Cisco IOS Embedded Event Manager (EEM)

Introduction

This document describes how to configure a Cisco IOS^® Embedded Event Manager (EEM) applet in order to capture the output from the show stacks command. The Cisco Technical Assistance Center (TAC) usually needs this output in order to troubleshoot high CPU utilization issues caused by the Simple Network Management Protocol (SNMP).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Simple Network Management Protocol (SNMP)
• Cisco IOS Embedded Event Manager (EEM)
• Syslog

Components Used

The information in this document is based on these software and hardware versions:

• Cisco IOS Release 15.1(4)M6
• Cisco 2811 Integrated Services Router

Note: The configurations in this document should work with earlier Cisco IOS software versions, since both applets use EEM Version 3.0, which is supported in Cisco IOS Release 12.4(22)T or later. However, this has not been tested.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Configure

These EEM applets automate the process to capture output from the show stacks command. Note that:

• Both applets use the Process ID (PID) of the SNMP engine. Enter the show processes cpu command in order to find the PID; in this example, the PID is 188:
  
  

  2811#show processes cpu | include SNMP ENGINE
   PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process
   188          40           1      40000  0.00%  0.04%  0.01%   0 SNMP ENGINE
  2811#

• EEM Version 3.0 or higher is required in order to use the wait actions. Enter the show event manager version command in order to detect the EEM version.
• Cisco IOS software devices that use Authentication, Authorization, and Accounting (AAA) should define which user can execute CLI actions. Use the event manager session cli username user command for this configuration, where user is a username authorized to execute all CLI commands in EEM applets.
• Some file systems may not be supported with the 'append' option to redirect the output. Before you configure the applet, test this manually in order to ensure that you can redirect output to your file system.

The show stacks command displays the tasks that are being handled by the specified process. When troubleshooting high CPU utilization issues, it is useful to find out which tasks are being executed when the condition occurs.

CPU Utilization Above 50%

This EEM applet detects when CPU utilization goes above 50%. At that time, output from the show stacks command is sampled over nine seconds and recorded in a file called SNMP_STACK.txt within the flash. This information helps TAC identify the cause of the high CPU utilization.

This example investigates a high CPU condition caused by SNMP; you can use a similar EEM applet in order to collect a different set of outputs to investigate high CPU issues caused by a different process.

event manager applet SNMP_STACK
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type exact entry-op gt 
   entry-val "50" exit-op lt exit-val "15" poll-interval 2 maxrun 20
action 0.0 syslog msg "High CPU DETECTED"
action 0.1 cli command "enable"
action 1.1 cli command "show clock | append flash:SNMP_STACK.TXT"
action 1.2 cli command "show proc cpu sort | append flash:SNMP_STACK.TXT"
action 2.1 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.2 wait 1
action 2.3 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.4 wait 1
action 2.5 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.6 wait 1
action 2.7 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.8 wait 1
action 2.9 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.1 wait 1
action 3.2 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.3 wait 1
action 3.4 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.5 wait 1
action 3.6 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.7 wait 1
action 3.8 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"

%SNMP-3-INPUT_QFULL_ERR Syslog Message

This EEM applet is activated if the %SNMP-3-INPUT_QFULL_ERR syslog message is generated. At that time, output from the show stacks command is sampled over nine seconds and recorded in a file called SNMP_STACK.txt within the flash. This information helps TAC identify the cause of the high CPU utilization.

event manager applet SNMP_STACK
event syslog pattern "%SNMP-3-INPUT_QFULL_ERR"
action 1.0 cli command "enable"
action 2.1 cli command "show clock | append flash:SNMP_STACK.TXT"
action 2.2 cli command "show proc cpu sort | append flash:SNMP_STACK.TXT"
action 3.1 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.2 wait 1
action 3.3 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.4 wait 1
action 3.5 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.6 wait 1
action 3.7 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.8 wait 1
action 3.9 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.1 wait 1
action 4.2 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.3 wait 1
action 4.4 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.5 wait 1
action 4.6 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.7 wait 1
action 4.8 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.9 wait 1

Verify

There is currently no verification procedure available for this configuration.

Troubleshoot

There is currently no specific troubleshooting information available for this configuration.

Related Information

• Embedded Event Manager Configuration Guide, Cisco IOS Release 15M&T
• Technical Support & Documentation - Cisco Systems