EEM Script to trigger an action based on traffic rate on a sub-interface

[AlbusDumbledore]

Hi

I'm trying to create a fairly basic EEM script to capture certain command outputs when the traffic on a sub-interface exceeds a certain threshold. I was able to do so for the interface using transmit_rate_bps but this parameter is only for the physical interface, not sub-interfaces. I was trying to fetch the output for sub-interface trying with the snmp OID for Interface Octets in & out, but I'm stuck. Can you help me out with the script?

For the interface:

==============

event manager applet test-if
event interface name GigabitEthernet0/2 parameter transmit_rate_bps entry-op ge entry-val 500000 entry-type value poll-interval 30
action 1.0 cli command "enable"
action 2.0 cli command "terminal length 0"
action 3.0 cli command "show clock | append flash:TEST.txt"
action 4.0 cli command "sh ip cache flow | append flash:TEST.txt"
action 5.0 syslog msg "Traffic Spike observed"

Here's my crude attempt for the Sub-interface

==================

event manager applet test-subif
event snmp oid 1.3.6.1.2.1.2.2.1.10.11 get-type exact poll-interval 30
action 1.0 syslog msg "Value is $_snmp_oid_val"
action 1.1 set $tmp multiply $_snmp_oid_delta_val 8
action 1.2 set $tmp1 divide $tmp 30
action 1.3 if $tmp1 ge 500000
action 1.4 syslog msg "Value is $tmp1"

Regards

Aditya

[Joe Clarke · Accepted solution]

event manager applet test-subif
event snmp oid 1.3.6.1.2.1.2.2.1.10.11 get-type exact entry-type increment entry-op ge entry-val 1875000 poll-interval 30
action 1.0 syslog msg "Value is $_snmp_oid_val"
action 1.1 multiply $_snmp_oid_delta_val 8
action 1.2 divide $_result 30
action 1.3 puts "bps is $_result"

[AlbusDumbledore]

Hi Joe

Thanks a ton for your help! I hadn't quite understood the "entry-type increment" well, but your script helped me understand it.

Just a little note: The increment value of 1875000 is for 500Kbps threshold, not 5Mbps, so you missed a zero here :)

Really appreciate your help. Thanks again.

Aditya