Joe,

The switches dont have access to the mail server. Without outputing the "show proc cpu sorted" via email, can i not syslog it?

Sure, you can, but that would a HUGE syslog message.  Some syslog servers have a 1024 byte maximum message size.  You could try something like "show proc cpu sorted | exc 0.00" to weed out some of the noise.

Joe,

I only need to run eem script for a short period time.

Should i expect to see the process PID consuming 50% of CPU on the syslog server with my eem script config?

All i see on the syslog server is the message " %HA_EM-2-LOG: highcpu: HIGH CPU". or there is a way to check event manager output on the switch to capture the process PID.

Thanks Joe

any one please.

Is the EEM the tool for what i am trying to do?

Any suggestion please.

Change action 3.0 to:

action 3.0 syslog priority critical msg "HIGH CPU: $_cli_result"

Joe,

That is very aggressive. it output to syslog all active processes even with 0.00% CPU utilization. All i want to capture is a process using 50% CPU.

Thanks

Francisco

That you can't do without Tcl or programmatic applets.  What version of IOS do you have?

12.2.18-SXF14 on C6500 and 12.2(24)T2.

Not possible to accomplish what i am trying to do with EEM?

Don't know much about tcl! Can you assist us?

Francisco

One facet of EEM is Tcl.  You are currently using an applet policy, but you could easily do what you want in Tcl.  The 12.4(24)T router would allow you to do what you want with an applet, but that wouldn't work on the 6500.  One Tcl policy could be made to do what you want on both.  I will post suhc a policy in a while.

Thank you Joe.

Here is a policy which will replace your existing applet policy.  Before you can register it, you must create a directory on flash to hold EEM Tcl policies.  For example, flash:/policies.  Then, copy the sn_alert_high_cpu.tcl script into this directory.  Then, you need to set three EEM environment variables in the running config.  For example, to maintain your current level of polling and threshold:

event manager environment high_cpu_cpu_id 1
event manager environment high_cpu_threshold 50
event manager environment high_cpu_poll_freq 5

Then configure:

event manager policy sn_alert_high_cpu.tcl

When the CPU crosses 50%, you should see a syslog which contains the top non-zero CPU consumers.

Joe,

Thanks for the script.

I think we are almost there.

Regarding the "event manager environment high_cpu_threshold 50", does the value 50 mean 50.00% or 0.50% of CPU?.

I am testing your tcl script in our lab before i use it in production. Since i am not generating lot of traffic on the switch i have changed the threshold to 8 instead. With a value of 8 i am seeing processes that's using 0.08% and above appearing on the syslog server (see below). if i change it to 50 i am see processes with 0.50% and above. That's good but i am interested in anything at 50.00% or above not 0.50%. Does that make sense?

Can we change the tcl file "High CPU threshold" to a number say between 0.00 and 100.00 to reflect 0.00% to 100.00%  ?

*Mar  1 01:14:02.379: %HA_EM-2-LOG: system:/lib/tcl/eem_scripts_registered/sn_alert_high_cpu.tcl: HIGH CPU: top processes: Compute load avg (0.25%) SSS Feature Time (0.08%) Virtual Exec (0.17%) Exec (0.08%) IGMP Input (0.34%) PIM Process (0.08%) EEM TCL Proc (25.74%) EEM ED SNMP (0.51%) Syslog (0.34%) RBSCP Background (0.08%) HC Counter Timer (0.08%) bsm_xmt_proc (0.17%) AAA SEND STOP EV (0.08%) EEM Server (0.76%) Mwheel Process (0.17%)

I configured the script to react when the overall CPU is high, then print out those top processes with non-zero CPU utilizations.  You may not be seeing one process at 50% when the overall CPU utilization is at 50.  I can certainly change the script, but I think the way it is working now is probably what you want.  Checking that an individual process' CPU utilization is at or above 50 may not yield anything.