EEM – Script to check bandwidth usage for differents types of interfaces.

Objetivo: crear un script que chequee el ancho de banda de diferentes tipos de interfaces y que genere un log cuando se sobrepase un threshold.

Estos 3 scripts iniciales sirven de base para la comprensión del script que chequea el % de utilización del ancho de banda y genera un msg.

Este primer script tiene cómo objetivo encontrar una palabra dentro de una expresión regular e imprimirla por separado.

!
event manager applet regex
 event none
/Ya que no se declara un evento, se ejecuta manualmente mediante el comando event manager run applet-name.
 action 001 regexp "(.*) (.*) (.*)" "one two three" _match _sub1 _sub2 _sub3
/Esta acción con regex permite buscar un patrón determinado dentro de la expresión regular que se le pasa. En este caso es la cadena one two three.

 action 002 puts "match is $_match"
/Esta acción imprime en el cli el valor de la variable match en la que anteriormente se guardo la expresión regular completa.
 action 003 puts "submatch 3 is $_sub3"
/Esta acción imprime en el cli el valor de la variable sub3 que guarda el tercer valor de acuerdo al patrón definido al principio de regex.

Este segundo script tiene cómo objetivo probar la iteración sobre una cadena presentada.

event manager applet iteration
 event none
/Ya que no se declara un evento, se ejecuta manualmente mediante el comando event manager run applet-name.
 action 001 foreach iterator "red blue green orange 10 hol67"
/Itera sobre la cadena presentada.

 action 002  puts "Iterator is $iterator"
/Esta acción imprime en el cli el valor de iterator, que va cambiando por cada palabra de la variable.
 action 003 end

Este tercer script tiene cómo objetivo imprimir la dirección ip de la interfaz Loopback0.

!
event manager applet showIP
 event none sync yes
/Ya que no se declara un evento, se ejecuta manualmente mediante el comando event manager run applet-name. sync  (EEM policy execution sync or async) yes (Policy and CLI will run synchronously)
 action 001 cli command "enable"
 action 002 cli command "sh ip inter brief | i Loopback0"
 action 003 regexp " [0-9.]+ " "$_cli_result" ipadd
/Busca cadenas de números en la variable que guarda el resultado del comando anterior. Este resultado lo guarda en la variable ipadd.
 action 004 if $_regexp_result eq "1"
/Si el resultado de la regex es positivo, o sea, si la loopback0 tenía alguna dirección ip entonces sigue a la siguiente acción. Sino, ve directamente a else o end (si no hay ningún else declarado, va directamente a end).
 action 005  puts "IP address = $ipadd"
/Esta acción imprime el valor guardado en la variable ipadd, que seía la dirección de la loopback0
 action 006 else
 action 007  puts "No ip address configured"
/En este caso, si cae en el else, es porque la loopback0 no tenía ninguna dirección IP.
 action 008 end

Este primer script tiene cómo objetivo chequear el tx rate y en caso de que exceda un valor determinado, generar un msg.

!
event manager environment max_rx_rate 3
event manager environment poll_interfaces Gi0/0

/EEM allows environment variables to be defined using a CLI command, the event manager environment command, for use within an EEM policy.There are three different types of environment variables associated with Embedded Event Manager:
• User-defined--Defined by you if you create an environment variable in a policy that you have written.
• Cisco-defined--Defined by Cisco for a specific sample policy.
• Cisco built-in (available in EEM applets)--Defined by Cisco and can be read only or read/write. The read only variables are set by the systembefore an applet starts to execute. The single read/write variable,
_exit_status, allows you to set the exit status at policy exit for policies triggered from synchronous events.

event manager applet check_rx_rate
 event timer watchdog name rx_timer time 40
 action 001 foreach int "$poll_interfaces"
 action 002  cli command "ena"
 action 003  cli command "sh inter gigabitEthernet 0/0 summary | b ------"
 action 004  foreach line "$_cli_result" "\n"
 action 005   regexp ".*[0-9]+\s+[0-9]+\s+[0-9]+\s+[0-9]+\s+[0-9]+\s+([0-9]+)\s+.*" "$line" junk rxps
 action 006   if $_regexp_result eq "1"
 action 007    if $rxps lt "$max_rx_rate"
 action 008     syslog msg "Warning rx rate for $int is > than threshold. Current values is $rxps (threshold is $max_rx_rate)"
 action 009    end
 action 010   end
 action 011  end
 action 012 end
!

Para enlaces frame-relay:

!
event manager environment poll_interfaces Se2/0.1
event manager environment max_out_bs 12000
event manager applet check_tx_rate
 event timer watchdog name tx_time time 60
 action 001 foreach int "$poll_interfaces"
 action 002  cli command "enable"
 action 003  cli command "sh frame-relay pvc | i 5 minute output rate"
 action 004  foreach line "$_cli_result" "\n"
 action 005   regexp "5 minute output rate ([0-9]+)\s.*" "$line" junk txout
 action 006   if $_regexp_result eq 1
 action 007    if $txout gt $max_out_bs
 action 008     syslog msg "Warning, tx output for $int is above threshold. Current value is $txout (threshold is $max_out_bs)"
 action 009     counter name "congestion" op inc value 1
 action 010     set min "$_counter_value_remain"
 action 012     counter name "congestion1" op inc value 1
 action 013     set min1 "$_counter_value_remain"
 action 014     if $min1 eq 5
 action 015      puts "La interfaz $poll_interfaces lleva $min minutos con congestion de mas del 90 % de su ancho de banda"
 action 016     end
 action 017    else
 action 018     counter name "congestion" op set value 0
 action 019     counter name "congestion1" op set value 0
 action 020    end
 action 021   end
 action 022  end
 action 023 end
event manager applet test
 event counter name congestion entry-val 1000 entry-op gt exit-val 1000 exit-op lt
 action 4.0 counter name "congestion" op set value 0
event manager applet test1
 event counter name congestion1 entry-val 5 entry-op gt exit-val 5 exit-op lt
 action 4.0 counter name "congestion1" op set value 0

Para enlaces por tunnels:

event manager environment poll_interfaces Tu1
event manager environment max_out_bs 20000
event manager applet check_tx_rate
 event timer watchdog name tx_time time 20
 action 001 foreach int "$poll_interfaces"
 action 002  cli command "enable"
 action 003  cli command "sh inter tunnel 1 | i 30 second output rate"
 action 004  foreach line "$_cli_result" "\n"
 action 005   regexp "30 second output rate ([0-9]+)\s.*" "$line" junk txout
 action 006   if $_regexp_result eq 1
 action 007    if $txout gt $max_out_bs
 action 008     syslog msg "Warning, tx output for $int is above threshold. Current value is $txout (threshold is $max_out_bs)"
 action 009     counter name "congestion" op inc value 1
 action 010     set min "$_counter_value_remain"
 action 012     counter name "congestion1" op inc value 1
 action 013     set min1 "$_counter_value_remain"
 action 014     if $min1 eq 5
 action 015      puts "La interfaz $poll_interfaces lleva $min minutos con congestion de mas del 90 % de su ancho de banda"
 action 016     end
 action 017    else
 action 018     counter name "congestion" op set value 0
 action 019     counter name "congestion1" op set value 0
 action 020    end
 action 021   end
 action 022  end
 action 023 end
event manager applet test
 event counter name congestion entry-val 1000 entry-op gt exit-val 1000 exit-op lt
 action 4.0 counter name "congestion" op set value 0
event manager applet test1
 event counter name congestion1 entry-val 5 entry-op gt exit-val 5 exit-op lt
 action 4.0 counter name "congestion1" op set value 0

 

Posted in EEM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.