cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2053
Views
0
Helpful
7
Replies

EEM Script to enable netdr on high CPU utilization

Nishant Kumar
Level 1
Level 1

Hi All,

 

I need help in creating a EEM script in Cisco router 7606 as per below requirement:

 

>> Monitor CPU Utilization

>> I want script to start working only When CPU Utilization remains more than 85% for atleast 5 minutes

>> Once event is triggered i.e, CPU utilization remains more than 85% for more than 5 minutes, take following action:

First, clear netdr cap packets >> "debug netdr clear-cap"

Enable netdr capture >> "debug netdr capture rx"

Wait for 5 secs

Stop netdr capture >> "no debug netdr capture rx"

 

Please help. Thanks in Advance.

 

Regards,

Nishant

1 Accepted Solution

Accepted Solutions

Joe Clarke
Cisco Employee
Cisco Employee

Something like this should work:

 

event manager applet high-cpu

 event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

 action 1.0 cli command "enable"

 action 2.0 cli command "debug netdr clear-cap"

 action 3.0 cli command "debug netdr capture rx"

 action 4.0 wait 5

 action 5.0 cli command "no debug netdr capture rx"

View solution in original post

7 Replies 7

Joe Clarke
Cisco Employee
Cisco Employee

Something like this should work:

 

event manager applet high-cpu

 event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

 action 1.0 cli command "enable"

 action 2.0 cli command "debug netdr clear-cap"

 action 3.0 cli command "debug netdr capture rx"

 action 4.0 wait 5

 action 5.0 cli command "no debug netdr capture rx"

Hi Joseph,

 

Thanks for reply.

 

I am new to EEM script, it would be great if you explain first line of event manager little bit :

event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

Also, don't we need to send enable password after enable command ??

 

Thanks,

Nishant

 

The first line looks at the CPU 5 minute total busy percentage.  If the percentage is at or above 85, the policy will fire.  It will not fire again until the percentage drops below 85 then rises again.

 

No, you do not need an enable password.  EEM is only concerned with authorization, not authentication.

Hi Joseph,

 

Is it possible to check two parameters for triggering script ?

Suppose I want to monitor CPU utilization and "ARP Input Process" for triggering script.

Like CPU Utilization for 5min > 85% and "ARP Input Process" utilization >10%, then only script fires.

 

Thanks,

Nishant

If you know the ID of the ARP process you can create a multiple event policy.  Something like:

 

event tag system snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

event tag arp snmp oid " 1.3.6.1.4.1.9.9.109.1.2.2.1.7.1.184" get-type exact entry-op ge entry-val 10 exit-op lt exit-val 10 poll-interval 60

trigger

 correlate event system and event arp

 

Note: the "184" value here needs to be replaced with the actual process ID of the ARP Input Process.

ARP input process ID is 12. So, script becomes:

event manager applet high-cpu

event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8.1" get-type exact entry-op ge entry-val 85 exit-op lt exit-val 85 poll-interval 60 maxrun 30

event tag arp snmp oid " 1.3.6.1.4.1.9.9.109.1.2.2.1.7.1.12" get-type exact entry-op ge entry-val 10 exit-op lt exit-val 10 poll-interval 60

trigger

 correlate event system and event arp

action 1.0 cli command "enable"

 action 2.0 cli command "debug netdr clear-cap"

 action 3.0 cli command "debug netdr capture rx"

 action 4.0 wait 5

 action 5.0 cli command "no debug netdr capture rx"

 

Is it correct ??

Assuming 12 is the PID of ARP Input Process, then that is right.  But you are missing the "tag system" in the first event registration line.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco