Hi, I want to develop an applet using correlation of 2 events: - CPU load behond a threshhold AND - specific syslog message received What I want is to launch actions when the 2 events occur in the same tme. My doubt is: what happens if the switch detect a CPU load one day, then receive the syslog mesasge another day? Does the appletconsider the event happened, and wait (without limit of time) up to have the 2d event occuring? Or it there a timeout or a way to implement a timeout? thanks by advance P. ... View more

Hi, I am developping a EEM TCL script (let's say; "INT.tcl" based on a syslog event which has to occur 3 times in less that 60 seconds to be executed ::cisco::eem::event_register_syslog tag e1 pattern "xxxxxxx" occurs 3 period 60. The event is correlated with ::cisco::eem::event_register_none, in order to execute this script from another script (let's say: LAUNCH.tcl) I am trying to find a solution to stop INT.tcl execution (exit 0) after 60 seconds (if I am not wrong, by default, if the event ::cisco::eem::event_register_none happens one (execution from LAUNCH.tcl), the it continues indefinitely to monitor syslogs up to have 3 events in less than 60s. What could be the solution? Thanks by advance P. ... View more

Hi, I am totally beginner in EEM scripts, and try to find a solution to disable an interface in the following conditions: - a syslog message appears becaus of Storm control limit reached, - this message appears at least 1 time during a 30 second period, and at least 1 time in each of the next 5 other 30 seconds period My first concern is to extract, from the syslog message, the name of interface, as a variable: 018136: Aug  6 05:07:36.002 MET: %PM_PLATFORM-5-PORTDROP: Port GigabitEthernet1/1 dropped packets due to storm control Is it possible through a EEM applet, or the only solution is TCL script? Thanks by advance. Regards. P. ... View more

Hi, we configured broadcast storm control on our C6500. We would like now to add multicast storm control, but with another value (bigger) than for broadcast. The problem is when I configure multicast level, it changes automatically the value for broadcast. Is it a way to avoid that? Regards. D. ... View more

Hi, I notice on my 6500 qui te a lot of multicast traffic processed by the CPU. For exemple, I have a lot of SRVLOC traffic on IP address 239.255.255.253. - TTL is 250 - there is no IP options in packet - packet is not fragmented so I don't see the reason of such a traffic processed by CPU ... Any idea? Thanks by advance. ... View more

Hi, I would like to apply an ARP rate limiter on my C6500. The average ARP traffic is low, however, every 60 seconds, there is a peak, some times close from 1Mbps. This peak is due to unicast ARP request; I have readen in other discussions that these ARP unicast request are generated by Cisco to refresh the ARP table. So I could police ARP traffic to 1Mbps to avoid drops during these peaks, but this limit seems really high, and I ask myself if it is finally really necessary. What's your experience about that? Thanks ... View more

Hi, in order to mitigate layer 2 loops on my C6500, I'd like to implement ARP rate limiter. Doing a span of arp traffic on the Sup720 rp & sp, I notice an average arp traffic of 10kb/s. I don't notice traffic peak, event with a 100ms step. So I configured my rate limiter as following: mls qos protocol arp police 64000 1000. 64000bps is far from the 10000bps I observed with span 1000 byte of Bc means, if I am correct, means burst of 1000bytes on a 125ms interval. Looking at span result, my burst value shloud be enough to avoid policed packets. But is is not the case: #sh mls qos protoc Modes: P - police, M - marking, * - passthrough Module: All - all EARL slots;    Dir: I&O - In & Out;   F - Fail Proto Mode Sid Mod Dir AgId Prec         Cir    Burst   AgForward-By   AgPoliced-By ------------------------------------------------------------------------------------      ARP    P   1   1  In    4    -       64000     1000          42908           3008      ARP    P   1   2  In    4    -       64000     1000          19652              0      ARP    P   1   5  In    4    -       64000     1000          16764              0      ARP    P   1   6  In    4    -       64000     1000          61872          20928      ARP    P   1   8  In    4    -       64000     1000              0              0      ARP    P   2   1  In    4    -       64000     1000          20996            836      ARP    P   2   4  In    4    -       64000     1000           3488              0      ARP    P   2   5  In    4    -       64000     1000          12834            256      ARP    P   2   6  In    4    -       64000     1000          42738          10304      ARP    P   2   7  In    4    -       64000     1000          17430            640      ARP    P   2   8  In    4    -       64000     1000              0              0      ARP    P   2   9  In    4    -       64000     1000           5632              0 So I change Bc value for 4000 (Tc=500ms). There is still policed packets, but result is better (in the following outpur, all policed packet appeard in one time, so I guess during a burst): Proto Mode Sid Mod Dir AgId Prec         Cir    Burst   AgForward-By   AgPoliced-By ------------------------------------------------------------------------------------      ARP    P   1   1  In    4    -       64000     4000          53100           1088      ARP    P   1   2  In    4    -       64000     4000          19912              0      ARP    P   1   5  In    4    -       64000     4000          20446              0      ARP    P   1   6  In    4    -       64000     4000          70236          20096      ARP    P   1   8  In    4    -       64000     4000              0              0      ARP    P   2   1  In    4    -       64000     4000          25728              0      ARP    P   2   4  In    4    -       64000     4000           3344              0      ARP    P   2   5  In    4    -       64000     4000          15468              0      ARP    P   2   6  In    4    -       64000     4000          53796           6210      ARP    P   2   7  In    4    -       64000     4000          23222              0      ARP    P   2   8  In    4    -       64000     4000              0              0      ARP    P   2   9  In    4    -       64000     4000           4928              0 Then I tried Bc = 8000 (Tc = 1s!). Quite no more policed packets. [Edit] And finally, Bc = 16000 (Tc = 2s, which has no sense!!) => still packets policed (span indicate no peaks!): Proto Mode Sid Mod Dir AgId Prec         Cir    Burst   AgForward-By   AgPoliced-By ------------------------------------------------------------------------------------      ARP    P   1   1  In    4    -       64000    16000        1355426          12032      ARP    P   1   2  In    4    -       64000    16000         553734              0      ARP    P   1   5  In    4    -       64000    16000         480478              0      ARP    P   1   6  In    4    -       64000    16000        2071666          33472      ARP    P   1   8  In    4    -       64000    16000              0              0      ARP    P   2   1  In    4    -       64000    16000         657224           3976      ARP    P   2   4  In    4    -       64000    16000          94732              0      ARP    P   2   5  In    4    -       64000    16000         404400              0      ARP    P   2   6  In    4    -       64000    16000        1412826          35584      ARP    P   2   7  In    4    -       64000    16000         518716              0      ARP    P   2   8  In    4    -       64000    16000              0              0      ARP    P   2   9  In    4    -       64000    16000         149308              0 I guess there is a misunderstanding of me with this burst value, or with the span interpretation. Has someone any idea ? Thanks! ... View more