cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1889
Views
0
Helpful
6
Replies
Joseph Razionale
Beginner

Trigger on syslog on hourly occurrence

Hi.

The MWR2900 router has a known bug for Marvel chip, which causes the CPU utilization to spike.

https://tools.cisco.com/bugsearch/bug/CSCtz75800

The workaround is the command "clear mac-address-table secure"

I've written the following EEM applet to issue that command upon the Marvel syslog:

event manager applet MARVEL

event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"

action 1.0 cli command "enable"

action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"

action 3.0 cli command "clear mac-address-table secure"

I would like this applet to trigger only once an hour, regardless of the number of related syslogs (%MWR2900MRVL_FLTMG-5-EVENT_WARNING).

How can this be accomplished.

Thanks for any assistance.

Joe Razionale

6 REPLIES 6
Joe Clarke
Hall of Fame Cisco Employee

Change the event line to:

event timer watchdog time 3600

Joseph,

I'm hoping to trigger on that exact syslog pattern.

I'm trying to prevent multiple executions of the script.

Joe

Joe Clarke
Hall of Fame Cisco Employee

Ah, I misunderstood.  There are a number of ways you could do this.  One thing that might be easiest is to configure two applets:

event manager applet MARVEL

event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"

action 1.0 cli command "enable"

action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"

action 3.0 cli command "clear mac-address-table secure"

action 4.0 cli command "config t"

action 5.0 cli command "event manager applet MARVEL"

action 6.0 cli command "event none"

action 7.0 cli command "exit"

action 8.0 cli command "event manager applet MARVEL-countdown"

action 9.0 cli command "event timer countdown time 3600"

action 9.1 cli command "end"

!

event manager applet MARVEL-countdown

event none

action 1.0 cli command "enable"

action 2.0 cli command "config t"

action 3.0 cli command "event manager applet MARVEL-countdown"

action 4.0 cli command "event none"

action 5.0 cli command "event manager applet MARVEL"

action 6.0 cli command "event syslog pattern %MWR2900MRVL_FLTMG-5-EVENT_WARNING"

action 7.0 cli command "end"

Joseph,

Upon further thought, there may be another solution.

Is it possible to add a condition before executing any of the "action" statements?

This script should only run if CPU utilization is high (above 75%).

This might prevent multiple triggers of repeated syslog messages.

Example:

event manager applet MARVEL

event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"

<<>>

action 1.0 cli command "enable"

action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"

action 3.0 cli command "clear mac-address-table secure"

Thank you for any assistance.

Joe

Joe Clarke
Hall of Fame Cisco Employee

You could do this with SNMP or CLI.  SNMP would likely be easiest:

action 0.1 info type snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type exact

action 0.2 if $_info_snmp_value ge 75

...

action 4.0 end

Thanks for the input, Joseph.

I'll give it a try.