How can I configure an EEM applet event to be triggered by the increment of local snmp counter oid?

[Alfred Johnson]

I am trying to use an EEM applet triggered by the incrementing of an snmp counter oid by the VoIP sip-ua on the local router/voice gateway.  When the counter is incremented, the applet will execute some IOS commands that force the sip-ua to do a new registration with its SIP Proxy.  The specific oid is shown below:

CISCO-SIP-UA-MIB :: cSipStatsClientForbiddenIns
Name
cSipStatsClientForbiddenIns
Oid    1.3.6.1.4.1.9.9.152.1.2.4.7

cSipStatsClientForbiddenIns OBJECT-TYPE
    SYNTAX      Counter32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
         "This object reflects the total number of Forbidden (403)
          responses received by the user agent since system startup.
          Inbound Forbidden responses indicate that requests issued
          by this system are understood by the server but the server
          refuses to fulfill the request.  Authorization will not help
          and the requests should not be repeated."
    REFERENCE
         "RFC 2543, Sections 5.1.1 & 7.4.4"  
    ::= { cSipStatsErrClient 7 }

I see at least 2 different snmp event syntaxes in the EEM documentation:

event manager applet sip-register-on-403
   event snmp-object oid 1.3.6.1.4.1.9.9.152.1.2.4.7 type counter sync yes

   action 100 cli command "en"

   . . .

or

event manager applet sip-register-on-403
  event snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.7 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 90
  action 100 cli command "en"

  . . .

I am not getting a clear idea of what the difference is between these two snmp event syntaxes or how exactly they work.  If possible, I would like to avoid a constant background polling of the oid, in favoring of 'registering' with the snmp subsystem, so that it immediately invokes the applet actions only when the oid increment event occurs.  Polling slows the response time and consumes CPU time even when the 403 event never occurs.

What syntax do you recommend and why?

Thanks in advance.

Alfy Johnson

Time Warner Cable, Herndon, VA.

[cwildes]

Alfy,

Use the following to monitor an SNMP object within the box:

event manager applet sip-register-on-403

  event snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.7 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 90
  action 100 cli command "en"

  ....

The snmp-object ED is used to monitor for SNMP Get requests and then to potentially replace/augment the data with you own data. This ED can be used to:

- add a new MIB

- add a new OID to an existing MIB

- replace data for an existing OID with you own data.

There is no way to avoid background polling with the SNMP ED. Please note that in my experience the overhead of background polling is minimal. The polling is done within the ED code which is written in C and has a relatively short instruction path.

Use the "debug event manager detector snmp" command to enable debugging for the SNMP ED to assist in your debugging.

I hope this helps.

Thanks,

Clyde Wildes

[Joe Clarke · Accepted solution]

In addition to Clydes comments, you need to be careful with the object you select.  As you have it now, your policy will not work.  You have to specify an instance for your object to be able to do a get-type of exact.  Try this:

event manager applet sip-register-on-403
  event snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.7.0 get-type exact entry-op ge entry-val "1" entry-type increment exit-op eq exit-val "0" exit-type increment poll-interval 90
  action 100 cli command "en"
  ...

The addition of an exit criterion will mean that your policy will not continue to trigger after the error count increments by 1 (i.e. it will only trigger again when the error count increments by one or more again).

[Alfred Johnson]

Thanks for your help back in June.  The '.0' on the end of the OID was what was needed to get it to work.