This Tcl policy was designed for the Catalyst 4000 series (e.g., 4500 and 4900 series) switches to check for ports that exceed a specified threshold of learned MAC addresses. If the threshold is exceeded for any interface, a syslog is sent for that interface showing the number of learned MACs.
This policy requires one EEM environment variable to be set:
event manager environment learned_mac_threshold THRESHOLD
Where THRESHOLD is the number of MACs that can be learned on a port before the syslog will be sent.
This policy was tested on a Catalyst 4500 running 15.0(2)SG3.
