How do I write a eem script to catch high cpu on cat6k?

[cchrysle]

Hi,

I have a high cpu condition I am trying to catch in a 6509 with a WS-SUP720-3B

running s72033-advipservicesk9_wan-mz.122-33.SXI2a  code.

I configured this eem script but even when this message is printed in the log, it doesn't execute.

*Jun 9 19:15:48.822: %HA_EM-6-LOG: cpu_stats: ------HIGH CPU DETECTED----, CPU: 92%

Am I missing a parameter on my trigger?

event manager applet cpu_stats

event syslog pattern "%HA_EM-6-LOG: cpu_stats: ------HIGH CPU DETECTED----" maxrun 120

action 1.02 cli command "enable"

action 1.03 cli command "show clock | append disk0:cpu_stats"

action 1.04 cli command "show proc cpu sort | append disk0:cpu_stats"

action 1.05 cli command "Show proc cpu history | append disk0:cpu_stats"

action 1.06 cli command "debug netdr cap rx"

action 1.07 cli command "show tcp brief | append disk0:cpu_stats"

action 1.08 cli command "show ibc | append disk0:cpu_stats"

action 1.09 cli command "show platform hardware capacity ibc | append disk0:cpu_stats"

action 1.15 cli command "show netdr cap | append disk0:cpu_stats"

action 1.16 cli command "undebug all"

This is from the show logg:

*Jun 9 19:15:48.822: %HA_EM-6-LOG: cpu_stats: ------HIGH CPU DETECTED----, CPU: 92%

*Jun 9 19:23:44.066: %HA_EM-6-LOG: cpu_stats: ------HIGH CPU DETECTED----, CPU: 91%

*Jun 9 19:44:18.862: %SYS-5-CONFIG_I: Configured from console by console

*Jun 9 19:49:34.718: %HA_EM-6-LOG: cpu_stats: ------HIGH CPU DETECTED----, CPU: 91%

*Jun 9 19:50:58.962: %SYS-5-CONFIG_I: Configured from console by console

But the disk0:cpu_stats file never gets data appended to it.

Thank you in advance for any assistance,

Chris

[Joe Clarke]

I'm betting you need to do:

event manager session cli username USER

Where USER is a user authorized to execute all of these commands.  This assumes you have command authorization enabled.  If not, post the output of "debug event manager action cli".

[cchrysle]

Hi Joseph,

I have a continuous ping from a 4500 to this 6500.

I enabled the debug event manager action cli but got limited output.

So enabled debug event manager all.

Here is the output:

*Jun 10 15:30:20.673: cli_history_entry_add: free_hist_list size=0, hist_list size=7

*Jun 10 15:30:20.673: check_eem_cli_policy_handler: num_matches = 0, response_code = 1d

c6500#

*Jun 10 15:30:22.417: cli_history_entry_add: free_hist_list size=0, hist_list size=7

*Jun 10 15:30:22.417: check_eem_cli_policy_handler: command_string=end

*Jun 10 15:30:22.417: check_eem_cli_policy_handler: num_matches = 0, response_code = 1

*Jun 10 15:30:22.417: fh_fd_config_event_match: num_matches = 0

*Jun 10 15:30:22.417: fh_fd_config_event_notify:

*Jun 10 15:30:22.429: fh_fd_syslog_event_match: num_matches = 0

*Jun 10 15:30:22.429: fh_fd_data_syslog: num_matches = 0

*Jun 10 15:31:00.001: fh_fd_timer_process_async

*Jun 10 15:31:00.001: cron_tick: num_matches 0

*Jun 10 15:32:00.005: fh_fd_timer_process_async

*Jun 10 15:32:00.005: cron_tick: num_matches 0

*Jun 10 15:33:00.001: fh_fd_timer_process_async

*Jun 10 15:33:00.001: cron_tick: num_matches 0

c6500#debu event mana

*Jun 10 15:34:00.001: fh_fd_timer_process_async

*Jun 10 15:34:00.001: cron_tick: num_matches 0ger action cli

Debug EEM action cli debugging is on

c6500#

*Jun 10 15:34:08.181: cli_history_entry_add: free_hist_list size=0, hist_list size=7

*Jun 10 15:34:08.181: check_eem_cli_policy_handler: command_string=debug event manager action cli

*Jun 10 15:34:08.181: check_eem_cli_policy_handler: num_matches = 0, response_code = 1

*Jun 10 15:35:00.001: fh_fd_timer_process_async

*Jun 10 15:35:00.001: cron_tick: num_matches 0

*Jun 10 15:36:00.009: fh_fd_timer_process_async

*Jun 10 15:36:00.009: cron_tick: num_matches 0

*Jun 10 15:37:00.001: fh_fd_timer_process_async

*Jun 10 15:37:00.001: cron_tick: num_matches 0

*Jun 10 15:38:00.001: fh_fd_timer_process_async

*Jun 10 15:38:00.001: cron_tick: num_matches 0

C6500# sh proc cpu

CPU utilization for five seconds: 93%/11%; one minute: 91%; five minutes: 90%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

Thank you for your help,

Chris

[Joe Clarke]

Ah, sorry, I missed your event trigger.  EEM cannot match syslog messages that it generates.  Your applet here will never trigger.  Why not use "process cpu threshold ..." to enable a CPU threshold, then match on the CPURISINGTHRESHOLD pattern?