取消
显示结果 
搜索替代 
您的意思是: 
cancel
4768
查看次数
38
有帮助
2
评论
ywanxin
Cisco Employee
Cisco Employee
本帖最后由 ywanxin 于 2018-3-27 11:42 编辑
在做CPU突高的时候经常会使用EEM,一般咱们是使用SNMP OID去get cpu的值做EEM的触发条件。但是由于OID在不同的IOS下可能会不一样,所以很肯能取不到CPU的值,进而EEM无法触发。
我在设备上发现了另一种EEM的配置方法。原理是通过配置让CPU在高过threshold的时候报一条log,EEM的触发条件是这个log的pattern。
下面贴出配置
process cpu threshold type total rising 85 interval 5 全局模式下配置,命令解释:
process cpu threshold type {total | process | interrupt} rising percentage interval seconds [falling percentage interval seconds]
!
event manager applet high-cpu
event syslog pattern "CPURISINGTHRESHOLD" 报出的log有这个pattern。
action 0.1 syslog msg "EEM: HIGH CPU detected. Writing info to flash:eem-log.txt"
action 0.2 cli command "enable"
action 0.3 cli command "term exec prompt timestamp"
action 0.4 cli command "term len 0"
action 1.1 cli command "show process cpu sorted | append flash:eem-log.txt"
action 1.2 cli command "show proc mem sorted | append flash:eem-log.txt"
action 1.3 cli command "show mem alloc total | append flash:eem-log.txt"
action 1.4 cli command "show buffers | append flash:eem-log.txt"
action 1.5 cli command "show interfaces | append flash:eem-log.txt"
action 1.6 cli command "show interfaces stat | append flash:eem-log.txt"
action 1.7 cli command "show ip traffic | append flash:eem-log.txt"
action 2.2 syslog msg "EEM: Self-removing applet from configuration..."
action 2.3 cli command "configure terminal"
action 2.4 cli command "no event manager applet high-cpu"
action 2.5 cli command "end"
!
End
实验:
我是用rack上的RSRP2 (3945)测试的,使用长ping loopback接口IP把CPU冲高,配置如下:
process cpu threshold type total rising 25 interval 5 每5秒检测一次CPU, total cpu utilization 高于25%则报log,log如下:
*Mar 1 05:21:56.354: %SYS-1-CPURISINGTHRESHOLD: Threshold: Total CPU Utilization(Total/Intr): 30%/0%, Top 3 processes(Pid/Util): 132/14%, 5/10%, 185/0%
Log 中会看到占用最多CPU的3个进程ID和占用CPU多少
然后EEM触发
*Mar 1 05:21:56.363: %HA_EM-6-LOG: High_CPU: High CPU DETECTED. Please wait - logging Information to nvram:high_cpu.txt
看到文件已经抓下来了
RSRP2#dir nvram:
Directory of nvram:/
505 -rw- 3976 startup-config
506 ---- 1912 private-config
1 ---- 35 persistent-data
2 -rw- 0 ifIndex-table
3 -rw- 32048 high_cpu.txt
36 -rw- 557 IOS-Self-Sig#1.cer
37 -rw- 336174 cpu_stats
**************************************************************************************
process cpu threshold type total rising 85 interval 5 <<<<<<< 5秒钟检测大于85
event manager applet high-cpu
event syslog pattern "CPURISINGTHRESHOLD"
action 0.1 syslog msg "EEM: HIGH CPU detected. Writing info to flash:eem-log.txt"
action 0.2 cli command "enable"
action 0.3 cli command "term exec prompt timestamp"
action 0.4 cli command "term len 0"
action 1.1 cli command "show process cpu sorted | append flash:eem-log.txt"
action 1.2 cli command "show proc mem sorted | append flash:eem-log.txt"
action 1.3 cli command "show mem alloc total | append flash:eem-log.txt"
action 1.4 cli command "show buffers | append flash:eem-log.txt"
action 1.5 cli command "show interfaces | append flash:eem-log.txt"
action 1.6 cli command "show interfaces stat | append flash:eem-log.txt"
action 1.7 cli command "show ip traffic | append flash:eem-log.txt"
action 2.2 syslog msg "EEM: Self-removing applet from configuration..."
action 2.3 cli command "configure terminal"
action 2.4 cli command "no event manager applet high-cpu"
action 2.5 cli command "end"
!
End
****************************************************************************************
如果出现一下提示 可以用""""event manager session cli username """"
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
more flash:eem-log.txt
Command authorization failed.
Command authorization failed.
Command authorization failed.
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
并且这个可以跟EEM 连用 直接抓包下来
*******************************************************************************************
配置:
monitor capture buffer cc
monitor capture point ip cef cc gX/X both 对应接口
monitor capture point associate cc cc
或者
monitor capture buffer cisco-buf
monitor capture buffer cisco-buf size 10240
monitor capture buffer cisco-buf max-size 1500
monitor capture point ip process-switched cisco-point both
monitor capture point associate cisco-point cisco-buf
process cpu threshold type total rising 85 interval 5 每5秒检测cpu超过85
event manager applet high-cpu
event syslog pattern "CPURISINGTHRESHOLD"
action 0.1 syslog msg "EEM: HIGH CPU detected. Writing info to flash:eem-log.txt"
action 0.2 cli command "enable"
action 0.3 cli command "term exec prompt timestamp"
action 0.4 cli command "term len 0"
action 0.8 cli command "monitor capture point start cc"
action 0.9 cli command "show process cpu sorted | append flash:eem-log.txt"
action 1.0 cli command "show proc mem sorted | append flash:eem-log.txt"
action 1.1 cli command "show mem alloc total | append flash:eem-log.txt"
action 1.2 cli command "show buffers | append flash:eem-log.txt"
action 1.3 cli command "show interfaces | append flash:eem-log.txt"
action 1.4 cli command "show interfaces stat | append flash:eem-log.txt"
action 1.5 cli command "show ip traffic | append flash:eem-log.txt"
action 1.6 cli command "show process cpu history | append flash:eem-log.txt"
action 1.7 wait 15
action 1.8 cli command "monitor capture point stop all"
action 1.9 syslog msg "EEM: Self-removing applet from configuration..."
action 2.0 cli command "configure terminal"
action 2.1 cli command "no event manager applet high_cpu"
action 2.2 cli command "end"
!
评论
Mansur
Spotlight
Spotlight
厉害了。。不过监控我一般都是用的外部的服务器获取snmp,还没在设备上做过
byl_qware_com
Level 8
Level 8
好好学习一下此类型故障的解决方法
入门指南

使用上面的搜索栏输入关键字、短语或问题,搜索问题的答案。

我们希望您在这里的旅程尽可能顺利,因此这里有一些链接可以帮助您快速熟悉思科社区:









快捷链接