Multiple Event SNMP Triggers in a script.

[IAN HOLMES]

I gather EMM 2.4 now allows multiple Event triggers for SNMP in the one script. Do I just add the ::cisco::eem::event_register_snmp oid lines multiple times ?? And how do I differentiate the $_snmp_oid_val values returned from the different Events in order to call upon them separately ??

[IAN HOLMES]

Traps don't match expected behaviour. I cannot get the system to consistently trap when an access-list blocks packets. I see the logged packets blocked, the IP SLA job only shows them after it has compeleted. And it appears that is when the OID values are updated. Therefore I have brought the SLA job frequency down to 10 seconds....and the applet event poll to 2 seconds. I am getting more traps as expected, but still some fail to be triggered. What is the function of the Increment feature....how does it handle the OID counter wrap ? The system just seems to go to sleep.....I can see the OID walk showing a value > 0 and the polling event applet just doesn't seem to grab it....even though it should be testing every 2 seconds.

[Joe Clarke]

You'll need to provide the actual show run from the device. I'm not really sure what you're seeing.

[IAN HOLMES]

I have attached the key config. It is not really clear but I have blocked multiple times and nothing is captured. Then suddenly one will work. The OID value is only available for the period of the process, but as this is 10 seconds, and the event poll interval is 2 seconds, they should overlap. I cannot use the OID stored in historical OID as it's OID has an associated timestamp, and is therefore always changing.....can only use this "latest" OID for UDP-Jitter PacketsLostDS

[Joe Clarke]

The problem is you're using the entry-type of increment. This won't work correctly for rttMonLatestJitterOperPacketLossDS since the object is implemented as a Gauge, and gauges can both increment and decrement between polls (i.e. in one poll the value may be 5, and in the next poll, the value could be 1). The increment type is only applicable for monotonically increasing counters. What you want is:

event snmp oid 1.3.6.1.4.1.9.9.42.1.5.2.1.27.12 get-type exact entry-op ge entry-val 1 poll-interval 2

Really, 2 seconds is too low. It is recommended that you poll no quicker than every 10 seconds.

[Joe Clarke]

On top of this, since your IP SLA frequency is 10, you should stick to a 10 second SNMP polling period.

[IAN HOLMES]

Set poll-interval to 10 seconds, and removed entry-type inc. That tracks correctly..... excellent. One access-list block for one trap....sometimes two if they fall across an IPSLA process period. I was assuming the OID value was watching the latest process as described, but it tracts the last completed process. So it makes sense increment process would be watching and sometimes seeing values that are non-zero but lower that the last inc value. Hence the intermittent nature...and zero values are anyones guess. The devil in the detail.....having the IPSLA at 10 seconds gives the roll-up values needed....I was trying to use the event poll to give the 10 seconds blocks. Thanks Joe. Now that all works I can start the TCL side. had to get the basics working.

[IAN HOLMES]

Receiving error when registering script: Trying to follow config guidelines....applet multi-event works O.K.

Register event failed: Only correlate and attribute statements are allowed within trigger

while executing

"::cisco::eem::trigger {

::cisco::eem::correlate event 1 or event 2

::cisco::eem::attribute tag 1 occurs 1

::cisco::eem::attribute tag 2 occurs 1

} o..."

Embedded Event Manager configuration: failed to retrieve intermediate registration result for policy AdelaideSW.tcl

IVisionPoller(config)#

Config:

::cisco::eem::event_register_snmp tag 1 oid 1.3.6.1.4.1.9.9.42.1.5.2.1.27.12 get_type exact entry_op ge entry_val 2 poll_interval 10

::cisco::eem::event_register_snmp tag 2 oid 1.3.6.1.4.1.9.9.42.1.5.2.1.26.12 get_type exact entry_op ge entry_val 2 poll_interval 10

::cisco::eem::trigger {

::cisco::eem::correlate event 1 or event 2

::cisco::eem::attribute tag 1 occurs 1

::cisco::eem::attribute tag 2 occurs 1

} occurs 1

[Joe Clarke]

The document is misleading. All of these commands must be on the same line:

::cisco::eem::trigger { ::cisco::eem::correlate event 1 or event 2 ::cisco::eem::attribute tag 1 occurs 1 ::cisco::eem::attribute tag 2 occurs 1 } occurs 1

[IAN HOLMES]

Register event failed:Invalid argument "::cisco::eem::attribute"

while executing

"::cisco::eem::correlate event 1 or event 2 ::cisco::eem::attribute tag 1 occurs 1 ::cisco::eem::attribute tag 2 occurs 1"

invoked from within

"::cisco::eem::trigger { ::cisco::eem::correlate event 1 or event 2 ::cisco::eem::attribute tag 1 occurs 1 ::cisco::eem::attribute tag 2 occurs 1 } occ..."

Tried altering the config as a guess and remove the second attribute command.....

so the line was:

::cisco::eem::trigger { ::cisco::eem::correlate event 1 or event 2 ::cisco::eem::attribute tag 1 occurs 1 tag 2 occurs 1 } occurs 1

But another error:

IVisionPoller(config)#event manager policy AdelaideSW.tcl typ user

Register event failed:Invalid argument "::cisco::eem::attribute"

while executing

"::cisco::eem::correlate event 1 or event 2 ::cisco::eem::attribute tag 1 occurs 1 tag 2 occurs 1"

invoked from within

"::cisco::eem::trigger { ::cisco::eem::correlate event 1 or event 2 ::cisco::eem::attribute tag 1 occurs 1 tag 2 occurs 1 } occurs 1"

[Joe Clarke]

I'm looking into this. I'll get back to you.

[Joe Clarke]

You're hitting CSCsr44967 which won't be fixed until the next 12.4T release. I'll see if I can get this pushed into a 12.4(20)T throttle build.

[Joe Clarke · Accepted solution]

Try this as a workaround:

:cisco::eem::event_register_snmp tag 1 oid 1.3.6.1.4.1.9.9.42.1.5.2.1.27.12 get_type exact entry_op ge entry_val 2 poll_interval 10

::cisco::eem::event_register_snmp tag 2 oid 1.3.6.1.4.1.9.9.42.1.5.2.1.26.12 get_type exact entry_op ge entry_val 2 poll_interval 10

::cisco::eem::trigger {

::cisco::eem::correlate event 1 or event 2

::cisco::eem::attribute tag 1 occurs 1

::cisco::eem::attribute tag 2 occurs 1

} occurs 1

Note: there is a single space before the '}' character.

[IAN HOLMES]

It has loaded after putting the config back into multi-line format, and adding the space before the "}" as suggested. Thanks.