Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

EEM Script to enable netdr on high CPU utilization

Hi All,

 

I need help in creating a EEM script in Cisco router 7606 as per below requirement:

 

>> Monitor CPU Utilization

>> I want script to start working only When CPU Utilization remains more than 85% for atleast 5 minutes

>> Once event is triggered i.e, CPU utilization remains more than 85% for more than 5 minutes, take following action:

First, clear netdr cap packets >> "debug netdr clear-cap"

Enable netdr capture >> "debug netdr capture rx"

Wait for 5 secs

Stop netdr capture >> "no debug netdr capture rx"

 

Please help. Thanks in Advance.

 

Regards,

Nishant

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Something like this should

Something like this should work:

 

event manager applet high-cpu

 event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

 action 1.0 cli command "enable"

 action 2.0 cli command "debug netdr clear-cap"

 action 3.0 cli command "debug netdr capture rx"

 action 4.0 wait 5

 action 5.0 cli command "no debug netdr capture rx"

7 REPLIES
Cisco Employee

Something like this should

Something like this should work:

 

event manager applet high-cpu

 event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

 action 1.0 cli command "enable"

 action 2.0 cli command "debug netdr clear-cap"

 action 3.0 cli command "debug netdr capture rx"

 action 4.0 wait 5

 action 5.0 cli command "no debug netdr capture rx"

New Member

Hi Joseph, Thanks for reply.

Hi Joseph,

 

Thanks for reply.

 

I am new to EEM script, it would be great if you explain first line of event manager little bit :

event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

Also, don't we need to send enable password after enable command ??

 

Thanks,

Nishant

 

Cisco Employee

The first line looks at the

The first line looks at the CPU 5 minute total busy percentage.  If the percentage is at or above 85, the policy will fire.  It will not fire again until the percentage drops below 85 then rises again.

 

No, you do not need an enable password.  EEM is only concerned with authorization, not authentication.

New Member

Hi Joseph, Is it possible to

Hi Joseph,

 

Is it possible to check two parameters for triggering script ?

Suppose I want to monitor CPU utilization and "ARP Input Process" for triggering script.

Like CPU Utilization for 5min > 85% and "ARP Input Process" utilization >10%, then only script fires.

 

Thanks,

Nishant

Cisco Employee

If you know the ID of the ARP

If you know the ID of the ARP process you can create a multiple event policy.  Something like:

 

event tag system snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

event tag arp snmp oid " 1.3.6.1.4.1.9.9.109.1.2.2.1.7.1.184" get-type exact entry-op ge entry-val 10 exit-op lt exit-val 10 poll-interval 60

trigger

 correlate event system and event arp

 

Note: the "184" value here needs to be replaced with the actual process ID of the ARP Input Process.

New Member

ARP input process ID is 12.

ARP input process ID is 12. So, script becomes:

event manager applet high-cpu

event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

event tag arp snmp oid " 1.3.6.1.4.1.9.9.109.1.2.2.1.7.1.12" get-type exact entry-op ge entry-val 10 exit-op lt exit-val 10 poll-interval 60

trigger

 correlate event system and event arp

action 1.0 cli command "enable"

 action 2.0 cli command "debug netdr clear-cap"

 action 3.0 cli command "debug netdr capture rx"

 action 4.0 wait 5

 action 5.0 cli command "no debug netdr capture rx"

 

Is it correct ??

Cisco Employee

Assuming 12 is the PID of ARP

Assuming 12 is the PID of ARP Input Process, then that is right.  But you are missing the "tag system" in the first event registration line.

482
Views
0
Helpful
7
Replies
CreatePlease to create content