Event manager script not working as expected

Question

On a Cisco 4900M running Version 12.2(53)SG1, trying to capture certain information requested by Cisco TAC to troubleshoot periodic high cpu usage on the device causing it to momentarily not respond to HSRP packets from the HSRP partner.
This is the script in place today:
event manager applet capture_cpu_spike
event snmp oid 1.3.6.1.4.1.9.2.1.56 get-type next entry-op ge entry-val "80" exit-time 10 poll-interval 1
action 1.0 syslog msg "CPU Utilization is high"
action 2.0 cli command "en"
action 3.0 cli command "show proc cpu sort | redirect bootflash:cpuinfo1.txt"
action 3.1 cli command "show int summ | redirect bootflash:cpuinfo2.txt"
action 3.2 cli command "show proc cpu sort | redirect bootflash:cpuinfo3.txt"
action 3.3 cli command "show int summ | redirect bootflash:cpuinfo4.txt"
action 3.4 cli command "show platform cpu packet statistics | redirect bootflash:cpuinfo5.txt"
action 3.5 cli command "show platform health | redirect bootflash:cpuinfo6.txt"
action 4.0 cli command "end"
Problem is, when the cpu does spike, only action 3.1 is executed.
How do I modify this script to run all the commands listed?
TIA
dom

Answer 1

Let me first explain why your script is not working for you.
Basically, the problem you encounter is a result of a common misconception about copyin(). It is intended to be used to copy content of userspace memory into a scratch buffer so that it can be accessed directly from within kernel space (where the DTrace core executes). That said, it is often interpreted as somehow being equivalent to malloc() whereas in reality it actually works like alloca() instead. So, what you are seeing is basically the artefact of the scratch buffer being overwritten with other data. And unfortunately, that is perfectly legal.
The content of the scratch buffer pointed to by self->addr in your script is only valid for as long as the specific probe enabling is executing (it is clause-local). So, your clauses to print out the actual bytes in the buffer are looking at a buffer that is for all intends and purposes no longer reserved, and therefore you are looking at it after other data was written to the scratch space.
So... in order for this to work, you should do things a bit different. Rather than trying to get a copy of the buffer in one clause, and then read from it in following clauses, you can simply collect the buffer address in the entry read:entry clause, get the number of bytes read in the first read:return clause, and then for every clause in which you print 4 bytes do the following (example for bytes 4-7):
syscall::read:return
/execname == "foobar" && self->nbytes > 4/
this->addr = (char *)copyin((uintptr_t)self->bufferaddr + 4, 4);
printf(" 4- 7: %02x %02x %02x %02x\n", this->addr[0], this->addr[1], this->addr[2], this->addr[3]);
So basically, for every clause that print 4 bytes you copyin those bytes, and then print them out.