Cisco EEM Configuration question

[network_user]

Hello,

I am trying to configure a cisco EEM applet so that I can send an snmp trap from the router whenever an interface drops output packets. I have below configuration on my router and I see counter "Total output drops" on the interface go up sporadically once in a while , but there is no trap generated by EEM applet. Does anybody know what am I doing wrong?

Configuration----------

event manager applet interface-drops

event interface name s0/4:0 parameter output_packets_dropped entry-val 1 entry-op ge entry-val-is-increment true exit-val 1 exit-op lt exit-val-is-increment true poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

Outut of sh event manager policy registered-----------

#sh event manager policy registered

No.  Class   Type    Event Type          Trap  Time Registered           Name

1    applet  system  interface           Off   Thu Apr 5 16:38:19 2012   interface-drops

name {s0/4:0} parameter {output_packets_dropped} entry_op ge entry_val 1 entry_val_is_increment TRUE entry_op ge entry_val 1 entry_val_is_increment TRUE exit_op lt exit_val 1 exit_val_is_increment TRUE poll_interval 60.000

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_vlaue $_interface_parameter over the last 60 seconds"

Output of sh event manager history traps---------- no traps generated

#sh event manager history traps

No.  Time                      Trap Type           Name

Output of sh int s0/4:0----------

Serial0/4:0 is up, line protocol is up

  Hardware is GT96K Serial

  Description: xxxxxx

  Internet address is 192.168.8.21/30

  MTU 1500 bytes, BW 1216 Kbit, DLY 20000 usec,

     reliability 255/255, txload 32/255, rxload 20/255

  Encapsulation HDLC, loopback not set

  Keepalive set (10 sec)

  Last input 00:00:00, output 00:00:00, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 27536

  Queueing strategy: weighted fair

  Output queue: 0/1000/64/27536 (size/max total/threshold/drops)

     Conversations  0/20/256 (active/max active/max total)

     Reserved Conversations 0/0 (allocated/max allocated)

     Available Bandwidth 912 kilobits/sec

  5 minute input rate 97000 bits/sec, 82 packets/sec

  5 minute output rate 156000 bits/sec, 79 packets/sec

     88724321 packets input, 4031740466 bytes, 0 no buffer

     Received 91787 broadcasts, 0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

     82094273 packets output, 2883635784 bytes, 0 underruns

     0 output errors, 0 collisions, 6 interface resets

     0 output buffer failures, 0 output buffers swapped out

     1 carrier transitions

  Timeslot(s) Used:1-24, SCC: 4, Transmitter delay is 0 flags

Thank you.

[yjdabear]

Maybe EEM doesn't understand the s0/4:0 shorthand. Try "Serial 0/4:0" or "Serial0/4:0".

[network_user]

Hello yjdabear,

I tried using Serial0/4:0 and it still does not work. I still don't see any trap generated.

Thank you.

[yjdabear]

Can you post what the applet is doing with the following, while keeping an eye on if "Total output drops" is incrementing in another terminal?

debug event manager action cli

show event manager policy registered event-type interface

[Joe Clarke]

This policy doesn't do anything with CLI, so debug event manager action cli won't show anything.  Enabling "debug event manager detector interface" might show some useful information.  You also need to make sure "snmp-server enable traps event-manager" is configured.

[network_user]

Hello Joseph,

I added "snmp-server enable traps event-manager" command to the configuration. However it still does not generate a trap when "Total output drops" counter goes up. I will try the debug commands and see if I find anything.

Thank you.

[network_user]

Hello Joseph and jydabear,

I tested my Cisco EEM applet configuration over a Cisco 1811 router and there it works juts fine and traps are generated by the 1811 router. However when I try to run the same configuration on Cisco 3745 IOS version 12.3 it does not generate a trap. When I looked at the logs of this router I see a EEM message as below. I think it is not able to find the value for $_interface_delta_value and so it does not generate a trap. Do you know how to define this varaible in my configuration so that it knows how to calculate it??

Apr  9 17:07:25.191 UTC: %HA_EM-3-FMPD_UNKNOWN_ENV: fh_parse_var: could not find environment variable: _interface_delta_value

Thank you.

[network_user]

Below is the output from "debug event manager detector interface". As you can see the match happens when the counter value increases, however its not able to calculate the delta value.

Apr  9 18:07:24.999 UTC: fh_fd_intf_process_timer: re=0x66FBE8F4, fh_timer_type=POLL
Apr  9 18:07:24.999 UTC: fh_fd_intf_param_fetch:I/F=Serial0/4:0; output_pkt_drop=38162
Apr  9 18:07:24.999 UTC: intf_value_check:curr_val=122, thold_val=1, Returning TRUE fh_fd_intf_event_match: re = 0x66FBE8F4, num_matches = 1

Apr  9 18:07:24.999 UTC: fh_fd_intf_process_timer: update_t=1200000fh_fd_intf_info_publish: pe = 0x654026D4

Apr  9 18:07:24.999 UTC: %HA_EM-3-FMPD_UNKNOWN_ENV: fh_parse_var: could not find environment variable: _interface_delta_value

[Joe Clarke · Accepted solution]

You're code is too old for the _interface_delta_value variable.  Use _interface_value instead.  The difference will be counted.

[network_user]

Thanks Joseph! That worked!