10-28-2010 08:27 AM
I have built a simple eem applet to monitor snmp oids in the SIP user agent and take action using cli commands to re-register with a new SIP proxy. But the applet is too sensitive and creates more problems than it solves. To improve on it, I want to implement a leaky-bucket algorthm in an applet or applets that will accumulate SIP errors from snmp oids by adding to an accumulating bucket count, and subtracting from the bucket when successful SIP/ISDN calls occur, using other snmp oids. I am having trouble figuring out how to define, initialize, add to, and subtract from the bucket count, as well as debugging the applet, by examining the bucket count after causing different events, and by seeing and interpreting error messages.
Below is my intial eem applet that is too sensitive:
event manager applet re-register-with-new-proxy
event tag 403 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.7.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 30
event tag 408 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.17.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 30
event tag 480 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.33.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 30
event tag 500 snmp oid 1.3.6.1.4.1.9.9.152.1.2.5.1.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 30
event tag InviteRetries snmp oid 1.3.6.1.4.1.9.9.152.1.2.8.1.0 get-type exact entry-op ge entry-val "2" entry-type increment poll-interval 30
event tag dhcp routing network 0.0.0.0/0 type add protocol connected ge 1
trigger
correlate event 403 or event 408 or event 480 or event 500 or event InviteRetries or event dhcp
attribute tag 403 occurs 1
attribute tag 408 occurs 1
attribute tag 480 occurs 1
attribute tag 500 occurs 1
attribute tag InviteRetries occurs 1
attribute tag dhcp occurs 1
action 1.0 cli command "en"
action 2.0 cli command "clear host all *"
action 3.0 cli command "config t"
action 4.0 cli command "sip-ua"
action 5.0 cli command "no registrar"
action 6.0 cli command "registrar dns:ims.voip.hrndva.rr.com expires 3600 refresh-ratio 83 auth-realm ims.voip.hrndva.rr.com"
action 7.0 cli command "end"
Each time the cli actions are executed, they cause additional SIP 403 errors when a call or two fails due to an unregistered SIP user. Below is the leaky bucket applets I have coded.
event manager environment bucket 0
!
event manager applet Dhcp
event tag dhcp routing network 0.0.0.0/0 type add protocol connected ge 1
action 1.0 cli command "event manager run ReReg"
event manager applet FillBucket
event tag 403 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.7.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 30
event tag 408 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.17.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag 480 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.33.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag 500 snmp oid 1.3.6.1.4.1.9.9.152.1.2.5.1.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag InviteRetries snmp oid 1.3.6.1.4.1.9.9.152.1.2.8.1.0 get-type exact entry-op ge entry-val "2" entry-type increment poll-interval 60
trigger
correlate event 403 or event 408 or event 480 or event 500 or event InviteRetries
attribute tag 403 occurs 1
attribute tag 408 occurs 1
attribute tag 480 occurs 1
attribute tag 500 occurs 1
attribute tag InviteRetries occurs 1
action 1.0 multiply _snmp_oid_delta_val 4
action 2.0 add $bucket $_result
action 3.0 set $bucket "$_result"
action 3.1 syslog msg "OID: $_snmp_oid ; Delta: $_snmp_oid_delta_val ; Bucket: $bucket"
action 4.0 if $_result ge 40
action 5.0 set $bucket "0"
action 6.0 cli command "event manager run ReReg"
action 7.0 end
event manager applet LeakBucket
event tag CallsIn snmp oid 1.3.6.1.2.1.10.20.1.3.3.1.2.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag CallsOut snmp oid 1.3.6.1.2.1.10.20.1.3.3.1.3.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
trigger
correlate event CallsOut or event CallsIn
attribute tag CallsOut occurs 1
attribute tag CallsIn occurs 1
action 1.0 subtract _snmp_oid_delta_val $bucket
action 2.0 if $_result lt 0
action 3.0 set $bucket "0"
action 4.0 else
action 5.0 set $bucket "$_result"
action 6.0 end
event manager applet ReReg
event none
action 01.0 cli command "en"
action 02.0 cli command "config t"
action 03.0 cli command "sip-ua"
action 04.0 cli command "no registrar"
action 05.0 cli command "registrar dns:ims.voip.hrndva.rr.com expires 3600 refresh-ratio 83 auth-realm ims.voip.hrndva.rr.com"
action 06.0 wait 15
action 07.0 cli command "do show sip-ua register status | include no"
action 08.0 string length "_cli_result"
action 09.0 if $_string_result gt 10
action 10.0 cli command "do clear host all *"
action 11.0 cli command "no registrar"
action 12.0 cli command "registrar dns:ims.voip.hrndva.rr.com expires 3600 refresh-ratio 83 auth-realm ims.voip.hrndva.rr.com"
action 13.0 cli command "end"
action 14.0 end
Currently, I have started testing the applets by creating a SIP Invite retry error. I get the following error message:
Oct 28 14:36:52.358 EDT: %HA_EM-6-FMPD_OPERAND_INVALID: Invalid operand in action, expected value within range -2147483648 to 2147483647, received: _snmp_oid_delta_va
Oct 28 14:36:52.358 EDT: %HA_EM-3-FMPD_ERROR: Error executing applet FillBucket statement 1.0
Below is the statement that is causing the error
action 1.0 multiply _snmp_oid_delta_val 4
I am doing the multiply by 4 to give greater weight to errors than to succesful calls, each of which reduces (leaks) the bucket count by 1.
I have tried turning on debug eem all, but the output is too massive to make sense of. I am having trouble finding clear documentation on how to define the bucket variable, how to query its value interactively, and how to see errors when the applets execute. Can anyone help?!
Message was edited by: Alfred Johnson
10-28-2010 11:39 PM
It looks like you're almost there, but you're missing a few '$' here and there, and you have extra ones where you don't need them. The other problem is that you're misusing environment variables. If you want to share a variable across policies, you need to use contexts. Try these versions:
event manager environment bucket 0
!
event manager applet Dhcp
event tag dhcp routing network 0.0.0.0/0 type add protocol connected ge 1
action 1.0 cli command "event manager run ReReg"!
event manager applet FillBucket
event tag 403 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.7.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 30
event tag 408 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.17.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60 event tag 480 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.33.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60 event tag 500 snmp oid 1.3.6.1.4.1.9.9.152.1.2.5.1.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag InviteRetries snmp oid 1.3.6.1.4.1.9.9.152.1.2.8.1.0 get-type exact entry-op ge entry-val "2" entry-type increment poll-interval 60
trigger
correlate event 403 or event 408 or event 480 or event 500 or event InviteRetries
attribute tag 403 occurs 1
attribute tag 408 occurs 1
attribute tag 480 occurs 1
attribute tag 500 occurs 1
attribute tag InviteRetries occurs 1action 0.5 context retrieve key SIPCTXT variable bucket
action 1.0 multiply $_snmp_oid_delta_val 4
action 2.0 add $bucket $_result
action 3.0 set bucket "$_result"
action 3.1 syslog msg "OID: $_snmp_oid ; Delta: $_snmp_oid_delta_val ; Bucket: $bucket"
action 4.0 if $_result ge 40
action 5.0 set bucket "0"action 5.1 context save key SIPCTXT variable bucket
action 6.0 cli command "event manager run ReReg"
action 7.0 end!
event manager applet LeakBucket
event tag CallsIn snmp oid 1.3.6.1.2.1.10.20.1.3.3.1.2.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60 event tag CallsOut snmp oid 1.3.6.1.2.1.10.20.1.3.3.1.3.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
trigger
correlate event CallsOut or event CallsIn
attribute tag CallsOut occurs 1
attribute tag CallsIn occurs 1action 0.5 context retrieve key SIPCTXT variable bucket
action 1.0 subtract $_snmp_oid_delta_val $bucket
action 2.0 if $_result lt 0
action 3.0 set bucket "0"
action 4.0 else
action 5.0 set bucket "$_result"
action 6.0 endaction 7.0 context save SIPCTXT variable bucket
!
event manager applet ReReg
event none
action 01.0 cli command "en"
action 02.0 cli command "config t"
action 03.0 cli command "sip-ua"
action 04.0 cli command "no registrar"
action 05.0 cli command "registrar dns:ims.voip.hrndva.rr.com expires 3600 refresh-ratio 83 auth-realm ims.voip.hrndva.rr.com"
action 06.0 wait 15
action 07.0 cli command "do show sip-ua register status | include no"
action 08.0 string length "$_cli_result"
action 09.0 if $_string_result gt 10
action 10.0 cli command "do clear host all *"
action 11.0 cli command "no registrar"
action 12.0 cli command "registrar dns:ims.voip.hrndva.rr.com expires 3600 refresh-ratio 83 auth-realm ims.voip.hrndva.rr.com"
action 13.0 cli command "end"
action 14.0 end
10-29-2010 01:31 PM
Joe,
Thanks for your help. I am seeing the following error when I cause a SIP error that causes EEM to run FillBucket:
Oct 29 16:12:59.718 EDT: %HA_EM-6-FMPD_CONTEXT_RETRIEVE: Failed to retrieve context for key SIPCTXT: 'Embedded Event Manager' detected the 'fatal' condition 'could not find key'l
Oct 29 16:12:59.718 EDT: %HA_EM-3-FMPD_ERROR: Error executing applet FillBucket statement 0.5
This is coming from: action 0.5 context retrieve key SIPCTXT variable bucket
This is the first invocation of bucket with context key SIPCTXT, which may not have been invoked.
I am going to read up on context saving and retrieving in the meantime, but if you get a chance, let me if you have any ideas on how to fix this context retrieve error.
Also, are there any other EEM applet programming guide documents you could recommend other than the one I am using now:
Writing Embedded Event Manager Policies
Using the Cisco IOS CLI
First Published: October 31, 2005
Last Updated: December 9, 2009
Thanks for your help
Alfy Johnson
10-29-2010 02:52 PM
Add this:
action 0.1 handle-error type ignore
...
action 0.6 handle-error type exit
10-29-2010 02:55 PM
Actually, we need to re-write more of the FillBucket applet:
event manager applet FillBucket
event tag 403 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.7.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 30
event tag 408 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.17.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag 480 snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.33.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag 500 snmp oid 1.3.6.1.4.1.9.9.152.1.2.5.1.0 get-type exact entry-op ge entry-val "1" entry-type increment poll-interval 60
event tag InviteRetries snmp oid 1.3.6.1.4.1.9.9.152.1.2.8.1.0 get-type exact entry-op ge entry-val "2" entry-type increment poll-interval 60
trigger
correlate event 403 or event 408 or event 480 or event 500 or event InviteRetries
attribute tag 403 occurs 1
attribute tag 408 occurs 1
attribute tag 480 occurs 1
attribute tag 500 occurs 1
attribute tag InviteRetries occurs 1
action 0.1 handle-error type ignore
action 0.5 context retrieve key SIPCTXT variable bucket
action 0.6 handle-error type exit
action 1.0 multiply $_snmp_oid_delta_val 4
action 2.0 add $bucket $_result
action 3.0 set bucket "$_result"
action 3.1 syslog msg "OID: $_snmp_oid ; Delta: $_snmp_oid_delta_val ; Bucket: $bucket"
action 4.0 if $_result ge 40
action 5.0 set bucket "0"
action 6.0 cli command "event manager run ReReg"
action 7.0 end
action 8.0 context save key SIPCTXT variable bucket
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide