Shut down interface based on CRC errors

[cofee]

I need someone to verify this script and let me know if this will work in an event when there are more than 2 line errors detected
on the serial interface. I haven't worked with EEM in the past so please let me know if I have configured it incorrectly. Based on the
parameters defined in the script, would it shut the interface down if there are more than 2 line errors detected on the serial interface.
Can you explain how does the polling interval work? based on the configuration does it mean that it will go and check every 10 seconds
what the CRC value is on the serial interface? One more thing, lets say I already have 1 crc error on the serial interface before I apply this script, in that case would it work and shut down the interface if I change the value to 1 instead of 2. If so, I tried that and it
didn't work or is there a way to test this script?

This is the script I will be using:

event manager applet SCRIPT authorization bypass
event interface name serial0/1 parameter input_errors_crc entry-op ge entry-val 2 entry-type increment poll-interval 5
action 1.0 syslog priority errors msg "interface serial0/1 has seen CRC errors"
action 2.0 cli command "enable"
action 3.0 cli command "configure terminal"
action 4.0 cli command "interface serial0/1"
action 5.0 cli command "shutdown"

* If I want to set parameters that it should only shut the interface if it sees 100 crc in a 30 minute timeframe, is that possible?
or timeframe can't be configured and it will only work based on the amount of CRC errors configured and whenever it reaches that
number the script will kick in and shut down the interface.

Comments/suggestions are greatly appreciated.

[Joe Clarke · Accepted solution]

Your applet and understanding are correct.  The polling-interval specifies how often to look at the value of the CRC counter.  In this case, the counter will be evaluated every five seconds.  If the diff (or incremental value) between the value now and the value the last time the policy fired is greater than or equal to 2, then the applet will fire.

You could set this threshold value to 100 and the timer to 30 minutes.  It would come close to what you want to do, but it will still evaluate the diff between the current value and the value the last time the policy fired (or the time it was first configured).

You might also try using the "rate" entry-type to give you more of a rate of increase.

[cofee]

Thanks a lot for the explanation.

I have few more questions:

1) Lets say that policy is set for 100 CRC errors and the interface is shutdown once it reaches that value by the EEM applet. After that someone logs into the router and bring that interface back up that was shut down by the script without issuing the command "clear counters serial1/0. So would it be safe to say that the next time EEM script will fire up when the CRC errors value is at 200 since the counters were never cleared? I went through your explanation again and I was able to find the answer for this question. Based on your explanation my understanding is correct.

2) Can you please give me an example how to integrate "rate" entry type in my policy and what would it accomplish?

3) Is it possible to set the policy in a way that it will only trigger the script if it sees X amount of crc errors within a certain time value? for example I want the policy to trigger only if  it detects 300 crc errors within 10 minutes.

[Joe Clarke]

1. Correct.

2. Just change "increment" to rate.  This would give you the actual rate of change of CRCs, which sounds like what you want.

3. Yes, that's what rate should give you.

[cofee]

Thanks again!

I am getting all these options when I replace increment with rate and not sure which one to use. It says I must use average-factor when use rate command. Which option and what the syntax should be if I want to set the policy to trigger if it detects 300 crc errors in 5 minutes.

* event interface name Serial2/0 parameter input_errors_crc entry-op ge entry-val 2 entry-type rate

options:

 average-factor  Period used for rate based calculations
  exit-comb       Exit combination operator for exit condition tests
  exit-event      Raise an exit event upon exit
  exit-op         Exit comparison operator
  exit-time       Time before event monitoring is reenabled
  exit-type       Exit comparison type
  exit-val        Exit counter value for interface event
  maxrun          Maximum runtime of applet
  poll-interval   Interval between consecutive polls in seconds

[Joe Clarke]

This depends.  You could set the average-factor to 2, and this would collect two samples and diff the two.  The average would then be over the two samples.  So, after two polling cycles, it should do what you want (assuming you have set your poll-interval to 300).

Now, if you want to collect the max samples and poll more frequently, you can set this to 0.  The same logic is done (the current sample is compared to the last), but you will have a more granular picture of the rate of increase of CRCs.

[cofee]

Based on your post and my understanding I came up with this script, but I am getting error that script is incomplete.

event intername name s3/1 parameter input_errors_crc entry-op ge entry-val 2000 average factor 2 poll interval 300

* my goal with this script is to shut down the interface if there are 2000 line errors detected in 5 minutes.

Please let me know what I am missing.

[Joe Clarke]

You're missing entry-type rate.

[cofee]

Thanks for the correction. It took the command after I included "entry-type rate". Now just to double check, this script will continue to poll every 5 minutes and if it detects 2000 CRC errors within those 5 minutes it will shut down the interface.

[Joe Clarke · Accepted solution]

It will take two polling periods at least, but it should give you what you want.

[raulnc985]

Hi Joe,

I have the same problem.

I want to see if an interface has 2 (or more) CRC errors in a 20 second interval but it doesn't work for me. My config is as follows:

event interface name GigabitEthernet0/1 parameter input_errors_crc entry-op ge entry-val 2 entry-type rate average-factor 2 poll-interval 20

With this configuration the applet is never activated.

Where's the mistake?

Thanks,

Raul