cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
924
Views
5
Helpful
17
Replies

EEM EXPERIENCE

grupporete
Level 1
Level 1

Did anyone has got a pratical experience around the TCL script using the EEM tools ?

In the detail I have some difficult for an event that have to macth the CRC increment in an ATM interface and after trigger down that interface.

Over the web and Cisco portall too its not so easy to find a clear example.

Any help is appreciated

Alberto

1 Accepted Solution

Accepted Solutions

Joe Clarke
Cisco Employee
Cisco Employee

Your EEM TCL policy registration line to match input CRCs, for example would be something like:

::cisco::eem::event_register_interface name ATM2/0 parameter input_errors_crc entry_op ge entry_val 10 entry_val_is_increment TRUE poll_interval 60

A policy with this event detector will check interface ATM2/0 every 60 seconds to see if the incremental input CRC errors is greater than or equal to 10.

If all you want to do is bring the interface down when the condition occurs, it might be better to use an EEM applet rather than a TCL policy. For example:

event manager applet atm_input_crcs

event interface name ATM2/0 parameter input_errors_crc entry-op ge entry-val 10 entry-type increment poll-interval 60

action 1.0 cli command "enable"

action 2.0 cli command "config t"

action 3.0 cli command "interface ATM2/0"

action 4.0 cli command "shutdown"

action 5.0 cli command "end"

action 6.0 syslog msg "Input CRC errors exceeded 10 during the last 60 seconds; interface ATM2/0 has been shutdown"

View solution in original post

17 Replies 17

Joe Clarke
Cisco Employee
Cisco Employee

Your EEM TCL policy registration line to match input CRCs, for example would be something like:

::cisco::eem::event_register_interface name ATM2/0 parameter input_errors_crc entry_op ge entry_val 10 entry_val_is_increment TRUE poll_interval 60

A policy with this event detector will check interface ATM2/0 every 60 seconds to see if the incremental input CRC errors is greater than or equal to 10.

If all you want to do is bring the interface down when the condition occurs, it might be better to use an EEM applet rather than a TCL policy. For example:

event manager applet atm_input_crcs

event interface name ATM2/0 parameter input_errors_crc entry-op ge entry-val 10 entry-type increment poll-interval 60

action 1.0 cli command "enable"

action 2.0 cli command "config t"

action 3.0 cli command "interface ATM2/0"

action 4.0 cli command "shutdown"

action 5.0 cli command "end"

action 6.0 syslog msg "Input CRC errors exceeded 10 during the last 60 seconds; interface ATM2/0 has been shutdown"

Great !

HI Clarke,

This EEM Applet is Great.

Could you please Attach / Add more EEM Template for all Requirements to which you have Tried with Success.

Best Regards,

Guru Prasad R

I have way too many of them to post. We are trying to maintain an archive of useful EEM policies at http://www.cisco.com/go/ciscobeyond/ .

HI Clarke,

Great Community Link :-)

Thanks,

Guru Prasad R

HI Clarke,

In addition to verifying the Link provided by you for this EEM Applets.

Do you have some Applet for Tracking:

"MPLS Label based Traffic"

"CPU Utilization"

"Memory Utilization"

Would appreciate if i can get the Update as soon as possible. Thanks in Advance.

Best Regards,

Guru Prasad R

I have one applet for memory utilization tracking that I give as a basic EEM example. The applet is designed for systems with redundant CPUs. The idea is to watch for low free memory, then fail over to the secondary CPU before free memory gets too low.

event manager applet memory-demo

event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op lt entry-val 5120000 poll-interval 10

action 1.0 syslog priority critical msg "Memory exhausted; current available memory is $_snmp_oid_val bytes"

action 2.0 force-switchover

I do not have specific examples created for CPU utilization or MPLS traffic analysis.

HI Clarke,

Thanks for the Immediate Response.

With regards to the Memory Utilization Applet, my idea is to watch for low free memory.

If the case matches, ALERT required as how your CRC applet works.

Can you modify the above applet accordingly for my requirement.

In addition, do let me know what are the Other Unique "Network Management" applet you have installed. Kindly list the same, let me check and request you accordingly.

Thanks in Advance for all your help & time.

Best Regards,

Guru Prasad R

If all you want to do is alert on low free memory, just remove the "action 2.0" from my applet.

If you're looking for good example policies, I highly suggest you look at http://www.cisco.com/go/ciscobeyond/ . there are a lot of examples there that should help get you started.

HI Clarke,

Have rated your POST. Sorry to re-trigger.

I have an Urgent Requirement in EEM,

do you have some Applet for PING Response (to check the Latency) between PE to PE / ASBR to PE, this will help to have better Network Systems Monitoring.

Thanks in Advance for your Help & Actions.

Best Regards,

Guru Prasad R

This kind of thing is more suited to IP SLA rather than EEM. However, you can integrate IP SLA and EEM to trigger events when IP SLA operations fail.

Depending on what you want to do when latency becomes unacceptable, IP SLA might be all you need. With IP SLA, you can send an SNMP trap to indicate latency has become unacceptable. If you want to do more, then you can tie EEM into the picture. For example:

ip sla 1

icmp-echo 172.18.123.33

timeout 50

ip sla schedule 1 life forever start now

track 1 rtr 1

event manager ip_sla_track

event track 1 state down

action 1.0 syslog msg "Latency has increased to 50 ms"

action 2.0 cli command "enable"

action 3.0 cli command "config t"

action 4.0 cli command "interface POS4/0"

action 5.0 cli command "shut"

action 6.0 cli command "end"

action 7.0 syslog msg "Switched over to backup interface"

In this example, when latency increases beyond 50 ms, the IP SLA operation will timeout, and the EEM applet will trigger. The applet will notify via syslog, then shutdown the main POS interface (ideally causing a backup interface to take over).

There are many ways to do this kind of of thing, as well as ways to extend this example to be more robust (e.g. react to latency problems on the backup interface, and fail back over to the main interface).

Definitely take some time to play with EEM yourself in a lab environment to get comfortable with it before deploying it in production.

HI Clarke,

That was a Great POST.

My Requirement is to trigger using ICMP and track the LATENCY. As in your Eg: If it goes beyond 50 ms means ALERT via SYSLOG.

Will the below can do my requirement:

======================================

ip sla 1

icmp-echo 172.18.123.33

timeout 50

ip sla schedule 1 life forever start now

track 1 rtr 1

event manager ip_sla_track

event track 1 state down

action 1.0 syslog msg "Latency has increased to 50 ms"

Once afer hearing your green light i am going to implement. As per your recommendation, i will still take more time to play with EEM in lab environment.

In Addition, may be in future if you write EEM Applet for CPU Utilization means do add in the POST for reference.

Thanks in Advance for Help.

Best Regards,

Guru Prasad R

You should not just implement this in production without testing. I cannot say if this will work in your environment because I do not know anything about your environment. This applet also requires fairly recent IOS code.

As for how it works, the IP SLA operation will ping the host every 60 seconds. If the latency goes above 50 ms, the operation will timeout which will cause the tracked object to go down. When that object goes down, the applet is triggered, and a syslog message will be sent.

HI Clarke,

Thanks for the Explanation. I am going to TEST in a lab environment first.

====

ip sla 1

icmp-echo 172.18.123.33

timeout 50

ip sla schedule 1 life forever start now

track 1 rtr 1

event manager ip_sla_track

event track 1 state down

action 1.0 syslog msg "Latency has increased to 50 ms"

====

Please re-modify your Applet, i don't want the Tracked object to go down it the Latency goes above 50ms.

Anyway, i wanted to have an Alert via SYSLOG as how your CRC Applet works.

Thanks in Advance.

Best Regards,

Guru Prasad R

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco