Embedded event manager question

[mogli]

Hi,

we have an cpu utillization issue at one ouf our customers cisco 7600 router. in the average everything works as designed (cpu util. is about 15%), but within a week we have (not periodicly but recurrent) 2 - 5 cpu spikes of about 100% (if we can trust "show proc cpu hist"), we can't explain.

now it would be very interesting to know, which process(es) cause this high utilization. as they occur at random times, it's not realy possible to do a "sh proc cpu" manually ;-)

i've read about the embedded event manager and it sounds as if this could be the tool to accomplish this task. we have already done some basic tests with the EEM but our demand seems to be a little bit tricky to implement (even if it sounds very straight):

"when the cpu utilization reaches 95% or more, i want to execute a "show proc cpu | e 0.0" and save the output somewhere"

has anyone of you an idea how implement this demand with EEM? do i need additional or other tools/mechanism to get the needed information (like the Embedded Resource Manager, ERM)? am i thinking too complicated, and the information i need is much easier to get?

thanks a lot for your help and

kind regards,

[Joe Clarke · Accepted solution]

What version of IOS are you running on the 7600? EEM would definitely work for this, but it is only available in 12.2(18)SXF4 for the 7600.

To do exactly what you want, you'd need to write an EEM TCL policy. However, if you were content with the whole show proc cpu (maybe show proc cpu sorted) appended to a file in flash, this EEM applet policy would work:

event manager applet cpucheck

event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6 get-type next entry-op ge entry-val 95 entry-type value exit-op lt exit-val 95 exit-type value poll-interval 10

action 1.0 syslog priority critical msg "Current CPU utilization is $_snmp_oid_val"

action 2.0 cli command "enable"

action 3.0 cli command "term exec prompt time"

action 4.0 cli command "show proc cpu sorted | append disk1:/cpu.txt"

This would watch the CPU of the RP to see if it hits 95%. If so, it will append the contents of show proc cpu sorted to disk1:/cpu.txt. The top of the output would contain the current time.

[mogli]

hi,

thanks a lot - your applet works great and delivers exactly the information we need. it seems that the "append" statement only works on the disk: filesystem. writing to the "flash:" or "tftp:" filesystem only allows the "tee" statement (as i did it in the lab-test with a c2600xm router), which overwrites the content of the file each time the event occurs - but this is still much better than having no information...;-)

will there be cpu issues while running this applet on a c7600?

kind regards,

[Joe Clarke]

The append command only works when the file system supports such operations. Linear flash is not appendable (only compact flash or ATA flash disks will work).

The CPU hit with this applet will be negligible. This applet will run every 10 seconds, and will have less overhead than the comparable network SNMP poll.

As I said, with 12.2(18)SXF4 on the 7600, you have the ability to turn this into a TCL policy. This will give you much more power, including the ability to create timestamped files in flash with the CPU information you need. See http://www.cisco.com/en/US/products/ps6017/products_feature_guide_book09186a008064206b.html for more on writing EEM policies for modular CatIOS.