Embedded Event Manager - IOS Watchdog System Monitor

[kondratev]

Hello,

I need to monitor 5 minute CPU utilization with EEM. I don't know what I need to specify in the field 'taskname' in the command 'event ioswdsysmon sub1 cpu-proc ...'? May be I need to specify 'taskname cpmCPUTotal5minRev'? I'm unsure about it.

Could you help me?

[cwildes]

Hi,

cpu-proc means that you are asking to monitor the CPU for a given IOS process. taskname is the name of the IOS process that you want to monitor.

To monitor overall CPU usage use the Embedded Resource Manager (ERM) and trigger an EEM policy using the "event resource" ED.

Thanks,

Clyde

[Pari Thiagasundaram]

Use this as an example and feel free to modify them as needed.

event manager applet cpmCPUTotal5minRev

event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.8 get-type exact entry-op ge entry-val "70" exit-time 500 poll-interval 60

    action 1.0 syslog msg "CPU Exceeded 70%"
    action 2.0 cli command "enable"
    action 3.0 cli command "term exec prompt timestamp"
    action 4.0 syslog msg "Writing CPU Utilization to Disk - disk0:cpmCPUTotal5minRev.txt"
    action 4.1 cli command "show proc cpu sorted | redirect disk0:cpmCPUTotal5minRev.txt"
    action 5.0 syslog msg "Writing CPU Processes History to Disk - disk0:cpmCPUTotal5minRev.txt"
    action 5.1 cli command "show proc cpu history | append disk0:cpmCPUTotal5minRev.txt"
    action 8.1 cli command "configure terminal"
    action 8.2 cli command "no event manager applet cpmCPUTotal5minRev"
    action 8.3 cli command "end"

[kondratev]

I tried this configuration:

event manager applet CPU

event snmp oid "1.3.6.1.4.1.9.9.109.1.1.1.1.8" get-type exact entry-op gt entry-val "60" entry-type value poll-interval 60

But when I activate 'debug event manager detector snmp', I see the following:

*Feb 20 20:03:27.754: fh_fd_snmp_process_async

*Feb 20 20:03:27.754: fh_fd_snmp_process_poll_timer: re=0x6A07B48C, timer_type=POLL

*Feb 20 20:03:27.754: snmp_entry_value_check: OID unavailable, value check skipped

*Feb 20 20:03:27.754: fh_fd_snmp_start_poll_timer: start_t=60000

I checked my IOS with MIB Locator and found that CISCO-PROCESS-MIB is contained in it.

Could you tell me please what I do wrong?

[Joe Clarke · Accepted solution]

See my other reply.  You're missing the instance.  In my example, I used the OID 1.3.6.1.4.1.9.9.109.1.1.1.1.8.1, which will work.

[Joe Clarke]

You should use the SNMP ED for what you want to do.  You could create an applet such as:

event manager applet cpu-watch
 event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.8.1 get-type exact entry-val 80 entry-op ge poll-interval 10
 ...

This would poll the first CPU, and fire an event if the five minute utilization reached 80%.  It would poll every 10 seconds.