EEM

[bogdand27]

Hello,

I want to monitoring a interface on router to see when is high traffic.I did search here on the forum(

https://supportforums.cisco.com/thread/2190808

) and found this :

event manager applet monitor-bandwidth

event tag e1 snmp oid 1.3.6.1.2.1.31.1.1.1.6.1 get-type exact entry-op eq entry-val 0 entry-type increment poll-interval 60

event tag e2 snmp oid 1.3.6.1.2.1.31.1.1.1.10.1 get-type exact entry-op eq entry-val 0 entry-type increment poll-interval 60

trigger

  correlate event e1 or event e2

action 1.0 syslog msg "Input or output octets was zero for the past 60 seconds for GigabitEthernet0/0"

but i dont know if i can use it for what i need.

Can anyone help me please .

Thank you,

Bogdan

[Joe Clarke · Accepted solution]

This applet monitors a given interface to see if it is not passing traffic for a specific amount of time.  It sounds like it would be the opposite of what you want to do.  However, you could adapt it.  Pick your polling interval, then set the entry-op to ge.  The entry-val will have to be the count of input or output octets that, if the interface passed that much traffic in the specific polling interval, would constitute a high bandwidth condition.

[bogdand27]

Hello Joseph,

I did change it like this :

event manager applet TEST

event snmp oid 1.3.6.1.4.1.9.2.2.1.1.6.1 get-type exact entry-op ge entry-val 800000 entry-type increment poll-interval 30

action 1.0 syslog msg "High Traffic IN Interface Fa0/1"

This is only for the INPUT on the interface, can't put second line for the OUTPUT in the event. If the second line for OUTput is configured then the line with INPUT is replace by the line with OUTPUT. Can you help with this problem ? I did use

locIfOutBitsSec and locIfinBitsSec. Is ok if i use old mib locIfOutBitsSec and locIfinBitsSec on interface that have a limitation 1Mbps or to use ifHCOutOctets and ifHCInOctets ?

Thank you very much.

Bogdan

[Joe Clarke]

You can use these objects, but they are deprecated, and may not work on all platforms.  If they are working for you, then that's fine.

You can use the same multi-event construct as in the original applet to track both input and output bandwidth.  Note: if you use locIf*BitsSec, the entry-type is not increment.  It is value.  The increment type should only be used for counter objects.