Script Active Even Though Unregistered

Carlton Patterson · ‎08-27-2013

Hello Community,

I have situation where a script called netc.tcl is active but doesn't actually exists i.e. not registered.

MX-IPS1#show even manager policy active

Key: p - Priority :L - Low, H - High, N - Normal, Z - Last

s - Scheduling node :A - Active, S - Standby

default class - 1 script event

no. job id p s status time of event event type name

1 541285 N A running Tue Jul30 12:31:22 2013 none netc.tcl

Can someone please show me how to remove it

Below is a list of scripts currently registered:

MX-IPS1#show run | inc event

event manager directory user policy "flash:/"

event manager scheduler script thread class Z number 5

event manager policy stateInterfacestatus.tcl

event manager policy utilisationHighInterfaceUtilization.tcl

event manager policy cpuHighCPUUsage.tcl

event manager policy memoryHighMemory.tcl

event manager policy configCONFCHG.tcl

event manager policy envAssetChassisIssue.tcl

event manager policy syslogOSPF.tcl

event manager policy syslogIPNAT.tcl

event manager policy syslogIOSVLAN.tcl

MX-IPS1#show eve m p r

No. Class Type Event Type Trap Time Registered Name

1 script user timer watchdog Off Sun Aug 25 18:54:37 2013 stateInterfacestatus.tcl

name {stateInterfacestatus} time 60.000

nice 1 queue-priority low maxrun 20.000 scheduler rp_primary

2 script user timer watchdog Off Sun Aug 25 18:54:37 2013 utilisationHighInterfaceUtilization.tcl

name {utilisationHighInterfaceUtilizat} time 60.000

nice 1 queue-priority low maxrun 60.000 scheduler rp_primary

3 script user timer watchdog Off Sun Aug 25 18:54:37 2013 cpuHighCPUUsage.tcl

name {cpuHighCPUUsage} time 60.000

nice 1 queue-priority low maxrun 20.000 scheduler rp_primary

4 script user timer watchdog Off Sun Aug 25 18:54:37 2013 memoryHighMemory.tcl

name {memoryHighMemory} time 60.000

nice 1 queue-priority low maxrun 20.000 scheduler rp_primary

5 script user syslog Off Sun Aug 25 18:54:37 2013 configCONFCHG.tcl

occurs 1 pattern {SYS-5-CONFIG_I.*}

nice 0 queue-priority normal maxrun 20.000 scheduler rp_primary

6 script user syslog Off Sun Aug 25 18:54:38 2013 envAssetChassisIssue.tcl

severity-warning severity-minor severity-major severity-critical severity-fatal occurs 1 pattern {ENV.*}

nice 0 queue-priority normal maxrun 60.000 scheduler rp_primary

7 script user syslog Off Sun Aug 25 18:54:38 2013 syslogOSPF.tcl

priority all pattern {OSPF}

nice 0 queue-priority normal maxrun 20.000 scheduler rp_primary

8 script user syslog Off Sun Aug 25 18:54:38 2013 syslogIPNAT.tcl

priority all pattern {IPNAT}

nice 0 queue-priority normal maxrun 20.000 scheduler rp_primary

As you can see netc.tcl isn't actually registered but still active.

Thanks in advance for your help.

Cheers

Joe Clarke · ‎08-27-2013

Try "event manager scheduler clear all". If that doesn't work, you'll need to reload.

mtimm · ‎08-27-2013

Hi Carlton,

I'm sorry, what version of code is this? This should not be possible in the latest versions of EEM 2.4 and later. I committed the fix to prevent this via CSCso98512 - Running EEM scripts should be terminated when removed from the config. After this change, when the policy is unregistered it should be forcibly killed similar to how the maxrun timer kills a policy.

Mike

Joe Clarke · ‎08-27-2013

The code was changed again to allow policies to continue to run because of the common use case of unregistering the policy from itself then doing some other cleanup. So in very new versions of code, this behavior is expected. Though it should be killable with the scheduler clear command.

Carlton Patterson · ‎08-27-2013

Hello all,

Thanks ever-so-much for getting to me.

I have tried clearing the script with "event manager scheduler clear all" but to no avail.

The versions are as follows:

MX-IPS1#show version

Cisco IOS Software, C181X Software (C181X-ADVIPSERVICESK9-M), Version 12.4(24)T2, RELEASE SOFTWARE (fc2)

Technical Support: http://www.cisco.com/techsupport

Compiled Tue 20-Oct-09 01:15 by prod_rel_team

ROM: System Bootstrap, Version 12.3(8r)YH6, RELEASE SOFTWARE (fc1)

MX-IPS1 uptime is 17 weeks, 6 days, 1 hour, 44 minutes

System returned to ROM by Reload Command

System restarted at 19:31:27 UTC Wed Apr 24 2013

System image file is "flash:c181x-advipservicesk9-mz.124-24.T2.bin"

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

Cisco 1812 (MPC8500) processor (revision 0x400) with 118784K/12288K bytes of memory.

Processor board ID FCZ1101109R, with hardware revision 0000

10 FastEthernet interfaces

1 ISDN Basic Rate interface

31360K bytes of ATA CompactFlash (Read/Write)

Configuration register is 0x2102

X-IPS1#show event manager version

Embedded Event Manager Version 3.00

Component Versions:

eem: (v300_throttle)2.2.2

eem-gold: (v300_throttle)1.0.10

eem-call-home: (v300_throttle)2.0.2

Event Detectors:

Name Version Node Type

appl 01.00 node0/0 RP

syslog 01.00 node0/0 RP

resource 01.00 node0/0 RP

routing 01.00 node0/0 RP

track 01.00 node0/0 RP

cli 01.00 node0/0 RP

counter 01.00 node0/0 RP

gold 01.00 node0/0 RP

interface 01.00 node0/0 RP

ioswdsysmon 01.00 node0/0 RP

ipsla 01.00 node0/0 RP

none 01.00 node0/0 RP

nf 01.00 node0/0 RP

oir 01.00 node0/0 RP

snmp 01.00 node0/0 RP

snmp-notification 01.00 node0/0 RP

timer 01.00 node0/0 RP

test 01.00 node0/0 RP

config 01.00 node0/0 RP

env 01.00 node0/0 RP

rpc 01.00 node0/0 RP

MX-IPS1#

If you can think of any other suggestion other than reloading the router I would be truly grateful.

Regards

Carlton

Joe Clarke · ‎08-27-2013

You should see the policy terminate on unregistering it in this release. However, I have seen cases where this did not work if the policy enters a blocking state. One way that can happen is reading from a socket. In these cases, the only way to remove the policy was to reload. Even a maxrun expiration wouldn't work since the policy is blocked. If it were to try and execute another instruction, it would terminate, but since it won't, then it never terminates.