EEM script for interface errors threshold

[CORY HEBERT]

I recently deployed a very simple EEM script to generate a syslog message when more than 100 input errors were detected in a minute on an interface:

event manager applet DIRTY_CIRCUIT
 event interface name Serial4/0 parameter input_errors entry-op ge entry-val 100 entry-type increment poll-interval 60
 action 60 syslog msg "'DIRTY_CIRCUIT' EEM script detecting errors"
 

...and it works as it should.  But I wanted it to generate a different kind of message if the errors are much higher.  Like, greater than 1000, for example.

event manager applet DIRTY_CIRCUIT
 event interface name Serial4/0 parameter input_errors entry-op ge entry-val 100 entry-type increment poll-interval 60
 action 10 if $_interface_delta_value le 1000
 action 20  syslog msg "'DIRTY_CIRCUIT' EEM script detecting errors"
 action 30 elseif $_interface_delta_value gt 1000
 action 40  syslog msg "'DIRTY_CIRCUIT' EEM script detecting MANY errors"
 action 50 end

This script worked fine.  I figured I'd try another version of it, but this one doesn't work:

event manager applet DIRTY_CIRCUIT
 event interface name Serial4/0 parameter input_errors entry-op ge entry-val 100 entry-type increment poll-interval 60
 action 10 if $_interface_delta_value ge 1000
 action 20  syslog msg "'DIRTY_CIRCUIT' EEM script detecting MANY errors"
 action 30 else
 action 40  syslog msg "'DIRTY_CIRCUIT' EEM script detecting errors"
 action 50 end

Any idea why this script isn't working?  Any help is appreciated.

[Joe Clarke]

Logic looks the same.  But you should understand that the polling doesn't work in true deltas.  The way it works is that a snapshot is taken when the policy is first registered.  Then, each poll will check the current value to that initial snapshot.  When the delta equals 100 (in your case) then the event fires and a new snapshot is taken.  This means that a snapshot will NOT NECESSARILY be taken after each polling interval.  Hopefully that will help demystify some of this with what you're seeing.

[CORY HEBERT]

Thanks, Joseph.  As usual, you were spot on.  Both of the proposed scripts shown above work, but I wasn't aware of the behavior you described.  Things were getting screwed up anytime I cleared the interface counters.  To combat this, I wrote a script to 're-register' my dirty circuit script anytime the counters were cleared:

event manager applet REGISTER_EEM
 event syslog pattern "%CLEAR-5-COUNTERS"
 action 10 cli command "enable"
 action 20 cli command "conf t"
 action 30 cli command "event manager applet DIRTY_CIRCUIT"
 action 40 cli command "event interface name Serial4/0 parameter input_errors entry-op ge entry-val 100 entry-type increment poll-interval 60"
 

It now works like a champ.  Thanks for taking the time to respond.