12-31-2009 01:44 PM
HI
How can i use EEM to capture 1st 5 process when cpu usage goes above 90 % (5 min avg).
I want to store output in a flash.
I tried generating trap when usage goes above 90% in 5 min and prepared applet based on output which i got.
biut looks like i am doing mistake in regular expression...
Is there any other / better way also to achive same?
THanks
Lokesh
12-31-2009 01:51 PM
Post the policy you wrote. What version of IOS are you running?
12-31-2009 02:31 PM
hi
snmp-server enable traps cpu threshold
process cpu threshold type total rising 90 interval 3
event manager applet CPU
event syslog pattern "CPURISINGTHRESHOLD"
action 1.0 cli command "enable"
action 1.1 cli command "show process cpu sorted 5min | include ^_[1-9]|^| append flash:cpu_info"
i am trying it on GNS3 - IOS is 12.4(25b) - 3600 series router. Not sure if this is not supposed to work on GNS3.
but i m sure i am doing mistake in my regular expresion since above command gives me everything instead of 1st 5 lines.
12-31-2009 10:24 PM
HI
I tried some thing else which partially worked
event manager applet CPU1
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.8.1 get-type exact entry-op ge entry-val "10" poll-interval 30
actiona 1.0 cli command "enable"
action 2.0 cli command "show process cpu | include ^__[1-9]|^__5|"
action 3.0 syslog priority warning msg "high cpu usage"
But this gives me all output of show process cpu, and i want only 1st few lines.
How do i achive this?
01-01-2010 09:12 AM
What you want to do cannot be done using applets (at least not in your version of code). You need to use a Tcl policy. Attached is a policy which should do what you want. The resulting flash:cpu_info file will contain the current date and time, the two "show proc cpu" header lines, and the first five processes.
01-01-2010 10:16 AM
Thanks Joe
Honestly i am finding it difficult since this is a new topic for me..
is there any easy way.
You mentioned this can't be done using regexp in my version of IOS... can this be done in other IOS, if yes then how? And which IOS do i need?
01-01-2010 10:22 AM
Getting the first five lines can be done easily using applets in IOS 12.4(22)T and higher. However, writing that data to a file on flash is where it gets difficult. You could easily print the lines, email them, or send them in a syslog message, but to write them out to a file, you need Tcl. The reason for this is that IOS does not support the double pipe syntax. That is, the following command line is invalid:
show proc cpu | exc 0.00 | append flash:/file
The second pipe is not interpreted the way you think it should be.
01-01-2010 10:25 AM
Thanks
Can you give me Sample config for sending mail and sending to Syslog for 1st 5 lines.
Regards
Lokesh
01-01-2010 10:35 AM
event manager applet dump-procs
event syslog pattern "CPURISINGTHRESHOLD"
action 001 cli command "enable"
action 002 cli command "show proc cpu sorted 5min"
action 003 set lines 0
action 004 foreach line "$_cli_result" "\n"
action 005 if $lines gt 6
action 006 break
action 007 end
action 008 append output $line
action 009 increment lines
action 010 end
action 011 mail to user@company.com from user@company.com server 10.1.1.1 subject "Top five processes" body "$output"
action 012 syslog msg "Top five processes: $output"
01-01-2010 10:45 AM
Thanks Joe
What does increment lines do here?
And Which IOS must i have to run this?
Regards
Lokesh
01-01-2010 11:45 AM
The "increment" command increments the value of the lines counter variable by one. The idea is that after the first two header lines, and first five processes are captured, the loop should be exited.
This applet requires 12.4(22)T or higher (i.e. EEM 3.0 or higher). You currently have EEM 2.1.
08-26-2010 05:18 AM
Hi,
I tried your solution in both IOS 12.4T-22 & IOS 15.0 in C7206VXR platform, it doesn't work!
08-26-2010 10:10 AM
You may need to add:
event manager session cli username USER
If you are using AAA command authorization. If that does not work, start a new thread for your specific problem with the output of "debug event manager action cli".
06-19-2011 05:14 PM
Hi Joseph,
vent manager applet dump-procs
event syslog pattern "CPURISINGTHRESHOLD"
action 001 cli command "enable"
action 002 cli command "show proc cpu sorted 5min"
action 003 set lines 0
action 004 foreach line "$_cli_result" "\n"
action 005 if $lines gt 6
action 006 break
action 007 end
action 008 append output $line
action 009 increment lines
action 010 end
action 011 mail to user@company.com from user@company.com server 10.1.1.1 subject "Top five processes" body "$output"
action 012 syslog msg "Top five processes: $output"
Instead of using the programming logic for sending 10 lines via email, can i do some thing like this
action 003 cli command "terminal width 100"<--since it has longer width for some process and to accomodate it in 1 line
action 004 cli command "terminal len 13" <-- it will count --more-- and 2 line after command
action 005 cli command "sh process cpu sorted 5min"
and then mail configuration.
Regards
Ahmed...
06-19-2011 07:17 PM
No, this will not work. The terminal used by EEM is specially designed to to disable the pager. Plus, you need to be able to find the device prompt when the command finishes executing. If you want to add more lines, just adjust the "$lines gt 6" piece. Specify a line count of 10 or higher. If you cannot use programmatic applets, then you will need to switch to Tcl to control the output.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide