Monitor Capture "Error! Could not prepare EPC session."

[hakan.topcu]

Hi,

I have a problem with the embedded packet capture feature on a C4510R+E / SUP7-E (v. 03.04.06.SG) device

I tried to start a monitor session with an extended ACL applied as a filter

- before I used the capture session without the ACL, and it worked -

Status Information for Capture OSPF
  Target Type:
   Interface: TenGigabitEthernet6/2, Direction: both
   Status : Inactive
  Filter Details:
   Access-list: ACL_MON_OSPF
  Buffer Details:
   Buffer Type: LINEAR (default)
  File Details:
   Associated file name: bootflash:OSPF.CAP
   Size of buffer(in MB): 1
  Limit Details:
   Number of Packets to capture: 0 (no limit)
   Packet Capture duration: 0 (no limit)
   Packet Size to capture: 0 (no limit)

As I started the capture, I got the following error output:

mon cap OSPF start

Feb 23 10:06:56.297 UTC: %IOSXE-2-PLATFORM: process ng_dumper: Process cat4k-epc_sm_li: terminated abnormally.
Feb 23 10:06:57.066 UTC: %IOSXE-2-PLATFORM: process ng_dumper: /flash3/CRASH/crashinfo_cat4k-epc_sm_li_20160223-100656-UTC has been generatedError! Could not prepare EPC session.
 Failed to start capture: Failed to start Wireshark
Unable to activate Capture.

Subsequently, I can not start the monitor capture anymore. Even if I delete the whole session and create a new one, I always get the error message:

Error! Could not prepare EPC session.
 Failed to start capture: Failed to start Wireshark
Unable to activate Capture.

I found a Bug document regarding the first error messsage:

Symptom:
The switch crashes with a message like the following:
%IOSXE-2-PLATFORM: process ng_dumper: Process eicored: terminated abnormally.

Conditions:
Sup7E, Sup7L-E or 4500X
CLI commands being issued at high rate, usually by a script.

Workaround:
Avoid scripted CLI

https://tools.cisco.com/bugsearch/bug/CSCtz19897

Any idea, what's wrong now?

Thanks in advance

Best regards

Hakan

[Mark Malone · Accepted solution]

Looks like the process gets jammed when it trys to start , you will prob need to reboot to restart it. But if your going to do that you may as well go to an IOS the bug is not effecting at same time

[hakan.topcu]

Thanks, a failover to the redundant supervisor solves the problem.

The switch is running Version 3.4.6.SG, 15.1(2)SG6

but the Bug stated above should be solved already with 3.4.1SG (!?!?)

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_27990-01.html

Resolved Caveats for Cisco IOS XE Release 3.4.1SG

...

• If a switch issues CLI commands at a high rate (usually by script), it crashes with a message like the following:

%IOSXE-2-PLATFORM: process ng_dumper: Process eicored: terminated abnormally.

Workaround: Avoid scripted CLI. CSCtz19897

---------------

But anyway, we will aim to upgrade to a newer version.

Thanks / best regards

Hakan