TCL script, interface bitrate

Krasnoperov · ‎02-15-2011

Hi, I need a script which will track all interface on device (catalyst or router) and if a bitrate output or input higher then threshold, it will send a message on e-mail with list ofp interfaces and bitrate on it.

I think this is hard problem, but may be somebody have similar script

thanks

Joe Clarke · ‎02-20-2011

This script should do what you want. It is an Embedded Event Manager Tcl policy that uses the timer event detector. You will need to configure some EEM environment variables before you can register the policy.

bitrate_interval : Time (in seconds) between executions of the script

bitrate_rising_threshold : Upper threshold for bits per second before an email will be sent

bitrate_falling_threshold : Lower threshold for bits per second before an interface will be seen in an email again

_email_server : IP address of the SMTP server

_email_from : Email address of the sender

_email_to : Email address of the recipient

_email_cc : (optional) email address(es) of additional recipients

For example, in config t mode:

event manager environment bitrate_interval 60

event manager environment bitrate_rising_threshold 1000000

event manager environment bitrate_falling_threshold 1000

event manager environment _email_server 10.1.1.1

event manager environment _email_from user@company.com

event manager environment _email_to user@company.com

Copy this script to a directory on flash called "policies", then register it with:

event manager directory user policy flash:/policies

event manager policy tm_check_bitrate.tcl

Krasnoperov · ‎02-24-2011

Thanks a lot for your answer, but I have some problem with script

first when I do this

r1(config)#event manager policy tm_check_bitrate.tcl

Compile check failed:missing close-bracket

while compiling

"set mail_msg"

r1(config)#

Tcl policy execute failed: missing close-bracketcouldn't compile policy file to bytecode: Unknown error 0

Sorry, I'm not coder but I decide to fix bracket here, might be I'm wrong

set mail_msg [uplevel #0 [list [subst -nobackslashes -nocommands $mail_pre]]]

if [catch {smtp_send_email $mail_msg} result] {

error $result $errorInfo

After that it shows this

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: invalid command name "run_ci"

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: while executing

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: "run_ci [list "show interface | inc ^\[A-Z]| rate""

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: "$slave eval $Contents"

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: (procedure "eval_script" line 7)

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: "eval_script slave $scriptname"

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: "if {$security_level == 1} { #untrusted script

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp create -safe slave

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stdout slave

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stderr slave..."

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: (file "system:/lib/tcl/base.tcl" line 50)

Feb 24 16:48:43: %HA_EM-6-LOG: tm_check_bitrate.tcl: Tcl policy execute failed: invalid command name "run_ci"

Where I'm wrong ?

Joe Clarke · ‎02-24-2011

Try this version.

Krasnoperov · ‎03-02-2011

I have same kind of message "Tcl policy execute failed: invalid command name "run_ci""

RouterRouter#fh_fd_timer_event_expire: re=0x64C09C34

Mar 2 15:42:51: fd_pulse_hndlr: received a pulse from /dev/fm/fd_timerfh_fd_timer_info_publish: pe = 0x63B8B1F4

Mar 2 15:42:51: fh_msg_send_to_fd: receive a reply msg, minor: 5

Mar 2 15:42:51: fd_pulse_hndlr: received FH_MSG_EVENT_PUBLISHfh_schedule_policy: prev_epc=0x00000000; epc=0x64BFFB38

Mar 2 15:42:51: fh_schedule_policy: policyname=system:/lib/tcl/eem_scripts_registered/tm_check_bitrate.tclspawn script system:/lib/tcl/eem_scripts_registered/tm_check_bitrate.tclEEM policy system:/lib/tcl/eem_scripts_registered/tm_check_bitrate.tcl has been scheduled to run

Mar 2 15:42:51: fh_spawn: -FMRUN -FMSAFE system:/lib/tcl/base.tcl system:/lib/tcl/eem_scripts_registered/tm_check_bitrate.tcl

Mar 2 15:42:51: fh_tcl_spawn: argc=5, argstr=-FMRUN, stdin=null:/tm_check_bitrate.tcl, stdout=syslog:/info/noscan/tm_check_bitrate.tcl,stderr=syslog:/err/noscan/tm_check_bitrate.tcl, priority=3pid for spawned process is 57

Mar 2 15:42:51: fh_tcl_esi_open: fd=1

Mar 2 15:42:51: fh_tcl_esi_open: fd=2

Mar 2 15:42:51: fh_tcl_get_mode: mode = 1, StartupScript = system:/lib/tcl/base.tcl, RealScript = system:/lib/tcl/eem_scripts_registered/tm_check_bitrate.tcl

Mar 2 15:42:51: fh_io_msg: received FH_MSG_API_INIT; jobid=17179, processid=57, client=17169, job name=EEM TCL Proc

Mar 2 15:42:51: fh_register_evreg_cmds: tctx=64DE72EC, dummy=1

Mar 2 15:42:51: fh_tcl_compile_policy: evaluating policy: startup_scriptname=system:/lib/tcl/base.tcl, real_scriptname=system:/lib/tcl/eem_scripts_registered/tm_check_bitrate.tcl

Mar 2 15:42:51: fh_tcl_slave_interp_init: interp=6477D674, tctx=64DE72EC, fh_mode=1, real=system:/lib/tcl/eem_scripts_registered/tm_check_bitrate.tcl, curr=

Mar 2 15:42:51: fh_register_evreg_cmds: tctx=64DE72EC, dummy=1

Mar 2 15:42:51: [fh_dummy_cmd]

Mar 2 15:42:52: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:42:52: fh_fd_data_syslog: num_matches = 0received SIGCHLD pulse from child death pid=57received pulse from child death code=1; epc=0x64BFFB38EEM policy tm_check_bitrate.tcl has ended with normal exit status of 0x0fh_schedule_policy: prev_epc=0x64BFFB38; epc=0x00000000

Mar 2 15:42:52: fh_server: fh_io_msg: received msg FH_MSG_API_CLOSE from client 17169 pclient 17169

Mar 2 15:42:52: fh_io_msg: received FH_MSG_API_CLOSE client=17169

Mar 2 15:42:52: fh_tcl_esi_close: fd=1

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: invalid command name "run_ci"

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: while executing

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: "run_ci [list "show interface | inc ^\[A-Z]| rate""

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: "$slave eval $Contents"

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: (procedure "eval_script" line 7)

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: "eval_script slave $scriptname"

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: "if {$security_level == 1} { #untrusted script

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp create -safe slave

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stdout slave

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stderr slave..."

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: (file "system:/lib/tcl/base.tcl" line 50)

Mar 2 15:42:52: %HA_EM-6-LOG: tm_check_bitrate.tcl: Tcl policy execute failed: invalid command name "run_ci"

Router#

Mar 2 15:42:52: fh_tcl_esi_close: fd=2

Mar 2 15:42:52: fh_tcl_assoc_data_delproc: freeing tctx=64DE72EC

Router#

Mar 2 15:42:57: %SEC-6-IPACCESSLOGP: list 102 denied tcp 192.168.107.46(2041) -> 94.245.71.209(80), 1 packet

Router#

Mar 2 15:42:57: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:42:57: fh_fd_data_syslog: num_matches = 0

Router#cron_tick: num_matches 0

Router#

Mar 2 15:43:02: %SEC-6-IPACCESSLOGP: list 102 denied tcp 192.168.107.46(2042) -> 94.245.71.213(80), 1 packet

Router#

Mar 2 15:43:02: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:43:02: fh_fd_data_syslog: num_matches = 0

Mar 2 15:43:03: %SEC-6-IPACCESSLOGP: list 102 denied tcp 192.168.107.19(3842) -> 184.168.222.198(80), 1 packet

Router#

Mar 2 15:43:03: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:43:03: fh_fd_data_syslog: num_matches = 0

Router#

Mar 2 15:43:07: %SEC-6-IPACCESSLOGP: list 102 denied tcp 192.168.107.46(2043) -> 94.245.71.209(80), 1 packet

Router#

Mar 2 15:43:07: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:43:07: fh_fd_data_syslog: num_matches = 0

Router#

Mar 2 15:43:10: %SEC-6-IPACCESSLOGP: list 102 denied tcp 192.168.107.19(3843) -> 75.101.227.242(80), 1 packet

Router#

Mar 2 15:43:10: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:43:10: fh_fd_data_syslog: num_matches = 0

Router#

Mar 2 15:43:12: %SEC-6-IPACCESSLOGP: list 102 denied tcp 192.168.107.46(2044) -> 94.245.71.213(80), 1 packet

Router#

Mar 2 15:43:12: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:43:12: fh_fd_data_syslog: num_matches = 0

Router#term no

Mar 2 15:43:17: %SEC-6-IPACCESSLOGP: list 102 denied tcp 192.168.107.46(2045) -> 94.245.71.209(80), 1 packet

Router#term no

Mar 2 15:43:17: fh_fd_syslog_event_match: num_matches = 0

Mar 2 15:43:17: fh_fd_data_syslog: num_matches = 0

Joe Clarke · ‎03-02-2011

It looks like you have not re-registered the script after copying the modified version. Be sure you do:

no event manager policy tm_check_bitrate.tcl

event manager policy tm_check_bitrate.tcl

Krasnoperov · ‎03-05-2011

Did exactly what you said, now this kind of error occurs:

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: while executing

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "if { $iidx != -1 && $paramarr(input) <= $bitrate_falling_threshold } {

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: set ifilst [lreplace $ifilst $iidx $iidx]

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: } elseif { $iidx == -1 && $param..."

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: ("foreach" body line 5)

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "foreach param [array names ifarr] {

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: array set paramarr $ifarr($param)

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: set iidx [lsearch -exact $ifilst $param]

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: set oidx [lsearch -exact $i..."

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "$slave eval $Contents"

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: (procedure "eval_script" line 7)

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "eval_script slave $scriptname"

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "if {$security_level == 1} { #untrusted script

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp create -safe slave

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stdin slave

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stdout slave

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: ..."

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: (file "system:/lib/tcl/base.tcl" line 50)

Mar 5 14:33:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: Tcl policy execute failed: can't read "paramarr(input)": no such element in array

Mar 5 14:33:18: fh_tcl_esi_close: fd=2

Mar 5 14:33:18: fh_tcl_assoc_data_delproc: freeing tctx=8464D2D8received SIGCHLD pulse from child death pid=172received pulse from child death code=2; epc=0x847D25B4EEM policy tm_check_bitrate.tcl has ended with abnormal exit status of 0x1fh_schedule_policy: prev_epc=0x847D25B4; epc=0x00000000mon

Joe Clarke · ‎03-05-2011

Post the output of the command:

show interface | inc ^[A-Z]| rate

It looks like your output format may differ from my test device.

Krasnoperov · ‎03-08-2011

show interface | inc ^[A-Z]| rate

FastEthernet0/0 is up, line protocol is up

5 minute input rate 1615000 bits/sec, 541 packets/sec

5 minute output rate 1609000 bits/sec, 543 packets/sec

FastEthernet0/0.2 is up, line protocol is up

FastEthernet0/0.3 is up, line protocol is up

FastEthernet0/0.168 is deleted, line protocol is down

NVI0 is up, line protocol is up

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

Joe Clarke · ‎03-08-2011

Ah, you have some sub-interfaces. Try this version.

Krasnoperov · ‎03-09-2011

Now it's just do not want to register

Sorry, but after second try it's regestred ! but some errors still exist

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: while executing

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "{Mailservername: 192.168.100.41

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: From: ask@xxx.ru

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: To: ask@xxx.ru

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: Cc:

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: Subject: Interface Utilization Alert

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: The following interfaces have high in..."

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: ("uplevel" body line 1)

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "uplevel #0 [list [subst -nobackslashes -nocommands $mail_pre]"

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "$slave eval $Contents"

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: (procedure "eval_script" line 7)

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "eval_script slave $scriptname"

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: invoked from within

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: "if {$security_level == 1} { #untrusted script

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp create -safe slave

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stdin slave

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: interp share {} stdout slave

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: ..."

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: (file "system:/lib/tcl/base.tcl" line 50)

Mar 9 15:57:18: %HA_EM-6-LOG: tm_check_bitrate.tcl: Tcl policy execute failed: invalid command name "Mailservername: 192.168.100.41

Joe Clarke · ‎03-10-2011

Try this version.

Krasnoperov · ‎03-14-2011

Thanks

it's working, message are coming to my e-mail

but there is some issue in message body

its coming like this (do not display interfaces which are above the threshold):

From: ask@xxx.ru

To: ask@xxx.ru

Cc:

Subject: Interface Utilization Alert

The following interfaces have high input bitrate (above 1000000 :

The following interfaces have high output bitrate (above 1000000 :

Joe Clarke · ‎03-15-2011

Sorry, I forgot to exit if there were no interfaces above the threshold. This version should suppress those emails.