EEM Applet to Monitor CPU

I need to what the PID using CPU utilization at 50%.
All i see on the syslog server is " %HA_EM-2-LOG: highcpu: HIGH CPU"
EEM doesnt tell me what process is consuming the CPU at 50%
Any ideas?
event manager applet highcpu
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.10.1 get-type exact entry-op ge entry-val 50 poll-interval 5
action 1.0 cli command "enable"
action 2.0 cli command "show proc cpu sorted"
action 3.0 syslog priority critical msg "HIGH CPU"
Francisco.

Joe,
I have uploaded the script in to flash and trying to register it, i get error below.
R1(config)#event manager policy tm_alert_high_cpu.tcl
Compile check and registration failed:Wrong # args, usage is "::cisco::eem::event_register_timer watchdog|countdown|absolute|cron name ? cron_entry ? time ? queue_priority normal|low|high maxrun ? nice ?"
while executing
"::cisco::eem::event_register_timer watchdog time $high_cpu_poll_freq
Tcl policy execute failed: Wrong # args, usage is "::cisco::eem::event_register_timer watchdog|countdown|absolute|cron name ? cron_entry ? time ? queue_priority normal|low|high maxrun ? nice ?"
Embedded Event Manager configuration: failed to retrieve intermediate registration result for policy tm_alert_high_cpu.tcl: Unknown error 0
R1(config)#event manager policy tm_alert_high_cpu.tcl
Compile check and registration failed:Wrong # args, usage is "::cisco::eem::event_register_timer watchdog|countdown|absolute|cron name ? cron_entry ? time ? queue_priority normal|low|high maxrun ? nice ?"
while executing
"::cisco::eem::event_register_timer watchdog time $high_cpu_poll_freq
Tcl policy execute failed: Wrong # args, usage is "::cisco::eem::event_register_timer watchdog|countdown|absolute|cron name ? cron_entry ? time ? queue_priority normal|low|high maxrun ? nice ?"
Embedded Event Manager configuration: failed to retrieve intermediate registration result for policy tm_alert_high_cpu.tcl: Unknown error 0
R1(config)#event manager policy tm_alert_high_cpu.tcl

Similar Messages

EEM applet that triggers on high CPU utilization

Hi Folks,
I am trying to create an eem applet which triggers on high cpu utilization (detected by erm).   The applet should then tftp the output from "show proc cpu sorted" to a tftp server.
I am trying to configure this on a 1841 running 124-24.T3 code
This is my config:
resource policy
policy HighGlobalCPU global
   system
    cpu total
     critical rising 5 falling 2 interval 10
    cpu process
     critical rising 5 falling 2 interval 10
! I'm not sure whether it is correct to monitor 'cpu total' or 'cpu process'.   The rising thresholds are deliberately low to maker testing easier
event manager applet ReportHighCPU
event resource policy "HighGlobalCPU"
action 1.0 cli command "show process cpu sorted 5sec | redirect tftp://192.168.1.1/highCPU$_resource_time_sent.txt"
action 2.0 syslog priority debugging msg "high cpu event detected, output tftp sent"
The problem is that I can't seem to trigger the applet.    I have generated enough traffic to push the cpu utilization to over 30% (according to 'show proc cpu'), but the applet does not appear to trigger (no syslog messages appear, and my syslog server does not receive anything).
If anyone can tell me what I've done wrong here I would be very grateful!
Thanks,
Darragh

I am just replying off the top of my head but I believe you
need to also add to your conf the line
user global HighGlobalCPU

Naming Networks in EEM route table monitor

I have the following EEM applet running on one of my core devices to monitor any changes in the routing table.
event manager applet route-table-monitor
event routing network 0.0.0.0/0 ge 1
action 0.5 set msg "Route changed: Type: $_routing_type, Network: $_routing_network, Mask/Prefix: $_routing_mask, Protocol: $_routing_protocol, GW: $_routing_lastgateway, Intf: $_routing_lastinterface"
action 1.0 syslog msg "$msg"
action 2.0 cli command "enable"
action 3.0 info type routername
action 4.0 mail server "*.*.*.*" to "roger@*********" from "Core1" subject "Routing Table Change" body "$msg $_cli_result"
action 8.0 set msg "Route changed: Type: "
This works brilliantly however the email I get lists the networks by IP and I am trying to get it to identify them by name
Email Output
Route changed: Type: modify, Network: 10.8.4.0, Mask/Prefix: 255.255.255.0, Protocol: BGP, GW: 10.1.1.1, Intf: N/A
The script is running on a 3750
I tried putting ip host info on the switch but that did not work.
I am not sure if there is an extra line I can add to the script or if anyone else has done this?
Thanks
Roger

I don't understand the request. Where would the network "name" come from? Networks are unnamed on IOS.

EEM Applet Problem With: event syslog pattern ".*" priority 2

I went to create a EEM applet that would be invoked whenever any syslog message of priority 0-2 was invoked. I figured the following event statement would work
event syslog pattern ".*" priority 2
I never really used the priority optional argument before but thought I understood from the docs that messages at or numerically lower than the specified level are matched.
Well it doesn't seem to work as documented. Seems to me that only messages at the specified level are beng matched and not messages numerically lower than the specified level.
Anyway I did what I wanted differently but wanted to post this in case this is a bug in the syslog ed.

Actually, it's a problem with the documentation. The priority option only matches the specified severity. What you could do is adjust pattern to do this:
event syslog pattern "*-[012]-"

Is there any way to monitor CPU temp without Dual Core Center

I hate Dual Core Center it has done nothing but lock my system up is there any alteranative to monitor CPU temp/Fan speed

Quote from: Maesus on 21-March-07, 23:34:06
I use speedfan... but for Core 2 Duo, I don't think I have to worry about the CPU temp anymore... they are really coooooooooooooll
Does anybody have an idea what the optimal temperature range for core duo cpu:s are? I used to have an Athlon XP, which was typically 65 °, now the my E6600 is running at 35-40 ° [celsius]. But where's the critical temperature where it burns?

EEM applet does not support extended ping ?

Hi does anybody know if EEM applet does not support any extended Ping in a cli action ?
This works:
action 1000 cli command "ping ip 10.161.255.5"
These statements does not work ?
action 1000 cli command "ping ip 10.161.255.5 repeat 10 source Loopback0"
action 1000 cli command "ping vrf TESTVRF ip 10.161.255.5 repeat 20 source Loopback0"
I found another possibility how to achive extended ping in EEM like following
event manager applet ping
event none sync yes
action 100 cli command "enable"
action 101 cli command "ping" pattern "[ip]"
action 102 cli command "ip" pattern "address"
action 103 cli command "10.161.255.5" pattern "count"
action 104 cli command "20" pattern "size"
action 105 cli command "100" pattern "seconds"
action 106 cli command "2" pattern "commands"
action 107 cli command "y" pattern "interface"
action 108 cli command "Loopback0" pattern "service"
action 109 cli command "0" pattern "header"
action 110 cli command "no" pattern "data"
action 111 cli command "no" pattern "pattern"
action 112 cli command "0xABCD" pattern "Verbose"
action 113 cli command " " pattern "size"
action 114 cli command "n" event manager applet ping
bu there is also no way to specify the VRF ?
Any Ideas ?
Thx
Hubert

Hi found failure,
extended ping needs to be executed in priviledged mode, so need to enable in advance , then it works
thx Bruno for the hint
Hubert

Is there a VI to monitor CPU and memory usage on wINDOWS 2000 system ?

I want to monitor CPU usage and available memory for Windows 2000 computer. Is there a VI that can call the task mngr. via a DLL to provide this information in real time ?

There was a nice example using .NET technology, but it seems the link has changed and I cannot find it anymore. See this older thread for some clues.
Does anyone know what happened to the target of the original link in my old post?
Edit: Found it here.Message Edited by altenbach on 04-29-2005 12:42 PM
LabVIEW Champion . Do more with less code and in less time .

Eem applet or script for sending email for syslog denies

I am wanting to have my isr's send an email when a certain number of deny's occur on an ace. So if i have a particular ace set up to log when tcp 3389 denied. Then the eem applet or script would track when that deny entry happens. When the deny hits on that entry reach three times, it will send an email alert. The thing i am wondering about is how to set a variable within an event syslog pattern statement. For instance, how do i say express a variable for the source ip/port in the below
config-applet)# event syslog pattern "SEC-6-IPACCESSLOGP: list 198 denied tcp 201.198.71.51(38531) -> 212.184.81.52(3389)" occurs 3
The source ip and port could rotate or change so i'd need to express that with some kind of variable. How could that be done?(or is there a better approach altogether).

I put the below script in and it takes fine but does not send email alert. Is there something more to do for configuring email sending?
event manager applet Intrusion-Tracking
event syslog pattern "SEC-6-IPACCESSLOGP:.*-> 208.195.174.115$3389$" occurs 3
action 1.0 mail server "173.16.7.2" to ".[email protected]" from ".eem@company1." subject ".intrusion_alert_from_c2900isr." body "Intrustion alert c2800isr"

How to monitor CPU usage and performance on a Hyper-V server with several VM's

I have a server that is running Windows 2008 64 bit Hyper-V, with 8 gigs of RAM and Intel Xeon X3440 @ 2.53 Ghz, which gives me 8 logical cores in the performance monitor on the host system.
I have set up three Virtual Machines, all running Windows 2008 32 bit.
Build server, running Team City
Staging server
SQL Server, running SQL Server 2005
I have some troubles with the setup in that the host monitor remains responsive at all times, even though the VM's are seemingly working at 100% cpu and are very sluggish and unresponsive. (I have asked a separate question about that.)
So the question here is: What is the best way to monitor how the physical CPU's are actually utilized? The reason I am asking is that I am being told that i cannot reliably use the task manager to monitor CPU usage in a VM.

First, you have to remember that in Hyper-V that the "host" is called a parent partition and it really just like a virtualized guest with special permissions and roles. Just like any other child/guest, when you open up Task Manager, you can not see the CPU
usage of the other children on the server.
Ben Armstrong has a good explanation of this here:http://blogs.msdn.com/virtual_pc_guy/archive/2008/02/28/hyper-v-virtual-machine-cpu-usage-and-task-manager.aspx
To summarize his post, you need to check three things to get an accurate picture of CPU utilization:
View the CPU usage on each guest - this is available through Hyper-V Manager or Performance Monitor.
CPU usage due to context switching - this is the perfmon counter called % Hypervisor Run Timeunder Hyper-V Hypervisor Virtual Processor
Child partition worker process - vmwp.exe running on the parent partition (1 per child). This handles Hyper-V operations like saving
state.

What is 'fseventsd' when monitoring cpu in the activity monitor?

what is 'fseventsd' when monitoring cpu in the activity monitor?

The .fseventsd is the file system events storage location.
Since it writes file system event log files and since applications such as Time Machine use it, I would not stop its process.
Here is some background info.
http://arstechnica.com/reviews/os/mac-os-x-10-5.ars/7

How do I monitor CPU Temp?

Is there a way to monitor CPU temp already built in the software or do I have to download a third party one?
If I have to download one what do you recommend?

Temperature monitor is free. They also sell a program called hardware monitor. That is what I use. I bought it a few years ago, and they keep on upgrading it for free.
Glor

EEM Applet - Interface bandwidth utilization

We are planning to get syslog or snmp alert for bandwidth utilization of Uplinks by EEM applet, can any bdy help me on that?
We managed to get alert for input traffic but we are not able to get alert for total bandwidth utilization ( input + output ).

This is possible with an EEM applet. I have done it on G1 ISRs with 15.1. The applet is here:
http://ephemeralportal.blogspot.jp/2014/01/eem-applet-teach-your-router-to-monitor_24.html
I usually run 12.4 on 3745s in GNS3 and they do not have the action set to do variable manipulation, so I am guessing that this is a newer feature, although I could not find what minimum version you would need on a quick search.

EEM applet to reload router after ip is unreachable over time

Hi
I am trying to create an EEM applet that will track the reachability of a group of IP addresses. The condition needs to be as followed:
If the IP addresses become unreachable for about an 1 hour 15 minutes then reload the router. I have looked at the delay command using the IP SLA option but it only delays up to 180 seconds. Any Ideas?

The applet that tracks your IP SLA objects (I'm guessing you have a tracked object that tracks a list of other objects) should configure another timer applet that counts down the time you want. For example:
event manager applet track-down event track 3 state down action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "event manager applet countdown" action 3.1 cli command "event timer countdown time 4500" action 3.2 cli command "action 1.0 reload" action 4.0 cli command "end"!event manager applet track-up event track 3 state up action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "no event manager applet countdown" action 4.0 cli command "end"

EEM applet for IPSLA

Hi,
I have a scenario where i would like to execute a EEM applet for running an ip sla event when othe ip sla event is up. Just to summarize an IP sla event success should trigger anothe IP sla event. I have tried the two options below but was not able to find any debug logs.
ip sla 10
icmp-jitter x.x.x.x source-ip x.x.x.x num-packets 10
frequency 30
ip sla schedule 10 life forever start-time now
ip sla 20
icmp-jitter x.x.x.x source-ip x.x.x.x num-packets 10
frequency 30
event manager applet SLA
event timer cron cron-entry "5 * * * *"
event ipsla operation-id 10 reaction-type timeout
action 10   if $_ipsla_condition eq "Occurred"
action 15    cli command "enable"
action 20    cli command "configure term"
action 25    cli command "no ip sla schedule 20 life forever start-time now"
action 30    else
action 35    cli command "enable"
action 40    cli command "configure term"
action 45    cli command "ip sla schedule 20 life forever start-time now"
action 50   end
OR
ip sla 10
icmp-jitter x.x.x.x source-ip x.x.x.x num-packets 10
frequency 30
ip sla schedule 10 life forever start-time now
ip sla 20
icmp-jitter y.y.y.y source-ip y.y.y.y num-packets 10
frequency 30
track 1 ip lsa reachability
event manager applet SLA-1
event timer cron cron-entry "5 * * * *"
event track 1 state up
action 10 cli command "enable"
action 20 cli command "conf t"
action 30 cli command "ip sla schedule 20 life forever start-time now"
action 40 cli command "end"
event manager applet SLA-2
event timer cron cron-entry "5 * * * *"
event track 1 state down
action 10 cli command "enable"
action 20 cli command '' conf t"
action 30 cli command "no ip sla schedule 20 life forever start-time now"
action 40 cli command "end"
Regards,
Sathvik K V

Hi Joseph,
I would like to run the script pasted below during buisness hours(9am to 6pm). When two if conditions are used is it the first condition is checked and if that passes it will check the second condition.
event manager applet APP-1
event track 1 state up
action 001 cli command "enable"
action 002 cli command "show clock"
action 003 regexp "([0-9]+):[0-9]:[0-9]" $_cli_result match hour
action 004 if $hour ge 9
action 005 cli command "conf t"
action 006 cli command "ip sla 2"
action 007 cli command "icmp-echo x.x.x.x source-ip x.x.x.x"
action 008 cli command "frequency 30"
action 009 cli command "ip sla schedule 2 life forever start-time now"
action 010 end
action 011 if $hour le 18
action 012 cli command "ip sla 2"
action 013 cli command "icmp-echo x.x.x.x source-ip x.x.x.x"
action 014 cli command "frequency 30"
action 015 cli command "ip sla schedule 2 life forever start-time now"
action 016 end
event manager applet APP-2
event track 1 state down
action 10 cli command "enable"
action 20 cli command "conf t"
action 30 cli command "no ip sla 2"
action 40 cli command "end"
Regards,
Sathvik

Need help in executing EEM applet only once

Do we have any sample script for EEM applet counter ? We want applet to execute once after reload after matching a string . We tried couple of solutions like “ server suspend “( customer does not like server suspend) and event counter ( this does not allow syslog string matching ). Please let me know if there are any options.
At the router reload, match the string , bring down the interface and run this applet only once . I have been trying multiple messages in Bootup log for this for bringing the interface down.
The issue we are facing is that most of the bootup log messages can be triggered when the router is up as well which will result in triggering of the applet which is what we want to avoid.
event manager applet Interface_down
event syslog pattern "SPA removed from subslot 0/0"
trigger delay 10
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface gi0/0/0"
action 2.5 cli command "shutdown"
action 3.0 cli command "end"
event manager applet Interface_up
event syslog pattern "Bulk Sync succeeded"
trigger delay 100
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface gi0/0/0"
action 2.5 cli command "no shutdown"
action 3.0 cli command "end"
end

This is a bit dirty but you can create an applet to run at startup that creates the event detection applet. Then at the end of the detection applet, have it remove itself from the running config. This means that the applet running at startup will always create the event detection applet but the event detection applet will only ever run once for that router boot period as it deletes itself after first run.
The problem is that when you want to have one applet create another applet, you have issues with the inverted commas being correctly configured for the second applet which will cause it to run once, but fail after that. The way you can get around this is to write the applet to a text file on the flash and then copy the contents of the text file to the running config at boot. This preserves the structure of the applet being created and ensures that it will function correctly.
The following example builds the event detection applet at system restart (BUILDAPPLET) by copying the file "eventapplet.txt" to running config. The event detection applet (EVENTDETECT) detects a syslog pattern, in this case exiting global config, and runs the applet sending a puts command and outputting HELLO. The event detection applet then removes itself from the running config.
!# configure the router
conf t
!# turn off file prompting to let the BUILDAPPLET run when copying
file prompt quiet
!# create the applet that runs at system restart and copies the flash applet to the running config
event manager applet BUILDAPPLET
event syslog pattern "%SYS-5-RESTART"
action 10 cli command "en"
action 11 cli command "copy flash:eventapplet.txt running-config"
!# exit
end
!######## Create the flash file containing your run once applet ########
! enter the tclsh so we can write our applet to a file - put your event detection applet in here between the {} that you want to run once
tclsh
puts [open "flash:eventapplet.txt" w+] {
event manager applet EVENTDETECT
event syslog pattern "%SYS-5-CONFIG_I"
action 1.0 puts "HELLO"
action 2.0 cli command "en"
action 3.0 cli command "conf t"
action 4.0 cli command "no event manager applet EVENTDETECT"

EEM Applet to Monitor CPU

Similar Messages

Maybe you are looking for