cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
configure & troubleshoot anyconnect
233
Views
5
Helpful
4
Replies
Highlighted
Cisco Employee

APIC. Is there any way to figure out flapping interfaces in the fabrci.

Hello Experts.

 

Could you help me on the following? I have to find flapping interfaces in the fabric.

Theoritically I can do it in ugly way which is run a script which will execure show interface on each node of the fabric and then run a condition if last link flap <= 5 mins then it's problematic interface.

 

 

However, I believe there is much more elegant way to find such interfaces using moquery.

Could anybody tell me if he/she had to use it before?

 

Any suggestion will be highly appriciated.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Beginner

Re: APIC. Is there any way to figure out flapping interfaces in the fabrci.

Hello,

You can use the following moquery by adapting the timestamp field:

moquery -c eventRecord -f 'event.Record.cause=="port-down" and event.Record.created>"2019-06-11T08:40:00"' | grep affected | sort

The "<=5min" might be difficult to implement in a single moquery but instead should be integrated in a script to automatically generate the timestamp "current time minus 5 minutes" and fill the moquery field.

 

Remi Astruc

Beginner

Re: APIC. Is there any way to figure out flapping interfaces in the fabrci.

Hello,

Yes, it will cover even sub-second cuts.

 

An event is similar to a log entry. It can notify about issues but also informational things.

A Fault represents a faulty status of an object at a given time, and can influence Health Scores. A Fault has a notion of lifecycle and its status evolves in time.

 

Remi Astruc

4 REPLIES 4
Beginner

Re: APIC. Is there any way to figure out flapping interfaces in the fabrci.

Hello,

You can use the following moquery by adapting the timestamp field:

moquery -c eventRecord -f 'event.Record.cause=="port-down" and event.Record.created>"2019-06-11T08:40:00"' | grep affected | sort

The "<=5min" might be difficult to implement in a single moquery but instead should be integrated in a script to automatically generate the timestamp "current time minus 5 minutes" and fill the moquery field.

 

Remi Astruc

Cisco Employee

Re: APIC. Is there any way to figure out flapping interfaces in the fabrci.

Hello Remi,

Thank you very much!
Could you tell me please if the link flapped say for a second, will such thing be accounted as event?

Could you tell me please what could be the difference berween an event and fault.
Beginner

Re: APIC. Is there any way to figure out flapping interfaces in the fabrci.

Hello,

Yes, it will cover even sub-second cuts.

 

An event is similar to a log entry. It can notify about issues but also informational things.

A Fault represents a faulty status of an object at a given time, and can influence Health Scores. A Fault has a notion of lifecycle and its status evolves in time.

 

Remi Astruc

Cisco Employee

Re: APIC. Is there any way to figure out flapping interfaces in the fabrci.

Thank you very muxh Remi!

CreatePlease to create content