Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

EEM applet not working

Hi team,

Okay, so what we have observed in our network is that flow-export sometimes causes high interface utilization and as a workaround, we remove and re-add flow export commands. Now there are short burstd of traffic as well, so I want to add a condition where "burst happens 3 times in 60s, then trigger the event". As I cannot test in production router, so I am testing on a lab switch and there is not much traffic on it. txload/rxload is 1 and hence my applet looks like this:

sw1-trn-mr3.hyd.shaw.net#sh run | b event manager
event manager applet test authorization bypass
 event tag 1 interface name GigabitEthernet0/4 parameter txload entry-op ge entry-val 1 entry-type value exit-op lt exit-val 1 exit-type value poll-interval 10
 event tag 2 interface name GigabitEthernet0/4 parameter rxload entry-op ge entry-val 1 entry-type value exit-op lt exit-val 1 exit-type value poll-interval 10
 trigger occurs 3 period 60
  correlate event 1 or event 2
 action 1.1 cli command "enable"
 action 1.2 syslog msg "Interface utilization has risen again. "
 action 1.3 cli command "show proc cpu | append flash:test"
 action 1.4 cli command "show interface GigabitEthernet0/4 | append flash:test"
 action 1.6 cli command "show ip cache flow | append flash:test"
 action 1.7 cli command "show tech | append flash:test"
action 2.2 cli command "no ip flow-export source GigabitEthernet0/4"
 action 2.3 cli command "no ip flow-export destination 192.168.1.1 2055"
 action 2.5 cli command "ip flow-export source GigabitEthernet0/4"
 action 2.6 cli command "ip flow-export destination 192.168.1.1 2055"
 action 2.9 cli command "end"
!
end

The thing is it does not work. I turned on debugs and I see this.


Mar  3 15:30:46: fh_send_intf_fd_msg: msg_type=114

Mar  3 15:30:46: fh_send_intf_fd_msg: sval=0

Mar  3 15:30:46: fh_send_intf_fd_msg: msg_type=114

Mar  3 15:30:46: fh_send_intf_fd_msg: sval=0

Mar  3 15:30:54: fh_fd_intf_process_async

Mar  3 15:30:54: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 txload=1

Mar  3 15:30:54: intf_value_uint_compare:op1=1 op2=1 ret=TRUE

Mar  3 15:30:54: intf_entry_value_check:Returning TRUE

Mar  3 15:30:54: fh_fd_intf_event_match: re = 0x5849AA0, num_matches = 1



Mar  3 15:30:54: fh_fd_intf_start_poll_timer: start_t=10000

Mar  3 15:30:54: fh_fd_intf_process_poll_timer: update_t=0

Mar  3 15:30:54: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 rxload=1

Mar  3 15:30:54: intf_value_uint_compare:op1=1 op2=1 ret=TRUE

Mar  3 15:30:54: intf_entry_value_check:Returning TRUE

Mar  3 15:30:54: fh_fd_intf_event_match: re = 0x56D793C, num_matches = 1



Mar  3 15:30:54: fh_fd_intf_start_poll_timer: start_t=10000

Mar  3 15:30:54: fh_fd_intf_process_poll_timer: update_t=0

Mar  3 15:30:54: fh_send_intf_fd_msg: msg_type=64

Mar  3 15:30:54: fh_send_intf_fd_msg: sval=63

Mar  3 15:30:54: fh_send_intf_fd_msg: msg_type=64

Mar  3 15:30:54: fh_send_intf_fd_msg: sval=0

Mar  3 15:31:04: fh_fd_intf_process_async

Mar  3 15:31:04: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 txload=1

Mar  3 15:31:04: intf_value_uint_compare:op1=1 op2=1 ret=FALSE

Mar  3 15:31:04: intf_exit_value_check: re=0x5849AA0, returning=FALSE

Mar  3 15:31:04: intf_exit_comb_check:Returning FALSE

Mar  3 15:31:04: fh_fd_intf_event_match: re = 0x5849AA0, num_matches = 0



Mar  3 15:31:04: fh_fd_intf_start_poll_timer: start_t=10000

Mar  3 15:31:04: fh_fd_intf_process_poll_timer: update_t=0

Mar  3 15:31:04: fh_fd_intf_param_fetch:I/F=GigabitEthernet0/4 rxload=1

Mar  3 15:31:04: intf_value_uint_compare:op1=1 op2=1 ret=FALSE

Mar  3 15:31:04: intf_exit_value_check: re=0x56D793C, returning=FALSE

Mar  3 15:31:04: intf_exit_comb_check:Returning FALSE

Mar  3 15:31:04: fh_fd_intf_event_match: re = 0x56D793C, num_matches = 0

Only the first time, it returns TRUE. After that, it returns FALSE always and hence the condition "trigger occurs 3 period 60" does not match and hence no event is triggered. Where am I going wrong?
Appreciate your help on this.

Thanks.
1 REPLY
Cisco Employee

EEM applet not working

314
Views
0
Helpful
1
Replies