03-04-2012 04:36 AM
Hi team, Okay, so what we have observed in our network is that flow-export sometimes causes high interface utilization and as a workaround, we remove and re-add flow export commands. Now there are short burstd of traffic as well, so I want to add a condition where "burst happens 3 times in 60s, then trigger the event". As I cannot test in production router, so I am testing on a lab switch and there is not much traffic on it. txload/rxload is 1 and hence my applet looks like this: sw1-trn-mr3.hyd.shaw.net#sh run | b event manager event manager applet test authorization bypass event tag 1 interface name GigabitEthernet0/4 parameter txload entry-op ge entry-val 1 entry-type value exit-op lt exit-val 1 exit-type value poll-interval 10 event tag 2 interface name GigabitEthernet0/4 parameter rxload entry-op ge entry-val 1 entry-type value exit-op lt exit-val 1 exit-type value poll-interval 10 trigger occurs 3 period 60 correlate event 1 or event 2 action 1.1 cli command "enable" action 1.2 syslog msg "Interface utilization has risen again. " action 1.3 cli command "show proc cpu | append flash:test" action 1.4 cli command "show interface GigabitEthernet0/4 | append flash:test" action 1.6 cli command "show ip cache flow | append flash:test" action 1.7 cli command "show tech | append flash:test" action 2.2 cli command "no ip flow-export source GigabitEthernet0/4" action 2.3 cli command "no ip flow-export destination 192.168.1.1 2055" action 2.5 cli command "ip flow-export source GigabitEthernet0/4" action 2.6 cli command "ip flow-export destination 192.168.1.1 2055" action 2.9 cli command "end" ! end The thing is it does not work. I turned on debugs and I see this. Mar 3 15:30:46: fh_send_intf_fd_msg: msg_type=114 Mar 3 15:30:46: fh_send_intf_fd_msg: sval=0 Mar 3 15:30:46: fh_send_intf_fd_msg: msg_type=114 Mar 3 15:30:46: fh_send_intf_fd_msg: sval=0 Mar 3 15:30:54: fh_fd_intf_process_async Mar 3 15:30:54: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 txload=1 Mar 3 15:30:54: intf_value_uint_compare:op1=1 op2=1 ret=TRUE Mar 3 15:30:54: intf_entry_value_check:Returning TRUE Mar 3 15:30:54: fh_fd_intf_event_match: re = 0x5849AA0, num_matches = 1 Mar 3 15:30:54: fh_fd_intf_start_poll_timer: start_t=10000 Mar 3 15:30:54: fh_fd_intf_process_poll_timer: update_t=0 Mar 3 15:30:54: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 rxload=1 Mar 3 15:30:54: intf_value_uint_compare:op1=1 op2=1 ret=TRUE Mar 3 15:30:54: intf_entry_value_check:Returning TRUE Mar 3 15:30:54: fh_fd_intf_event_match: re = 0x56D793C, num_matches = 1 Mar 3 15:30:54: fh_fd_intf_start_poll_timer: start_t=10000 Mar 3 15:30:54: fh_fd_intf_process_poll_timer: update_t=0 Mar 3 15:30:54: fh_send_intf_fd_msg: msg_type=64 Mar 3 15:30:54: fh_send_intf_fd_msg: sval=63 Mar 3 15:30:54: fh_send_intf_fd_msg: msg_type=64 Mar 3 15:30:54: fh_send_intf_fd_msg: sval=0 Mar 3 15:31:04: fh_fd_intf_process_async Mar 3 15:31:04: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 txload=1 Mar 3 15:31:04: intf_value_uint_compare:op1=1 op2=1 ret=FALSE Mar 3 15:31:04: intf_exit_value_check: re=0x5849AA0, returning=FALSE Mar 3 15:31:04: intf_exit_comb_check:Returning FALSE Mar 3 15:31:04: fh_fd_intf_event_match: re = 0x5849AA0, num_matches = 0 Mar 3 15:31:04: fh_fd_intf_start_poll_timer: start_t=10000 Mar 3 15:31:04: fh_fd_intf_process_poll_timer: update_t=0 Mar 3 15:31:04: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 rxload=1 Mar 3 15:31:04: intf_value_uint_compare:op1=1 op2=1 ret=FALSE Mar 3 15:31:04: intf_exit_value_check: re=0x56D793C, returning=FALSE Mar 3 15:31:04: intf_exit_comb_check:Returning FALSE Mar 3 15:31:04: fh_fd_intf_event_match: re = 0x56D793C, num_matches = 0 Only the first time, it returns TRUE. After that, it returns FALSE always and hence the condition "trigger occurs 3 period 60" does not match and hence no event is triggered. Where am I going wrong? Appreciate your help on this.
Thanks.
03-04-2012 10:57 AM
This is a dup of https://supportforums.cisco.com/message/3578345#3578345.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide