Capturing output queue drops

CrackedJack1 · ‎04-27-2016

I'm noticing the output queue drops on my 3850 has huge values across virtually every port. Is there a way I can trigger some sort of EEM script to dump the packets to a wireshark file when queue drops are detected on an interface so I can see what all this traffic is that is being dropped? I know nothing about EEM script other than seeing cisco tac using it once to troubleshoot an issue once.

Joe Clarke · ‎04-29-2016

There is no magic that EEM can do that CLI and SNMP cannot. Meaning, if you have a way of doing something manually via the CLI or with SNMP then EEM can help you automate that.

I don't know if the 3850s support Embedded Packet Capture (on other platforms EPC is configured with "monitor capture" commands), but if you have a way to capture packets locally, then EEM can certainly detect queue drops and snapshot a capture file. That said, even with EPC, I think you might not capture dropped traffic if there are no buffers to receive the ingress packet. So you would want to try and test this.

CrackedJack1 · ‎05-01-2016

The 3850 does support packet capture on the switch as it's been used on previous TAC cases but I have no clue how to use it to trigger a capture.

I'd like to use EEM to trigger a capture when it detects queue drops in the hope that I'll get some of the traffic and by able to see where it's coming from. Can you help me with a simple script to accomplish this?

Joe Clarke · ‎05-02-2016

I do not know the commands to enable the packet capture on the 3850s. I'm also not sure how you're detecting queue drops manually. Are you using the "show interface" output for that?

From a workflow perspective, you should manually start your packet capture with a circular buffer. Then, the EEM policy will run periodically looking for output queue drops. When it finds them, it will stop the capture, export it to a pcap file, email the file, and then restart the capture.

But I don't know how much of the capture workflow is supported on the 3850, nor do I know the specific commands to do that.