EEM script for high CPU

CORY HEBERT · ‎03-06-2014

Hi, all. So I have a simple EEM script for my 4507 closet switches to poll every minute for high CPU (above 75%), and log it to bootflash:

event manager applet HIGH_CPU

event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge entry-val "75" poll-interval 60

action 10 syslog msg "High CPU detected. Logging latest information to bootflash:high_cpu.txt"

action 20 cli command "term exec prompt timestamp"

action 30 cli command "show process cpu sorted | redirect bootflash:high_cpu.txt"

action 40 cli command "y"

action 50 cli command "term no exec prompt timestamp"

And I can see the applet being triggered:

SWITCH#sh event manager history events

No. Job Id Status Time of Event Event Type Name

1 21 success Sun Mar 2 00:40:23 2014 snmp applet: HIGH_CPU

2 22 success Sun Mar 2 02:01:24 2014 snmp applet: HIGH_CPU

3 23 success Mon Mar 3 00:31:35 2014 snmp applet: HIGH_CPU

4 24 success Mon Mar 3 02:01:36 2014 snmp applet: HIGH_CPU

5 25 success Tue Mar 4 00:30:47 2014 snmp applet: HIGH_CPU

6 26 success Tue Mar 4 02:00:48 2014 snmp applet: HIGH_CPU

7 27 success Tue Mar 4 02:01:48 2014 snmp applet: HIGH_CPU

8 28 success Wed Mar 5 00:31:00 2014 snmp applet: HIGH_CPU

9 29 success Wed Mar 5 02:01:00 2014 snmp applet: HIGH_CPU

10 30 success Thu Mar 6 00:31:12 2014 snmp applet: HIGH_CPU

...but there seems to be a problem executing the script according to the logs:

002700: Mar 5 00:31:00.394 cst: %PARSER-3-CFGLOG_NOMEM: User: command:connect y

002701: Mar 5 00:31:00.438 cst: %PARSER-3-CFGLOG_NOMEM: User: command:terminal no exec prompt timestamp

002703: Mar 5 02:01:00.787 cst: %PARSER-3-CFGLOG_NOMEM: User: command:terminal exec prompt timestamp

002704: Mar 5 02:01:00.899 cst: %PARSER-3-CFGLOG_NOMEM: User: command:connect y

002705: Mar 5 02:01:00.911 cst: %PARSER-3-CFGLOG_NOMEM: User: command:terminal no exec prompt timestamp

002708: Mar 6 00:31:12.097 cst: %PARSER-3-CFGLOG_NOMEM: User: command:terminal exec prompt timestamp

002709: Mar 6 00:31:12.121 cst: %PARSER-3-CFGLOG_NOMEM: User: command:connect y

002710: Mar 6 00:31:12.145 cst: %PARSER-3-CFGLOG_NOMEM: User: command:terminal no exec prompt timestamp

Really not sure what the issue is. Seems like a pretty straightforward script.

Thanks for any assistance.

Joe Clarke · ‎03-06-2014

You need to add:

action 15 cli command "enable"

But it could also be that your router is out of memory, and the CLI cannot be execute. You might also want to simplify this by doing:

action 25 cli command "del /force bootflash:high_cpu.txt"

action 30 cli command "show proc cpu sort | redirect bootflash:high_cpu.txt"

Then drop actions 40 and 50. The way it's written now won't work as you'd have to add a "pattern" keyword to your action 30 anyway.

CORY HEBERT · ‎03-14-2014

Thank you so much, Joseph. You're the best.

For those who will read this post later, here are the 2 options I tried successfully in the lab:

event manager applet HIGH_CPU

event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge entry-val 75 poll-interval 60

action 10 syslog msg "High CPU detected. Logging latest information to bootflash:high_cpu.txt"

action 20 cli command "enable"

action 30 cli command "term exec prompt timestamp"

action 40 cli command "show process cpu sorted | redirect bootflash:high_cpu.txt" pattern "confirm"

action 50 cli command "y"

action 60 cli command "term no exec prompt timestamp"

******************************************************************************************

event manager applet HIGH_CPU

event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge entry-val 75 poll-interval 60

action 10 syslog msg "High CPU detected. Logging latest information to bootflash:high_cpu.txt"

action 20 cli command "enable"

action 30 cli command "term exec prompt timestamp"

action 40 cli command "delete /force bootflash:high_cpu.txt"

action 50 cli command "show process cpu sorted | redirect bootflash:high_cpu.txt"

action 60 cli command "term no exec prompt timestamp"