Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

EEM applet: event correlation question

Hi,

I want to develop an applet using correlation of 2 events:

- CPU load behond a threshhold

AND

- specific syslog message received

What I want is to launch actions when the 2 events occur in the same tme.

My doubt is: what happens if the switch detect a CPU load one day, then receive the syslog mesasge another day? Does the appletconsider the event happened, and wait (without limit of time) up to have the 2d event occuring? Or it there a timeout or a way to implement a timeout?

thanks by advance

P.

2 REPLIES
Cisco Employee

EEM applet: event correlation question

You get to specify the time window for the correlation.  Use the command:

trigger period 1

That means both events must occur within the same second for the applet to fire.

Community Member

Re: EEM applet: event correlation question

Hi..

You can use 2 scripts and 2 snmp RW variables (i.e. description of an unused interface).

First script; to control snmp RW variables AND your events. According to your events you can set variables from 0 to 1.

Second script; to reset variables from 1 to 0 if nothing happens in an limited time.

first script: to set variables according to events (running every 15 seconds)

cpu load variable 0, specific syslog message variable 0 : do nothing

cpu load variable 0, specific syslog message variable 1 : do nothing

cpu load variable 1, specific syslog message variable 0 : do nothing

cpu load variable 1, specific syslog message variable 1 : launch actions

second script:

reset variables in 20 seconds

Mustafa..

473
Views
0
Helpful
2
Replies
CreatePlease to create content