cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1146
Views
5
Helpful
1
Comments
Joe Clarke
Cisco Employee
Cisco Employee

By combining EEM with the Embedded Packet Capture (EPC) feature, one can create an ever-running packet capture on the device that can be automatically stopped when a problem occurs.  Once stopped, the resulting capture file will be emailed to a recipient.  The result is a snapshot of the traffic leading up to and at the moment a problem occurs on the network. 

The attached Tcl policy uses the standard EEM email environment variables as well as the following:

$dpr_syslog : Syslog message pattern for which to watch before stopping the packet capture

$dpr_cappnt : EPC capture point

$dpr_capbuf : EPC Capture buffer

A sample EPC configuration for this policy would be:

monitor capture point ip cef cappnt all both

monitor capture buffer capbuf size 512 max-size 1518 circular

monitor capture point associate cappnt capbuf

monitor capture point start cappnt

Comments
benterry3
Level 1
Level 1

You know, I was looking for a EMM script to run on a periodic basis to help identify network issues s time permits one to review a capture for any TCP delays, DNS delays , bad TCP pakets, etc. But I came across your script and this makes so much sense to me. i will test and let you know if we roll out in production. Thanks a bunch, very clever indeed!!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco