storing a snmp value

[bryan totten]

I am new to EEM and am trying to create some simple functionality.  I would like to check a value of an oid every hour and send an alert if this value has changed since the last polling.  This oid is for dropped packets (discards).

The oid is a cummulative value and continues to increment with each dicard.  I am not concerned about the actual value instead if it has changed.  IS IT POSSIBLE to handle this situation by storing a variable somehow and then checking for differences during the next polling?  Perhaps there is an easier way to handle.  Any help would be appreciated.

thanks!

oid:       1.3.6.1.2.1.2.2.1.19    if-mib:ifoutdiscards

[Joe Clarke]

The SNMP event detector has this capability built right in:

event snmp oid 1.3.6.1.2.1.2.2.1.19.1 entry-op ge entry-val 10 entry-type increment poll-interval 10

action 1.0 syslog msg "ifOutDiscards increased by $-snmp_delta_value in the last 10 seconds"

This will monitor the interface with the ifIndex of 1 for ifOutDiscards every 10 seconds.  If the increase is 10 or more, then the action will fire.

[bryan totten]

I really appreciate the quick response. 

It sounds like this is exactly what i am looking for however, when i enter the event command it gives incomplete command error. Based on the context sensitive help options i am not sure how to complete.

thanks again!

[Joe Clarke]

Sorry, try this:

event snmp oid 1.3.6.1.2.1.2.2.1.19.1 entry-op ge entry-val 10 entry-type increment poll-interval 10 get-type exact

action 1.0 syslog msg "ifOutDiscards increased by $_snmp_delta_value in the last 10 seconds"

[bryan totten]

It took this command by simply specifying a specific interface using a oid: 1.3.6.1.2.1.2.2.1.19.10148.  I am seeing the conditions met for the event to trigger, however no syslog is getting generated.

my config looks as follows:

event manager session cli username "tecbtt"

event manager applet DROPS

event snmp oid 1.3.6.1.2.1.2..2.1.19.10148 get-type exact entry-op ge entry-val "10" entry-type increment poll-interval 10

action 1 syslog msg "drops have occurred"

action 1.0 syslog msg "ifOutDiscards increased by $_snmp_delta_value in the last 10 seconds"

When i go to show inter g 1/0/48 i see there have been more than output drops and should have triggered this event.  Is there any other troubleshooting statement that i can check?

thanks!!

[Joe Clarke]

The entry-type is increment, so the number of discards would have had to increase by 10 within that 10 second window.  Has that been the case?

[bryan totten]

Joseph,

this is now working great and i appreciate your help!!  I have two more related questions:

I am currently using the following:

event manager applet DROPS

event snmp oid 1.3.6.1.2.1.2.2.1.19.10148 get-type exact entry-op gt entry-val "1" entry-type increment poll-interval 10

action 1 syslog priority informational msg "drops have increased by more than 1 in the last 10 seconds"

question 1)  I am wanting to check for drops across all interfaces.  Do i have to write a applet for every interface as done above for interface g 1/0/48?  Is there a way to loop through all interfaces and add to total drops and compare this with the previous polling value?

question 2)  In the syslog msg, how can i display the oid value resulting from the polling?

thanks!!

[Joe Clarke]

Yes, in this case, you would need one applet per interface.  Doing one policy for all interfaces would add substantially more complexity, but it could be done using Tcl.

You can use the variable $_snmp_delta_value to display the change value.