cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1702
Views
0
Helpful
2
Replies

EEM applet: event correlation question

parisdooz12
Level 1
Level 1

Hi,

I want to develop an applet using correlation of 2 events:

- CPU load behond a threshhold

AND

- specific syslog message received

What I want is to launch actions when the 2 events occur in the same tme.

My doubt is: what happens if the switch detect a CPU load one day, then receive the syslog mesasge another day? Does the appletconsider the event happened, and wait (without limit of time) up to have the 2d event occuring? Or it there a timeout or a way to implement a timeout?

thanks by advance

P.

2 Replies 2

Joe Clarke
Cisco Employee
Cisco Employee

You get to specify the time window for the correlation.  Use the command:

trigger period 1

That means both events must occur within the same second for the applet to fire.

Hi..

You can use 2 scripts and 2 snmp RW variables (i.e. description of an unused interface).

First script; to control snmp RW variables AND your events. According to your events you can set variables from 0 to 1.

Second script; to reset variables from 1 to 0 if nothing happens in an limited time.

first script: to set variables according to events (running every 15 seconds)

cpu load variable 0, specific syslog message variable 0 : do nothing

cpu load variable 0, specific syslog message variable 1 : do nothing

cpu load variable 1, specific syslog message variable 0 : do nothing

cpu load variable 1, specific syslog message variable 1 : launch actions

second script:

reset variables in 20 seconds

Mustafa..

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: