Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Packet drop

Hi,

Is there a way a SNMP trap can be generated with a packet drop on an interface.

Can RMON handle a packet drop notification. Also, is there any syslog message which is generated for this.

Thanks

12 REPLIES

Re: Packet drop

Check to see if your device support this old mib, that would be way to get the queue drops:

From OLD-CISCO-INTERFACES-MIB

locIfInputQueueDrops = .1.3.6.1.4.1.9.2.2.1.1.26

locIfOutputQueueDrops = .1.3.6.1.4.1.9.2.2.1.1.27

If those OID are on your router, then as you said, you can try to use rmon with it.

example:

mon alarm 1 1.3.6.1.4.1.9.2.2.1.1.26.2 1 absolute rising-threshold 1 falling-threshold 1 1

Then you use an rmon event to trigger the trap, as per the standard configuration guide:

http://www.cisco.com/en/US/partner/tech/tk648/tk362/tk560/tsd_technology_support_sub-protocol_home.html

Now, you have to add the interface index to it at the end :1.3.6.1.4.1.9.2.2.1.1.26.X where X is the interface index, you can get that by doing an snmpwalk on ifname to match it.

Cisco Employee

Re: Packet drop

This example won't yield desired results. The queue drop objects are counters, and an absolute counter value doesn't tell you much. You would want to use delta.

However, I mush prefer the EEM approach. EEM allows you to watch interface drops without needing to know the ifIndex. For example, to watch interface drops on FastEthernet0/0:

event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped entry-op ge entry-val 1 entry-type increment exit-op lt exit-val 1 exit-type increment poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

This particular example assumes a recent version of IOS, but the entry-type and exit-type parameters can be changed to entry-val-is-increment true and exit-val-is-increment true for earlier versions of IOS.

New Member

Re: Packet drop

Hi jclarke,

Thank you so much for the information.

Even after all this, my question is can it be handled by a syslog or a SNMP trap so I get the notification after a packet drop.

Thanks

Cisco Employee

Re: Packet drop

My EEM example will send an SNMP trap. If you need a syslog, you can add:

action 2.0 syslog msg "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

New Member

Re: Packet drop

Hi Jclarke,

Thanks for this wonderful suggestion.

But, unfortunately, I guess EEM will not work for us because our standard IOS is 12.2(18) SXF9. So any other solutions/suggestions you can send my way are greatly appreciated.

Thanks a lot.

Cisco Employee

Re: Packet drop

EEM will work in IOS 12.2(18)SXF9. The applet I provided you will work fine. You will just need to use the older "entry-val-is-increment" notation.

New Member

Re: Packet drop

Hi Jclarke,

Thankd for all your help.

Can you please clarify the syntax for me with this one?

Is this correct for our IOS?

event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped

entry-val-is-increment true exit-val-is-increment true poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw

$_interface_delta_value $_interface_parameter over the last 60 seconds"

Thank you.

Cisco Employee

Re: Packet drop

The syntax would be:

event manager applet interface-drops

event interface name FastEthernet0/0 parameter input_packets_dropped entry-val 1 entry-op ge entry-val-is-increment true exit-val 1 exit-op lt exit-val-is-increment true poll-interval 60

action 1.0 snmp-trap strdata "Interface $_interface_name saw $_interface_delta_value $_interface_parameter over the last 60 seconds"

New Member

Re: Packet drop

Hi Jclarke,

Thanks for all the wonderful information.

As per the EEM you told me a script for the interface. is there a way we can configure EEM on global config to have it applied on all the interfaces automatically.

Thanks

Cisco Employee

Re: Packet drop

Unfortunately, no. However, if you wanted to convert the applet policy to a Tcl policy, you could run a script periodically to check all interfaces for errors. With your version of IOS, in order to keep using applets, you'd have to add one applet per interface.

New Member

Re: Packet drop

Hi,

I went to apply this for multiple interfaces and the last entry overwrites the previous entry. So my question is, do I need to create a new event manager applet interface-drops for each interface I want to monitor?

Thanks

Cisco Employee

Re: Packet drop

You will need to use unique names for your applets. For example:

interface-drops-fa1/1

interface-drops-fa1/2

...

360
Views
15
Helpful
12
Replies
CreatePlease to create content