EEM issue

Dear,
I am trying to configure an EEM applet in order to shut an interface when an ip sla failed. On this router we use AAA so i have configured an aaa list to bypass authorization .
aaa authentication login EEM none
aaa authorization config-commands
aaa authorization exec default if-authenticated
aaa authorization exec EEM none
aaa authorization commands 0 EEM none
aaa authorization commands 1 EEM none
aaa authorization commands 15 EEM none
And i use a dedicated line to execute this applet :
line vty 0
authorization commands 1 EEM
authorization commands 15 EEM
authorization exec EEM
login authentication EEM
transport input none
My applet configuration is :
event manager applet SHUTDOWN_LO1
event track 10 state down
action 1.0 syslog msg "Timeout to reach 10.100.1.1"
action 1.1 cli command "enable"
action 1.2 cli command "configure terminal"
action 1.3 cli command "interface loopback1"
action 1.4 cli command "shutdown"
My issue is when this applet is executed, it block on the "configure terminal" action :
Jul 26 11:50:33.198: fh_server: fh_io_msg: received msg FH_MSG_EVENT_REQINFO from client 36 pclient 1
Jul 26 11:50:33.198: %HA_EM-6-LOG: SHUTDOWN_LO1: Timeout to reach 10.100.1.1
Jul 26 11:50:33.198: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : CTL : cli_open called.
Jul 26 11:50:33.242: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :
Jul 26 11:50:33.242: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : ROUTER>
Jul 26 11:50:33.242: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : IN :ROUTER>enable
Jul 26 11:50:33.246: cli_history_entry_add: free_hist_list size=0, hist_list size=7
Jul 26 11:50:33.246: eem_no_scan flag set, skipping scan of command_string=check_eem_cli_policy_handler
Jul 26 11:50:33.254: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :
Jul 26 11:50:33.254: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :ROUTER#
Jul 26 11:50:33.254: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : IN : ROUTER#configure terminal
Jul 26 11:50:33.258: cli_history_entry_add: free_hist_list size=0, hist_list size=7
And then i saw that the line vty 0 is used but stuck in idel state
ROUTER#systat
    Line       User       Host(s)              Idle       Location
194 vty 0                idle                 00:00:46
And on the next execution , i saw that the router try to execute next steps on the previous call for this applet
Jul 26 11:55:18.170: %HA_EM-6-LOG: SHUTDOWN_LO1: Timeout to reach 88.191.97.16
Jul 26 11:55:18.170: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : CTL : cli_open called.
Jul 26 11:55:18.254: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :
Jul 26 11:55:18.254: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : ROUTER>
Jul 26 11:55:18.254: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : IN : ROUTER>enable
Jul 26 11:55:18.254: cli_history_entry_add: free_hist_list size=0, hist_list size=7
Jul 26 11:55:18.254: eem_no_scan flag set, skipping scan of command_string=check_eem_cli_policy_handler
Jul 26 11:55:18.266: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :
Jul 26 11:55:18.266: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : ROUTER#
Jul 26 11:55:18.266: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : IN : ROUTER#configure terminal
Jul 26 11:55:18.482: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : Command authorization failed.
Jul 26 11:55:18.482: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :                       ^
Jul 26 11:55:18.482: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Jul 26 11:55:18.482: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :
Jul 26 11:55:18.482: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : ROUTER#
Jul 26 11:55:18.482: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : IN : ROUTER#interface loopback1
Jul 26 11:55:18.498: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :                        ^
Jul 26 11:55:18.498: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Jul 26 11:55:18.498: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :
Jul 26 11:55:18.498: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : ROUTER#
Jul 26 11:55:18.498: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : IN : ROUTER#shutdown
Jul 26 11:55:18.814: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : Command authorization failed.
Jul 26 11:55:18.814: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :                         ^
Jul 26 11:55:18.814: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Jul 26 11:55:18.814: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT :
Jul 26 11:55:18.814: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : OUT : ROUTER#
Jul 26 11:55:18.814: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : IN : ROUTER#exit
Jul 26 11:55:18.814: %HA_EM-6-LOG: SHUTDOWN_LO1 : DEBUG(cli_lib) : : CTL : cli_close called.
Thanks for any help.

Hi Joseph,
The device in question is a Cisco router 1841 with
c1841-adventerprisek9-mz.124-9.T1.bin IOS firmware.
Regarding EEM version, i think the current version is a 2.2 because i can track an event but i have only an action of cli type and not pattern.
The actual prompt for this device is enable mode.
ROUTER#
Thanks

Similar Messages

EEM syslog issue

I have an issue with the syslog output of my eem script. The syslog command below does work. It sends an individual syslog message to my mgmt station for EACH line of cli output. I confirmed this with wireshark. The "show log" output looks fine (see below). I would like to get all the cli output or at least most of it in ONE large syslog message Anyone know how to fix this?
<script>
event manager applet SH_IP_NAT_STATS
event timer cron name nat_stats cron-entry "0-59/5 * * * *"
action 1.1 cli command "sh ip nat statistics"
action 1.2 syslog msg "cli: $_cli_result"
Log Buffer (52000 bytes):
000080: *Nov 15 04:30:00.052: %HA_EM-6-LOG: SH_IP_NAT_STATS: cli:
Total active translations: 38 (1 static, 37 dynamic; 38 extended)
Peak translations: 135, occurred 00:25:23 ago
Outside interfaces:
FastEthernet0/0, FastEthernet0/1
Inside interfaces:
Vlan10
Hits: 6270 Misses: 0
CEF Translated packets: 1078, CEF Punted packets: 5192
Expired translations: 622
Dynamic mappings:
-- Inside Source
[Id: 1] route-map nonat interface FastEthernet0/1 refcount 37
Appl doors: 5
Normal doors: 0
Queued Packets: 0

Ah, I misunderstood. There are a number of ways you could do this. One thing that might be easiest is to configure two applets:
event manager applet MARVEL
event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 1.0 cli command "enable"
action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"
action 3.0 cli command "clear mac-address-table secure"
action 4.0 cli command "config t"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event none"
action 7.0 cli command "exit"
action 8.0 cli command "event manager applet MARVEL-countdown"
action 9.0 cli command "event timer countdown time 3600"
action 9.1 cli command "end"
event manager applet MARVEL-countdown
event none
action 1.0 cli command "enable"
action 2.0 cli command "config t"
action 3.0 cli command "event manager applet MARVEL-countdown"
action 4.0 cli command "event none"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event syslog pattern %MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 7.0 cli command "end"

EEM absolute timer issue

Hi all,
I've seen an issue with the timer policy between EEM versions. The absolute timer "time" field is supposed to be the number of seconds since January 1 1970. This is the behaviour i am seeing on EEM 4.0.
I have 2 older devices, a 3600 and a 1700 that i am testing with and I am seeing different behaviour.
When i view the configured policy it shows the date as being 26 Jan 1970 whereas the same policy on the device with EEM 4.0 shows the date as being today.
Was there a version of EEM where the meaning of the time field was changed, e.g. went from milliseconds since epoch to seconds since epoch or could there have been a bug with earlier EEM versions?
On
C1700 Software (C1700-ENTSERVICESK9-M), Version 12.4(15)T, RELEASE SOFTWARE (fc3)
::cisco::eem::event_register_timer absolute time 1355148240 name timerets maxrun 0
Gives a date of
Mon Jan 26 1970 20:25:41.760
On
Version 15.2(2r)T, RELEASE SOFTWARE (fc1)
::cisco::eem::event_register_timer absolute time 1355147040 name timertest maxrun 0
Gives a date of
Mon Dec 10 2012 13:44:00.000
This document is what i follow for the correct use of variables:
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_eem_policy_tcl.pdf
Cheers,
Joe.

I know of no one else using this timer, so it's very likely that you have found a bug. I couldn't locate one that describes this, though. From what I've seen, it doesn't appear to me milliseconds exactly. When I take 1355148.240 ms, I get
Fri Jan 16 11:25:48 1970. I see a lot of code changes in this area, so it wouldn't surprise me if this bug was squashed anonymously.

Issue 'show hsrp detail' every 5 minutes using EEM

Hello,
Please confirm EEM is a feasible way to accomplish this and confirm I can trigger it every few minutes.
1. Issue a "show hsrp detail" under the respective interfaces.
2. In the output of the "show hsrp detail", if I find "Standby router is unknown", trigger an email to the [email protected]
event manager applet monitorhsrp
event timer watchdog time 300 maxrun 9999999

Yes, in Cisco IOS 'watchdog' works.
In NX-OS, that would be the 'scheduler' feature.

EEM TCL script configuration issue

Hi Experts,
I need help with an EEM TCL script for the CRS platform that generates a SYSLOG message after the CPU reaches a threshold value and then stays over the threshold value for 15 minutes, I've already tryied several thing and the last TCL script that I tested generated the SYSLOG message when the CPU reaches the threshold but I can't seem to find any way to make it wait the 15 min over the threshold and then generate the message.
My current script looks like this:
::cisco::eem::event_register_wdsysmon timewin 900 sub1 cpu_tot op ge val 70
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
array set event_details [event_reqinfo]
action_syslog msg "sub1 is $event_details(sub1)"
action_syslog msg "High CPU threshold value over 70%"
puts ok
I've tryied using the 'period' option for the 'cpu_tot' variable but the TCL script was'nt recognized and couldn't be registered, and I'm using the 'timewin' option here but it seems to be wrong as it says it's the time it has for multiple sub-events to ocurr in order for the script to execute.
timewin
(Optional) Time window within which all of the subevents have to occur in order for an event to be generated and is specified in SSSSSSSSSS[.MMM] format. SSSSSSSSSS format must be an integer representing seconds between 0 and 4294967295 inclusive. MMM format must be an integer representing milliseconds between 0 and 999).
Also, the 'period' option I believe wouldn't have worked because I understand that it referrs to the time period that the script will take to monitor the CPU:
•1. cpu_tot [op gt|ge|eq|ne|lt|le] [val ?] [period ?]
op
(Optional) Comparison operator that is used to compare the collected total system CPU usage sample percentage with the specified percentage value. If true, an event is raised.
val
(Optional) Percentage value in which the average CPU usage during the sample period is compared.
period
(Optional) Time period for averaging the collection of samples and is specified in SSSSSSSSSS[.MMM] format. SSSSSSSSSS format must be an integer representing seconds between 0 and 4294967295, inclusive. MMM format must be an integer representing milliseconds between 0 and 999. If this argument is not specified, the most recent sample is used.
As I said, I couldn't try this because the script send an error when I tried to register using the following line:
::cisco::eem::event_register_wdsysmon sub1 cpu_tot op ge val 70 period 900
This is the error message that appeared:
RP/0/RP0/CPU0:CRS(config)#event manager policy test.tcl username cisco
RP/0/RP0/CPU0:CRS(config)#commit
Thu Aug 29 12:35:43.569 CDT
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
RP/0/RP0/CPU0:CRS(config)#sh conf fail
Thu Aug 29 12:35:52.427 CDT
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
event manager policy test.tcl username cisco persist-time 3600
!!% Embedded Event Manager configuration: failed to retrieve intermediate registration result for policy test.tcl
end
Anyway, to make this work I understand that I need nested TCL scripts that do the following:
•1. Monitor the CPU and when it reaches the threshold install another TCL policy that counts down 15 min.
•2. If the second TCL policy reaches zero then it should generate the SYSLOG message.
•3. Monitor the CPU while this is running and if it falls below the threshold it should stop the second TCL policy.
I don't know how I can acomplish this so if anyone can help me with this or show me another way to do this I would really appreciate it.
Thanks in advance for all your help!

Neither option is likely to do what you want. The timewin is for correlating multiple events, and period is the polling interval. What you want is to create a timer when the CPU is first detected as being high, countdown 15 minutes, then alert you. You can do this with a nested EEM policy. For example, you can add the following to your existing policy:
proc get_pol_dir { fd } {
    set res {}
    set output [cli_exec $fd "show event manager directory user policy"]
    set output [string trim $output]
    regsub -all "\r\n" $output "\n" result
    set lines [split $result "\n"]
    foreach line $lines {
        if { $line == "" } {
            continue
        if { ! [regexp {\s} $line] && ! [regexp {#$} $line] } {
            set res $line
            break
    if { $res == {} } {
        return -code error "The user policy directory has not been configured"
    return $res
if { [catch {cli_open} result] } {
    error $result $errorInfo
array set cli $result
set output [cli_exec $cli(fd) "show event manager policy registered | inc tm_alert_high_cpu.tcl"]
if { [regexp {tm_alert_high_cpu.tcl} $output] } {
    exit 0
set poldir [get_pol_dir $cli(fd)]
set polname "${poldir}/tm_alert_high_cpu.tcl"
set fd [open $polname "w"]
puts $fd "::cisco::eem::event_register_timer countdown time 900"
puts $fd "namespace import ::cisco::eem::*"
puts $fd "namespace import ::cisco::lib::*"
puts $fd "action_syslog msg \"CPU has been over 70% for 15 minutes\""
close $fd
cli_exec $cli(fd) "config t"
cli_exec $cli(fd) "event manager policy tm_lert_high_cpu.tcl username eem"
cli_exec $cli(fd) "commit"
cli_exec $cli(fd) "end"
catch {cli_close $cli(fd) $cli(tty_id)}
Additionally, you'll want another permanently configured policy that checks for a low CPU threshold. Something like:
::cisco::eem::event_register_wdsysmon sub1 cpu_tot op le val 10
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
if { [catch {cli_open} result] } {
    error $result $errorInfo
array set cli $result
cli_exec $cli(fd) "config t"
cli_exec $cli(fd) "no event manager policy tm_alert_high_cpu.tcl"
cli_exec $cli(fd) "commit"
cli_exec $cli(fd) "end"
catch {cli_close $cli(fd) $cli(tty_id)}

EEM event_register_interface detector issue

hi,
Im working on a EEM policy for some of my routers using TCL, this policy checks for the txload value of an interface and reports the value with a syslog message, this policy is already in the eem scriptiong community so as least im sure that im in the right direction.
This is my policy right now for testing, as you can see its pretty simple:
::cisco::eem::event_register_interface name serial1/0 parameter txload poll_interval 5 entry_op ge entry_val 192 entry_val_is_increment FALSE entry_type value
action_syslog msg "event triggered"
However it doesn't works, i have tried this code on 2811 and 7200 routerswith 12.4 ios image and i cant get it working, i have been using other kind of detectors (counters, timers, cli, etc) and they are working fine.
thanks all for your replies.

Thanks joseph for your reply,
I applied the policy as you said, however it didn't work, I tested the policy on a 2801 router in a lab enviroment. I have included some output from the router. I have implemented another policy with a timer detector as a workaround, meanwhile I get some other IOS image for testing and production enviroment.
R1#sh event manager policy registered
No. Class Type Event Type Trap Time Registered Name
1 script user interface Off Sun Apr 17 11:54:26 2011 ifreporter.tcl
name {serial0/2/0} parameter {txload} entry_op ge entry_val 192 entry_val_is_increment FALSE poll_interval 70.000
nice 0 queue-priority normal maxrun 20.000
R1#sh ver
Cisco IOS Software, 2801 Software (C2801-ADVIPSERVICESK9-M), Version 12.4(19), RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Fri 29-Feb-08 20:54 by prod_rel_team
ROM: System Bootstrap, Version 12.3(8r)T9, RELEASE SOFTWARE (fc1)
R1 uptime is 48 minutes
System returned to ROM by reload at 11:48:07 cst Sun Apr 17 2011
System image file is "flash:c2801-advipservicesk9-mz.124-19.bin"

EEM configuration issue?

I'm using this EEM script to shut down a port when a cable is pulled or port goes down for any other reason. It works to shut down the port but I'm facing the following problem
1. If I attempt to re-enable the port manually it immedeately shuts it down using the EEM unless I remove the event manager configuration, re-enable the port and re-apply EEM config.
2. I have a "wait 120"configured but it never re-enable the port after 120 seconds
Any help would be greatly appreciated.
event manager applet interface_down
event syslog pattern ".*UPDOWN.*FastEthernet0/4.* changed state to down"
action 1.0 syslog msg "Interface FastEthernet0/4 has gone down"
action 1.1 cli command "enable"
action 1.2 cli command "conf t"
action 1.3 cli command "Interface FastEthernet0/4"
action 1.4 cli command "shut"
action 1.5 cli command "end"
action 1.6 syslog msg "Interface FastEthernet0/4, changed state to administratively down"
action 1.7 wait 120
action 2.1 cli command "enable"
action 2.2 cli command "conf t"
action 2.3 cli command "Interface FastEthernet0/4"
action 2.4 cli command "no shut"
action 2.5 cli command "end"

Joseph, based on your script and only adding to action 1.8 (1 minute timer), I was able to get the following working on a router:
event manager environment q "
event manager applet interface_down
event syslog pattern ".*UPDOWN.*FastEthernet0/0.* changed state to down"
action 1.0 syslog msg "Interface FastEthernet0/0 has gone down"
action 1.1 cli command "enable"
action 1.2 cli command "conf t"
action 1.3 cli command "Interface FastEthernet0/0"
action 1.4 cli command "shut"
action 1.6 syslog msg "Interface FastEthernet0/0, changed state to administratively down"
action 1.7 cli command "event manager applet interface_up"
action 1.8 cli command "event timer watchdog time 60"
action 1.9 cli command "action 1.0 cli command enable"
action 2.0 cli command "action 2.0 cli command $q config t$q"
action 2.1 cli command "action 3.0 cli command $q interface FastEthernet0/0$q"
action 2.2 cli command "action 4.0 cli command $q no shut$q"
action 2.3 cli command "action 5.0 cli command $q no event manager applet interface_up$q"
action 2.4 cli command "end"
R3(config-if)#int fa0/0
R3(config-if)#shut
R3(config-if)#
*Mar 1 01:50:43.187: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Mar 1 01:50:44.187: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down
*Mar 1 01:50:44.215: %HA_EM-6-LOG: interface_down: Interface FastEthernet0/0 has gone down
*Mar 1 01:50:44.467: %HA_EM-6-LOG: interface_down: Interface FastEthernet0/0, changed state to administratively down
R3(config-if)#
*Mar 1 01:50:44.887: %SYS-5-CONFIG_I: Configured from console by on vty0 (EEM:interface_down)
R3(config-if)#
*Mar 1 01:51:45.327: %SYS-5-CONFIG_I: Configured from console by vty0
R3(config-if)#
*Mar 1 01:51:47.103: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Mar 1 01:51:48.103: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R3(config-if)#do sh ip int bri
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES unset up                    up
FastEthernet0/1            unassigned      YES unset administratively down down
R3(config-if)#
If you notice the timestamps, 1 minute went by between the time the port went admin down and the time the 2nd part of the script started.
Also, if I try to re-enable the interface before the timer expires, it comes up with no problem.
I will get my hands on a 3560 later today and test there as well.
Thanks!
Nick

Frequent issues with supplied SSD in 17" 2011 MBP

Hi all,
Perhaps someone can help?
I've recently (in the last couple of months) been having problems with the SSD in my early-2011 17" MBP. The model of the SSD (from System Profiler) is APPLE SSD TS256C.
The problems eems to occur after emptying the Trash when it has files of large sizes in it (video files of 1 or more GB typically). I empty the Trash, and the available space showing for the drive gets bigger,a s expected, but then when I try to make use of the drive (for example by copying files from another drive to it) I am told there isn't enough free space (when there clearly ought to be).
Example from earlier today:
I had 60GB available.
I put around 30 GB of stuff in the Trash and emptied it.
Available space now shows 90GB free.
I try to copy 75GB from an external drive onto the SSD, but am told there isn't enough free space.
In a attempt to fix the problem, I did what I have done on the 3 previous occassions: Restart the computer, hold down Cmd+R and run Disk Utility from there. Here I can repair the SSD (as it has the OS on).
This is what Disk Utility showed me:
Verifying volume “Hard Drive”
Checking file systemPerforming live verification.
Checking Journaled HFS Plus volume.
Checking extents overflow file.
Checking catalog file.
Incorrect block count for file Hospital Records - 100k YouTube Subscribers.mov
(It should be 11029 instead of 144729)
Incorrect block count for file Netsky Live - Backstage at the Electric Brixton.mov
(It should be 12062 instead of 606074)
Incorrect block count for file Netsky Live - Lotto Arena 2013 Promo.mov
(It should be 7177 instead of 135443)
Checking multi-linked files.
Checking catalog hierarchy.
Checking extended attributes file.
Checking volume bitmap.
Volume bitmap needs minor repair for orphaned blocks
Checking volume information.
Invalid volume free block count
(It should be 11712443 instead of 10811938)
The volume Hard Drive was found corrupt and needs to be repaired.
Error: This disk needs to be repaired using the Recovery HD. Restart your computer, holding down the Command key and the R key until you see the Apple logo. When the OS X Utilities window appears, choose Disk Utility.
I ran it a couple of times (as on previous occasions) until no errors were reported.
On previous occassions, upon restarting, things went back to normal, but this time I am still being told there is not enough free space, though Get Info shows 121GB available.
So I have some questions:
What is going on?
Why does this keep happening?
What can I do to solve my current issue?
What can I do to stop this from happeneing again?
Many thanks in advance...

I'd totally forgotten about this until I got a notification that you had replied.
I no longer have this problem.vaguely remember calling up Crucial (who make my second SSD) and they said something about leaving the machine on, but not doing anything on it for 24 hours or something. So it has to stay switched on, not go to sleep (dim your screen though) and don't touch your keyboard or mouse for a full 24 hours... maybe it was a bit longer... maybe it had to be at the login screen (can't remember)... and in this time it will run some automatic repair thing.
It was so long ago I really can't remember the spcifics - but have a hunt around for things to that effect. Or call Apple/Crucial and mention what I've just said, see if it makes any sense to them and get them to advise the exact corect procedure.

Help with EEM TCL / CLI scripting for re-direction/wccp counters

Being new with EEM scripting I wanted to see if I was on the right track and get some help to finish my idea.
Our problem I am trying to fix is our remote sites utilize pairs of Cat3650's for some routing and WCCP redirection. We are encountering ACL denial issues causing slow down and access issues. The fix for the issue we remove the WCCP service groups to break peering with our wan optimizers and re-insert the configuration thus re-establishing peering and restoring service.
My idea is to use a TCL scipt on a watchdog timer to parse the "sh ip wccp | inc denied (or unassign)" output for denial and unassignable error counters. If a counter is found I wanted to create a syslog message that would then kick off a simple EEM CLI script to remove the service groups, wait 10 seconds, then re-add the service groups. Please point me in the right direction if I am off track as I am not sure if I can use the EEM CLI for all this or since I want to retreive specific info from the sh ip wccp output if I do need to utilize TCL. I am also unsure if the "total denied" ascii string pulled via the "sh ip wccp | inc denied" will cause issues when attempting to just pull the counter information.
sh ip wccp | inc Denied Red
Total Packets Denied Redirect: 0
Total Packets Denied Redirect: 0
Script thus far :
TCL
if [catch {context_retrieve "EEM_WCCP_ERROR_COUNTER" "count"} result] {
set wccpcounter 0
} else {
set wccpcounter $result
} if [catch {cli_open} result] {
error $result
} else {
array set cli $result
} if [catch {cli_exec $cli(fd) "show ip wccp | incl Denied"} result] {
error $result
} else {
set cmd_output $result
set count ""
catch [regexp {receive ([0-9]+),} $cmd_output} ignore count]
set count
set diff [expr $count - $wccpcounter]
if {$diff != 0} {
action_syslog priority emergencies msg "WCCP counters showing incremental Denied packet counts"
if [catch {cli_close $cli(fd) $cli(tty_id)} result] {
error $result
context_save EEM_WCCP_ERROR_COUNTER count
CLI
event manager applet WCCP_COUNTER_WATCH
event syslog priority emergencies pattern "WCCP counters showing incremental Denied packet counts"
action 001 cli command "enable"
action 002 cli command "config t"
action 003 cli command "no ip wccp 61"
action 004 cli command "no ip wccp 62"
action 005 wait 10
action 006 cli command "ip wccp 61"
action 007 cli command "ip wccp 62"
action 008 wait 15
action 009 cli command "clear ip wccp"
action 010 cli command "end"
Thanks for all the help

This won't work as EEM cannot intercept its own syslog messages. However, I'm not sure why you need this form of IPC anyway. Why not just make the Tcl script perform the needed CLI commands?
And, yes, you could use all applets here. But since you've written the hard stuff in Tcl already, it might be best just to add the missing calls to reconfigure WCCP to that script.

Can I use EEM to upload long scripts and run them?`

I asked this question here, on ServerFault, and they guided me to here.
The issue is basic. If I need to run hundreds of al/ag/ng/no commands on a Cisco ASA programmatically, I need to do it via a SSH shell, with the restriction that the ASA will not take a command size greater than 1024 bytes. I take my batch, and find the number of whole lines, as long as they are under 1,000 characters, and send commands like this-effectively "chunking" the batch into smaller pieces. This takes forever.
I am not talking about a replacement config, frequently run commands, or rebooting the AS in any way. I am just talking about making 'hot' modifications remotely via computer program.
I don't know if EEM is the way, but if it can do the following (exactly, or functionally), it is of great interest:
1. A remote client creates a batch file-nothing more than a sequence of commands for the CLI.
2. That batch file makes it's way to the ASA (any number of ways).
3. The commands in the batch are run, in order, as if typed in on the command line.
4. I imagine some sort of feedback would be nice, or even a signal that it is done, etc.
What are your thoughts?
Thank you!
P.S. I am not debating whether it is a good idea or not (unless you have a better way). I am merely asking how it can be done, and if EEM isn't the key, than what else might be?

The ASA doesn't really support EEM. Yes, there is a now a feature called EEM in 9.2, but it is quite limited compared to IOS. In IOS, what you want would be possible, but on the ASA, you'll need to do all of your CLI commands off box using something like Expect. I'm not sure how you're automating this now, but perhaps you are already using Expect. That would be what I'd likely do in this situation.

EEM / IP SLA to shutdown lossy high RTT BGP neighbor

Hi,
I'm relatively new to the IP SLA procedure and very new to EEM. I'm searching for the most efficient way to monitor the availability (packet loss and latency) of a BGP neighbor from a router to actively shutdown the neighbor relationship in order to failover to a back up L2L VPN I have configured on an ASA. It's important that I'm able to continue monitoring the BGP neighbor so that when the neighbor becomes stable again, I can reenable the BGP neighbor relationship. I've put something quick together (below) but am not sure if it will do what I want. I'd appreciate any suggestions and feedback.
Thank you!
-Mike
ip sla 90
icmp-echo <neighbor_ip> source-ip <source_ip>
threshold 250
timeout 500
frequency 3
ip sla schedule 90 life forever start-time now
ip sla enable reaction-alerts
track 90 ip sla 90 reachability
delay down 3 up 180
event manager applet BGP_NEIGHBOR_DIRTY
description SHUT DOWN BGP NEIGHBOR IF RTT OVER 250 FOR 3 SECONDS
event syslog pattern "90 ip sla 90 reachability Up->Down"
action 1.0 cli command "enable"
action 1.1 cli command "configure term"
action 1.2 cli command "router bgp 63320"
action 1.3 cli command "neighbor <neighbor_ip> shutdown"
action 1.4 cli command "end"
event manager applet BGP_NEIGHBOR_CLEAN
description ENABLE BGP NEIGHBOR IF RTT UNDER 250 FOR 3 MINUTES
event syslog pattern "90 ip sla 90 reachability Down->Up"
action 1.0 cli command "enable"
action 1.1 cli command "configure term"
action 1.2 cli command "router bgp 63320"
action 1.3 cli command "no neighbor <neighbor_ip> shutdown"
action 1.4 cli command "end"

By chosing a target that is along your desired path, you can certainly have a more robust script. I would use loopback to loopback communication as well, this will force the traffic through the router, and also find any potential issues where the peer is alive and sending bgp but not actually passing traffic. You will definitely need some "fudge" factors in there to deal with routers have to process the ICMP packets (Any CoPP will really really skew the results you are getting). I have had experiences where testing to/from a Nexus device gives wildly different results vs testing through the boxes.
HTH

Can't create SNMP Event in EEM 3.10

Hello,
We have upgraded one of our routers from version 12.4 to 15.0, Since the upgrade we can't seem to use SNMP event on the Embedded Event Manger applet.
We are using Cisco 2800 Software (C2800NM-ADVSECURITYK9-M), Version 15.0(1)M2
Embedded Event Manager Version 3.10
Component Versions:
eem: (v310_throttle)4.1.18
eem-gold: (v310_throttle)1.0.7
eem-call-home: (v310_throttle)1.0.6
Router(config)#event manager applet Router_Temp_Alert
Router(config-applet)#event ?
application Application specific event
cli          CLI event
config       Configuration policy event
counter      Counter event
env          Environmental event
interface    Interface event
ioswdsysmon IOS WDSysMon event
ipsla        IPSLA Event
nf           NF Event
none         Manually run policy event
oir          OIR event
resource     Resource event
rf           Redundancy Facility event
routing      Routing event
rpc          Remote Procedure Call event
syslog       Syslog event
tag          event tag identifier
timer        Timer event
track        Tracking object event
Did anyone encountered a similar issue ?
Thank you,
Valentine

I have a client that is getting the same error message when trying to add a new calendar entry at icloud.com.

Nexus 7010 NOX-OS 6.2 eem save running to slot0

Hi guys - hope someone can support me!
I have several N7k all runnings 6.2.10 and I just waint to save a copy of the running configuration to slot0 ( on mode CF in module 5 and 6 )
Because it is not possible to overwrite the file, I have to first delete the file and then save it again.
I have configured a small eem applet , which is working very well:
sh run eem
version 6.2(10)
logging level evms 5
event manager applet COPY-CONFIG-2-SLOT0
event syslog pattern "%SYSMGR-5-CFGWRITE_DONE:"
action 0.5 cli enable
action 1.0 cli delete slot0://module-5/N7k.cfg no-prom
action 1.5 cli delete slot0://module-6/N7k.cfg no-prom
action 2.0 cli copy running slot0://module-5/N7k.cfg
action 2.5 cli copy running slot0://module-6/N7k.cfg
action 4.0 syslog priority informational msg CONFIG_SAVED_SLOT0: DONE
on a other N7k, I have configured some VDCs, and the same script is running at the default VDC , but not at the VDC2!
so this applet in the default vdc is working
!Command: show running-config eem
!Time: Wed Nov 19 20:11:07 2014
version 6.2(10)
logging level evms 5
event manager applet COPY-CONFIG-2-SLOT0
event syslog pattern "%SYSMGR-5-CFGWRITE_DONE:"
action 0.5 cli enable
action 1.0 cli delete slot0://module-5/N7k-1-vdc.cfg-vdcall.cfg no-prom
action 1.1 cli delete slot0://module-5/N7k-1-vdc.cfg.cfg no-prom
action 1.5 cli delete slot0://module-6/N7k-1-vdc.cfg-vdcall.cfg no-prom
action 1.6 cli delete slot0://module-6/N7k-1-vdc.cfg.cfg no-prom
action 2.0 cli copy running slot0://module-5/N7k-1-vdc.cfg-vdcall.cfg vdc-all
action 2.5 cli copy running slot0://module-6/N7k-1-vdc.cfg-vdcall.cfg vdc-all
action 3.0 cli copy running slot0://module-5/N7k-1-vdc.cfg.cfg
action 3.5 cli copy running slot0://module-6/N7k-1-vdc.cfg.cfg
action 4.0 syslog priority warnings msg CONFIG_SAVED_SLOT0: DONE
and this one on the second vdc is not working
!Command: show running-config eem
!Time: Wed Nov 19 20:12:46 2014
version 6.2(10)
logging level evms 5
event manager applet COPY-CONFIG-2-SLOT0
event syslog pattern "%SYSMGR-5-CFGWRITE_DONE:"
action 0.5 cli enable
action 1.1 cli delete slot0://module-5/N7k-1-2vdc.cfg.cfg no-prom
action 1.2 cli copy running slot0://module-5/N7k-1-2vdc.cfg.cfg
action 1.6 cli delete slot0://module-6/N7k-1-2vdc.cfg.cfg no-prom
action 3.5 cli copy running slot0://module-6/N7k-1-2vdc.cfg.cfg
action 4.0 syslog priority warnings msg CONFIG_SAVED_SLOT0: DONE
I have read something about AAA and authorization as an issue, but I have deconfigured the AAA, and it is still not saving the file to slot0.
it possible to debug the eem on the N7k?

did you upgrade CMP, because could be that with the new upgrade to nx-os not responde the CMP.
if you want you check verify that documentation in that link.
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/hw/nexus7000/cmp/configuration/guide/n7cmp/n7cmp_configuring.html

Is it possible to call a tclsh script from EEM?

I thought it would be best to create another discussion for this topic, as this seems to be a separate request altogether.
If I have a TcL Script on a scp server, can I call it from within EEM?
Something along the lines of this, although it's not working...
if { [catch {cli_open} result] } {
exit 1
array set cli $result
cli_exec $cli(fd) "enable"
cli_exec $cli(fd) "tclsh scp://username:[email protected]/script.tcl"
catch {cli_close $cli(fd) $cli(tty_id)}

Found a dirty workaround. I'm still very interested in a better solution. I think the issue is having "exec" used in the tcl file I'm calling.
alias exec TcL tclsh
if { [catch {cli_open} result] } {
exit 1
array set cli $result
cli_exec $cli(fd) "enable"
cli_exec $cli(fd) "TcL scp://username:[email protected]/script.tcl"
catch {cli_close $cli(fd) $cli(tty_id)}

EEM Script to use in an triple play network

Hi,
I have a customer which have a tripe play network. I attach the following drawing so you can have a better idea how the network looks like.
IPTV, Internet and IP telephony is getting in in our customer network at both PE some you can see in the drawing.
Basicaly our customer deliver the network infrastructure while ISP1, ISP2 and ISP3 deliver the content (IPTV, Internet and IP telephony).
The two PEs which are getting the content in the network from the 3 ISPs are running the following hardware and IOS:
cisco CISCO7606 with WS-SUP720 MSFC3 Daughterboard Rev. 3.2.
IOS version: c7600s72033-advipservicesk9-mz.122-33.SRC5.bin
BGP is used between the PEs and the ISPs router.
The PEs are redundant for each other.
Our issue is when one of the ISP is having some maintenance on their routers one the PEs goes really high on CPU until reaching 100%.
I don't know why that is happening that is why I want to use EEM to dig deeper into it.
So What I want to do is an EEM script that could do the following:
1) The script should be triggered when CPU Threshold is reached (lets say 85 %).
3) Run a show tech and save the output in flash.
2) Then the script should run do the following commando and save the outputs to flash:
        - sh ip bgp vpnv4 vrf VRF10102 neighbors
        - sh bgp vpnv4 unicast vrf VRF10102 summary
        - sh ip bgp vpnv4 vrf VRF10102 neighbors x.x.x.x advertised-routes
        - sh ip bgp vpnv4 vrf VRF10102 neighbors x.x.x.x received-routes
        - sh isis neighbors detail
3) Run "sh log" and save the output into flash.
Anyone has an idea how I could made this script with EEM?
Thanks in advance for your help.
Best regards,
Laurent

I don't think you need a script for this. An applet should work just fine. This kind of thing is commonly done by TAC to aid in data collection for transient problems. This policy should work provided the CPU instance is correct. A 7600 will have at least two CPUs. This applet assumes CPU instance 1 is the desired CPU, but it may be CPU instance 2 you need to monitor.
event manager applet watch-cpu event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.11.1 get-type exact entry-op ge entry-val 90 exit-op lt exit-val 90 poll-interval 60 maxrun 300 action 1.0 cli command "enable" action 1.1 cli command "term exec promp time" action 2.0 cli command "show tech | append disk0:/high_cpu.txt" action 3.0 cli command "sh ip bgp vpnv4 vrf VRF10102 neighbors | append disk0:/high_cpu.txt" action 4.0 cli command "sh bgp vpnv4 unicast vrf VRF10102 summary | append disk0:/high_cpu.txt" action 5.0 cli command "sh ip bgp vpnv4 vrf VRF10102 neighbors x.x.x.x advertised-routes | append disk0:/high_cpu.txt" action 6.0 cli command "sh ip bgp vpnv4 vrf VRF10102 neighbors x.x.x.x received-routes | append disk0:/high_cpu.txt" action 7.0 cli command "sh isis neighbors detail | append disk0:/high_cpu.txt" action 8.0 cli command "show logg | append disk0:/high_cpu.txt"

EEM issue

Similar Messages

Maybe you are looking for