Troubleshooting OSPF Flaps with EEM Script

Document

Apr 5, 2012 4:37 AM
Apr 5th, 2012

1. Introduction

Embedded Event Manager (EEM) is a powerful tool which monitor events and take informational, corrective, or any desired action when the monitored events occur. Capturing the state of the router during such situations can be invaluable in taking immediate recovery actions and gathering information to perform root-cause analysis.

2. Prerequisite


Understanding of OSPF Routing Protocol

3. Summary

This document shows how to collect information from Router when there is an OSPF flap and the message seen is "Neighbor Down: dead timer expired". This means that the Router did not receive OSPF hello from the neighbor for the dead interface (120) seconds and then dropped the OSPF neighborship.

For example,

%OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on GigabitEthernet0/1 from FULL to DOWN, Neighbor Down: Dead timer expired

To troubleshoot this situation an EEM is configured to check for an OSPF-neighbor-down syslog message; when it occurs, it executes the following command and saves the output as a text file "GET_CLI_OUTPUT.txt" in the flash memory.

This script will collect CPU, memory, interfaces and OSPF outputs and will also run a unicast ping to the neighbor as well as multicast check with neighbor. The script is configured in the config mode.

Logging buffered 80000

event manager scheduler applet thread class default number 1

event manager applet OSPF-FLAP

event syslog pattern "FULL to DOWN, Neighbor Down: Dead timer expired"

action 2.0 cli command "enable"

action 3.0 cli command "sh proc cpu sorted | append flash:GET_CLI_OUTPUT.txt"

action 3.5 cli command "show interface | append flash:GET_CLI_OUTPUT.txt"

action 3.10 cli command "show proc memory | append flash:GET_CLI_OUTPUT.txt"

action 3.15 cli command "sh ip ospf nei | append flash:GET_CLI_OUTPUT.txt"

action 3.20 cli command "sh ip ospf int br | append flash:GET_CLI_OUTPUT.txt"

action 3.25 cli command "ping 224.0.0.5 rep 10 time 1"

action 3.25 cli command "ping 224.0.0.6 rep 10 time 1"

action 3.30 cli command "ping 10.10.12.2 rep 10 time 1"

action 5.0 syslog msg "$_cli_result" priority 5

end

Note: To display the content of a file in a compact Flash memory card, use the more flash: command.

Router# more flash: GET_CLI_OUTPUT.txt

4. Restrictions

1. Append command was integrated in CISCO IOS Release 12.2T

2. In case AAA is configured, user would require a Username/Password for CLI access.

5. Verification Commands

  1. dir flash:
  2. more flash:GET_CLI_OUTPUT.txt

flash.bmp

Get CLI OUTPUT.bmp

6. References

Troubleshooting OSPF

EEM Configuration for Cisco Integrated Services Router Platforms

Average Rating: 0 (0 ratings)

Actions

Login or Register to take actions

This Document

Posted April 5, 2012 at 4:37 AM
Stats:
Comments:0 Avg. Rating:0
Views:2991 Contributors:0
Shares:0

Related Content

Documents Leaderboard

Rank Username Points
1 177
2 64
3 60
4 50
5 23
Rank Username Points
5
0