EEM Script for collecting data during Intermittent High CPU issue

Document

Aug 18, 2011 11:46 PM
Aug 18th, 2011

Introduction

CPU going high is a very common issue which we all network Engineer face. Troubleshooting high CPU issue is a skill that every Network Engineer must possess in order to successfully handle a Cisco network. There are two general scenarios for CPU related issues:

  • CPU goes high and remains high.
  • CPU only goes high intermittently.

In the first situation, we can use our knowledge and experience or check online and find out why it’s behaving like (which is not that simple in real world). The second situation however, is trickier and gets extremely hard to troubleshoot as we don’t get much data to investigate the issue.

EEM, an integrated tool in Cisco IOS is very helpful in this condition. EEM offers the ability to monitor such events and take desired actions when such events occur.

1. Requirements

  • IOS used should support at least EEM 2.0 to run this script.

2. Components Used

Cisco 6500 switch with Sup 720 was used for this document creation

3.

Configuration

Here in this document we will learn how to use EEM in collecting data in condition where CPU is high intermittently:

1.       1. SSH/Telnet into the device

2.       2. Go to enable mode

  3.     3.  In configuration mode, type EEM script

event manager applet highCPU ßcreates a policy named highCPU

event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.5.1 get-type exact entry-op ge entry-val 1 poll-interval 5

(OID to define what data to compare against, in this example CPU value. Entry-val defines threshold value at which you want to start collecting data, poll-interval is the time period for each poll in seconds)

action 1.0 syslog msg "TAC-EEM: High CPU"

(Will generate a syslog message using message you provide)

action 2.0 cli command "enable"

(used to enter enable mode)

action 3.0 cli command "sh process CPU sorted | append disk0:proc CPU"

(the command whose output you desire, append disk0: will save the output in disk0 (you can specify other locations) and name of the file will be “proc CPU”)

You can specify other commands also in same way:

action 4.0 cli command "show spanning-tree summary | append disk0:spansum"

action 5.0 cli command "show log | append disk0:log"

action 6.0 cli command "show interface | in up|drops|append disk0:drops"

Finally, to take it one step further you can use below command to send the output of the captured commands to a specific mail address:

action 7.0 mail server "<SMTP server IP address>" to "abc@xyz.com" from "abc@xyz.com" subject "High CPU" body "$_cli_result"

(the last keyword “$_cli_result” will add the output of commands collected to the body of mail)

Related Information

CPU going high is a very common issue which we all network Engineer face. Troubleshooting high CPU issue is a skill that every Network Engineer must possess in order to successfully handle a Cisco network. There are two general scenarios for CPU related issues:

·        CPU goes high and remains high.

·        CPU only goes high intermittently.

In the first situation, we can use our knowledge and experience or check online and find out why it’s behaving like (which is not that simple in real worldJ). The second situation however, is trickier and gets extremely hard to troubleshoot as we don’t get much data to investigate the issue.

EEM, an integrated tool in Cisco IOS is very helpful in this condition. EEM offers the ability to monitor such events and take desired actions when such events occur

Average Rating: 0 (0 ratings)

Comments

cwoon Mon, 03/26/2012 - 04:14

How can the email be sent out when there is no login credential? Hope someone can help to answer. Thanks

pnagpal Tue, 03/27/2012 - 00:53 (reply to cwoon)

Hello,

Yes, No credentials are required for this mail address. You need to get in touch with the guy who handles Exchange Server in your team, he can get this setup for you.

Regards,

Pulkit

soliehm.jeevan Tue, 09/18/2012 - 03:36

Will the $_cli_result take the output of all the commands run in the applet? I tried this on a 3800 and its only logging the last command.

Is there a way to log all the commands rather than going through saving the output to a file and getting it displayed ?

Regards

Jeevan

Actions

Login or Register to take actions

This Document

Posted August 18, 2011 at 11:46 PM
Stats:
Comments:3 Avg. Rating:0
Views:6267 Contributors:3
Shares:0

Related Content

Documents Leaderboard

Rank Username Points
1 177
2 64
3 60
4 50
5 23
Rank Username Points
5
0