a specific CPU unit, because particularly with models such as the cat6k, there're often multiple CPUs, sometimes on line cards we laymen never expect. For example:

snmpwalk randomCat6k 1.3.6.1.4.1.9.9.109.1.1.1.1.3
cisco.ciscoMgmt.ciscoProcessMIB.ciscoProcessMIBObjects.cpmCPU.cpmCPUTotalTable.cpmCPUTotalEntry.cpmCPUTotal5sec.1 : Gauge32: 0
cisco.ciscoMgmt.ciscoProcessMIB.ciscoProcessMIBObjects.cpmCPU.cpmCPUTotalTable.cpmCPUTotalEntry.cpmCPUTotal5sec.2 : Gauge32: 7
cisco.ciscoMgmt.ciscoProcessMIB.ciscoProcessMIBObjects.cpmCPU.cpmCPUTotalTable.cpmCPUTotalEntry.cpmCPUTotal5sec.5 : Gauge32: 2

snmpwalk randomCat6k cpmCPUTotalPhysicalIndex
cisco.ciscoMgmt.ciscoProcessMIB.ciscoProcessMIBObjects.cpmCPU.cpmCPUTotalTable.cpmCPUTotalEntry.cpmCPUTotalPhysicalIndex.1 : INTEGER: 5017
cisco.ciscoMgmt.ciscoProcessMIB.ciscoProcessMIBObjects.cpmCPU.cpmCPUTotalTable.cpmCPUTotalEntry.cpmCPUTotalPhysicalIndex.2 : INTEGER: 5001
cisco.ciscoMgmt.ciscoProcessMIB.ciscoProcessMIBObjects.cpmCPU.cpmCPUTotalTable.cpmCPUTotalEntry.cpmCPUTotalPhysicalIndex.5 : INTEGER: 8011

snmpget randomCat6k entPhysicalName.5017

entityMIB.entityMIBObjects.entityPhysical.entPhysicalTable.entPhysicalEntry.entPhysicalName.5017 : DISPLAY STRING- (ascii): CPU of Routing Processor 7

So it looks to me that your EEM applet needs to select a CPU to monitor:

1.3.6.1.4.1.9.9.109.1.1.1.1.3.#

Joe Clarke · ‎02-04-2010

yjdabear is absolutely right regarding the OID. You either need to specify a cpmCPUTotalIndex or set get-type to be "next" instead of exact. Given that that this is a 6500, you really need to find the right CPU instance. To do this, you will need to walk the cpmCPUTotalTable, and find the available instances, then walk the entPhysicalDescr to match the cpmCPUTotalPhysicalIndex to a CPU entity (i.e. a 6500 will have more than one CPU).

Your other problem is your polling interval. Do NOT poll more frequently than every five seconds. Doing so will overwhlem the device, and will not provide accurate data since cpmCPUTotal5sec is only updated every five seconds.

Next, you only specified an entry criterion. Without an exit criterion specified, as long as the CPU utilization is greater than or equal to 50%, you will get an email. This could flood your inbox. Consider adding something like:

exit-op le exit-val 10

This will say, "fire an event when CPU utilization is greater than 50%, but do not fire again until it drops below 10%, then goes back to 50%."

Sergio Gaytan · ‎02-04-2010

Hi

I will try to explain some steps that I followed to resolve this problem, I hope you understand my procedure:

1. I used a SNMP Walk Tool by CiscoWorks LMS 3.2 to find the CPU entities (FILE "SCREEN---cpmCPUTotalPhysicalIndex")

2. I used the SNMP Walk with this OID (1.3.6.1.4.1.9.9.109.1.1.1.1.10---cpmCPUTotalMonIntervalValue---CPU utilization for five seconds)

and I have captured a screen to show the CPU percent before testing (FILE "SCREEN---cpmCPUTotalMonIntervalValue-BEFORE.TESTING")

3. I configured the EEM applet with "get-type next" and OID "1.3.6.1.4.1.9.9.109.1.1.1.1.10" but I did not get anything I have added some files where you can check this (FILES "EEM.get-type next and SCREEN---EEM.get-type next").

4. I configured other option to specify a CPU entity (Index=1) "get-type exact" and OID "1.3.6.1.4.1.9.9.109.1.1.1.1.10.1" but I did not a successful result, I have attached some files where you can check this (FILES "EEM.get-type exact--cpmCPUTotalPhysicalIndex=OID.1 and SCREEN---EEM.get-type exact--cpmCPUTotalPhysicalIndex=OID.1").

I'm sure that I filled with valid mail information but I did not receive anything.

Do you know any idea how can I resolve or re-configure the EEM applet ¿?

Best Regards,

Joe Clarke · ‎02-04-2010

Post the output of an SNMP Walk of entPhysicalDescr.

Sergio Gaytan · ‎02-05-2010

Hi

This is the output of entPhysicalDescr.

Joe Clarke · ‎02-05-2010