10-09-2013 10:31 AM
Hi.
The MWR2900 router has a known bug for Marvel chip, which causes the CPU utilization to spike.
https://tools.cisco.com/bugsearch/bug/CSCtz75800
The workaround is the command "clear mac-address-table secure"
I've written the following EEM applet to issue that command upon the Marvel syslog:
event manager applet MARVEL
event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 1.0 cli command "enable"
action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"
action 3.0 cli command "clear mac-address-table secure"
I would like this applet to trigger only once an hour, regardless of the number of related syslogs (%MWR2900MRVL_FLTMG-5-EVENT_WARNING).
How can this be accomplished.
Thanks for any assistance.
Joe Razionale
10-09-2013 11:23 AM
Change the event line to:
event timer watchdog time 3600
10-09-2013 11:30 AM
Joseph,
I'm hoping to trigger on that exact syslog pattern.
I'm trying to prevent multiple executions of the script.
Joe
10-09-2013 10:18 PM
Ah, I misunderstood. There are a number of ways you could do this. One thing that might be easiest is to configure two applets:
event manager applet MARVEL
event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 1.0 cli command "enable"
action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"
action 3.0 cli command "clear mac-address-table secure"
action 4.0 cli command "config t"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event none"
action 7.0 cli command "exit"
action 8.0 cli command "event manager applet MARVEL-countdown"
action 9.0 cli command "event timer countdown time 3600"
action 9.1 cli command "end"
!
event manager applet MARVEL-countdown
event none
action 1.0 cli command "enable"
action 2.0 cli command "config t"
action 3.0 cli command "event manager applet MARVEL-countdown"
action 4.0 cli command "event none"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event syslog pattern %MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 7.0 cli command "end"
10-10-2013 07:41 AM
Joseph,
Upon further thought, there may be another solution.
Is it possible to add a condition before executing any of the "action" statements?
This script should only run if CPU utilization is high (above 75%).
This might prevent multiple triggers of repeated syslog messages.
Example:
event manager applet MARVEL
event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"
<<
action 1.0 cli command "enable"
action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"
action 3.0 cli command "clear mac-address-table secure"
Thank you for any assistance.
Joe
10-10-2013 10:59 AM
You could do this with SNMP or CLI. SNMP would likely be easiest:
action 0.1 info type snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type exact
action 0.2 if $_info_snmp_value ge 75
...
action 4.0 end
10-10-2013 11:44 AM
Thanks for the input, Joseph.
I'll give it a try.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide