01-10-2013 04:32 AM
Hello,
I want to monitoring a interface on router to see when is high traffic.I did search here on the forum(
https://supportforums.cisco.com/thread/2190808
) and found this :
event manager applet monitor-bandwidth
event tag e1 snmp oid 1.3.6.1.2.1.31.1.1.1.6.1 get-type exact entry-op eq entry-val 0 entry-type increment poll-interval 60
event tag e2 snmp oid 1.3.6.1.2.1.31.1.1.1.10.1 get-type exact entry-op eq entry-val 0 entry-type increment poll-interval 60
trigger
correlate event e1 or event e2
action 1.0 syslog msg "Input or output octets was zero for the past 60 seconds for GigabitEthernet0/0"
but i dont know if i can use it for what i need.
Can anyone help me please .
Thank you,
Bogdan
Solved! Go to Solution.
01-12-2013 11:35 PM
This applet monitors a given interface to see if it is not passing traffic for a specific amount of time. It sounds like it would be the opposite of what you want to do. However, you could adapt it. Pick your polling interval, then set the entry-op to ge. The entry-val will have to be the count of input or output octets that, if the interface passed that much traffic in the specific polling interval, would constitute a high bandwidth condition.
01-12-2013 11:35 PM
This applet monitors a given interface to see if it is not passing traffic for a specific amount of time. It sounds like it would be the opposite of what you want to do. However, you could adapt it. Pick your polling interval, then set the entry-op to ge. The entry-val will have to be the count of input or output octets that, if the interface passed that much traffic in the specific polling interval, would constitute a high bandwidth condition.
01-13-2013 11:21 PM
Hello Joseph,
I did change it like this :
event manager applet TEST
event snmp oid 1.3.6.1.4.1.9.2.2.1.1.6.1 get-type exact entry-op ge entry-val 800000 entry-type increment poll-interval 30
action 1.0 syslog msg "High Traffic IN Interface Fa0/1"
This is only for the INPUT on the interface, can't put second line for the OUTPUT in the event. If the second line for OUTput is configured then the line with INPUT is replace by the line with OUTPUT. Can you help with this problem ? I did use
locIfOutBitsSec and locIfinBitsSec. Is ok if i use old mib locIfOutBitsSec and locIfinBitsSec on interface that have a limitation 1Mbps or to use ifHCOutOctets and ifHCInOctets ?
Thank you very much.
Bogdan
01-14-2013 06:35 AM
You can use these objects, but they are deprecated, and may not work on all platforms. If they are working for you, then that's fine.
You can use the same multi-event construct as in the original applet to track both input and output bandwidth. Note: if you use locIf*BitsSec, the entry-type is not increment. It is value. The increment type should only be used for counter objects.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide