CCIE学习笔记之EEM

首页 > 代码库 > CCIE学习笔记之EEM

2024-07-17 09:00:53 235人阅读

CCIE学习笔记之EEM

当内存使用到一定程度生成日志并发邮件：

Router(config)# event manager appletmemory-fail

定义触发事件：

event snmp oid oid-value get-type{exact|next} entry-op operator entry-val entry-value[exit-comb| and}] [exit-opoperator] [exit-val exit-value] [exit-time exit-time-value] poll-intervalpoll-int-value

例：Router(config-applet)#eventsnmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1get-type exact entry-op lt entry-val5120000 poll-interval 90

//an EEM event is triggered when free memoryfalls below the value of 5120000

动作显示日志：

action label syslog [prioritypriority-level] msg msg-text facility string

例：Router(config-applet)#action 1.0 syslog priority critical msg"Memory exhausted; current available memory is $_snmp_oid_val bytes"

动作发送邮件：

action label mail server server-address toto-address from from-address [cc cc-address] subject

subject body body-text

例：Router(config-applet)#action 2.0 mail server 192.168.1.10 to engineering@example.com from devtest@example.com subject "Memory failure" body "Memory exhausted;current

available memory is $_snmp_oid_valbytes"

设置环境变量：

event manager environment _email_to engineering@example.com

手动执行：

Router(config)#event manager applet manual-policy

Router(config-applet)# event none

Router(config-applet)# action 1.0 syslog msg"Manual-policy triggered"

Router# event manager run manual-policy

查看注册：

show event manager policy registered

取消注册：

no event manager policy policy-filename

例：

Router(config)# no event manager policyIPSLAping1

//Removes the EEM policy from theconfiguration,causing the policy to be unregistered.

暂停执行所有EEM策略：

Router(config)# event manager schedulersuspend

Tracking a Stub Object

Router(config)# track 2 stub-object

Router(config-track)# default-state up

Router(config)# event manager applet track-two

Router(config-applet)# event track 2 state down

Router(config-applet)# action 1.0 track set 2 state up

Router(config-applet)# action 2.0 trackread 2

显示EEM历史数据：

Router(config)# event manager history sizeevents 30

Router# show event manager history events

No. Time of Event EventType Name

1 Fri Aug13 21:42:57 2004 snmp applet: SAAping1

2 Fri Aug13 22:20:29 2004 snmp applet: SAAping1

3 Wed Aug18 21:54:48 2004 snmp applet: SAAping1

4 Wed Aug18 22:06:38 2004 snmp applet: SAAping1

5 Wed Aug18 22:30:58 2004 snmp applet: SAAping1

6 Wed Aug18 22:34:58 2004 snmp applet: SAAping1

7 Wed Aug18 22:51:18 2004 snmp applet: SAAping1

8 Wed Aug18 22:51:18 2004 application applet: CustApp1

Router# show event manager history trapspolicy

No. Time TrapType Name

1 Wed Aug18 22:30:58 2004 policy EEM Policy Director

2 Wed Aug18 22:34:58 2004 policy EEM Policy Director

3 Wed Aug18 22:51:18 2004 policy EEM Policy Director

Router# show event manager policy registeredtime-ordered

No. Type Event Type Time Registered Name

1 applet snmp Thu May30 05:57:16 2004memory-fail

oid{1.3.6.1.4.1.9.9.48.1.1.1.6.1} get-type exact entry-op lt entry-val

{5120000} poll-interval 90

action 1.0 syslog priority critical msg"Memory exhausted; current available memory

is $_snmp_oid_val bytes"

action 2.0 force-switchover

2 applet syslog Wed Jul16 00:05:17 2004 intf-down

pattern {.*UPDOWN.*Ethernet1/0.*}

action1.0 cns-event msg "Interface state change: $_syslog_msg"

Configuring Event SNMP Notification

Router(config-applet)# eventsnmp-notification dest-ip-address 192.168.1.1 oid 1 op eq oid-val 10

多事件检测：

event manager applet delay_50

event tag 1.0 cli pattern "show bgpall" sync yes occurs 32 period 60 maxrun 60

event tag 2.0 syslog pattern "COUNT"

trigger occurs 1 delay 50

correlate event 1.0 or event 2.0

attribute tag 1.0 occurs 1

attribute tag 2.0 occurs 1

action 1.0 cli command "show memory"

action2.0 cli command "enable"

action 3.0 cli command "configterminal"

action 4.0 cli command " ip route192.0.2.0 255.255.255.224 192.0.2.12"

action 91.0 cli command "exit"

action 99.0 cli command "show ip route |incl 192.0.2.5"

Configuring EEM Class-Based Scheduling

Router(config)# event manager schedulerapplet thread class default number 2

//In this example, two EEM executionthreads are created to run applets assigned to the default class

Holding a Scheduled EEM Policy Event or Event Queue

Router# event manager scheduler hold policy2

// Router# event manager scheduler holdpolicy 2

Resuming Execution of EEM Policy Events or Event Queues

Router# event manager scheduler release policy 2

// The example shows how to resume theexecution of the policy with job ID of 2

Clearing Pending EEM Policy Events or Event Queues

Router# event manager scheduler clearpolicy 2

// In this example, the EEM policy with ajob ID of 2 is cleared from the pending queue

Modifying the Scheduling Parameters of EEM Policy Eventsor Event Queues

event manager scheduler modify all class A

// In this example, all currently pendingEEM policies are assigned to class A

Reading Input from the Active Console

Router(config)# event manager applet action

Router(config-applet)# event none

Router(config-applet)# action label2 getsinput

// Gets input from the local console in asynchronous applet and stores the value in the given variable when an EEMapplet is triggered.

Router(config-applet)# action label3 syslogmsg “Input entered was \”$input\“”

In this example, the action to be taken isto write the value of the variable specified in Step 5, to syslog

效果：

Writing Input to the Active Console

Router(config-applet)# event manager appletputs

Router(config-applet)# event none

Router(config-applet)# action 1 regexp"(.*) (.*) (.*)" "one two three" _match _sub1

// Specifies the action to match theregular expression pattern on an input string when an EEM applet is triggered

Router(config-applet)# action 2 puts"match is $_match"

Router(config-applet)# action 3 puts"submatch 1 is $_sub1"

Router# event manager run puts

match is one two three

submatch 1 is one

Configuring SNMP Library Extensions

Router(config)# event manager applet snmp

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1get-type exac entry-op lt entry-val 5120000 poll-interval 90

// event snmp oid oid-value get-type {exact| next} entry-op operator

entry-val entry-value[exit-comb | and}][exit-op operator] [exit-val

exit-value] [exit-time exit-time-value]poll-interval poll-int-value

//In this example, an EEM event is

triggered when free memory falls below

the value of 5120000

Router(config-applet)# action 1.3 info typesnmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact community public ipaddr172.17.16.69

// action label info type snmp oidoid-value get-type {exact| next}

[community community-string] [ipaddrip-address]

// In this example, the type of getoperation

is specified as exact and community

string is specified as public.

Router(config-applet)# action 1.4 info typesnmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 set-type integer 42220 sysName.0community rw ipaddr 172.17.16.69

// action label info type snmp oidoid-value set-type oid-type oid-type-value community community-string [ipaddrip-address]

// In this example, the sysName.0 variable

is specified for the set operation and

community string is specified as rw.

Router(config-applet)# action 1.3 info typesnmp getid community public ipaddr 172.17.16.69

// action label info type snmp getidoid-value [community community-string] [ipaddr ip-address]

// (Optional) Specifies if the individual

variables should be retrieved by the getid

operation

Configuring EEM Applet for SNMP OID Notifications

Router(config)# event manager applet snmp

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1get-type exact entry-op lt entry-val 5120000 poll-interval 90

Router(config-applet)# action 1.3 info typesnmp var sysDescr.0 oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 integer 4220

// action label info type snmp varvariable-name oid oid-value oid-type oid-type-value

// In this example, the sysDescr.0 variableis used

outer(config-applet)# action 1.4 info type snmptrap enterprise-oid 1.3.6.1.4.1.1 generic-trapnum 4 specific-trapnum 7 trap-oid1.3.6.1.4.1.1.226.0.2.1 trap-var sysUpTime.0

// action label info type snmp trapenterprise-oid enterprise-oid-value

generic-trapnum generic-trap-numberspecific-trapnum specific-trap-number trap-oid trap-oid-value trap-vartrap-variable

// In this example, theauthenticationFailure trap is generated

// The specific trap number refers to the

enterprise-specific trap, which isgenerated

when an enterprise event occurs. If the

generic trap number is not set to 6, the

specific trap number you specify will be

used to generate traps

Router(config-applet)# action 1.4 info typesnmp inform trap-oid 1.3.6.1.4.1.1.226.0.2.1 trap-var sysUpTime.0 communitypublic ipaddr 172.69.16.2

// action label info type snmp informtrap-oid trap-oid-value trap-var trap-variable community community-stringipaddr ip-address

// In this example, the inform request is generatedfor the sysUpTime.0 variable

Configuring Variable Logic for EEM Applets

Router(config)# event manager appletcondition

Router(config-applet)#even none

Router(config-applet)#action 1.0 set i 2

// In this example, the value of thevariable i is set to 2

Router(config-applet)# action 2 while $i lt10

// In this example, a loop is set to checkif the value of the variable i is less than 10

Router(config-applet)# action 3 syslog msg "i is $i"

// In this example, the message ‘i is $_i’is written to the syslog

Router(config-applet)# action 3 end

Specifying if else Conditional Blocks

Router(config)# event manager appletifcondition

Router(config-applet)# action 1.0 set x 5

Router(config-applet)# action 2.0 if $x lt10

Router(config-applet)# action 3.0 puts “$xis less than 10”

Router(config-applet)# action 4.0 else

Router(config-applet)# action 5.0

Specifying foreach Iterating Statements

Router(config)# event manager appletiteration

Router(config-applet)# action 2.0 foreach iterator "red blue green orange"

Router(config-applet)# action 3.0 puts "Iterator is $iterator"

Router(config-applet)# action 4.0 end

Using Regular Expressions

Router(config)# event manager applet regexp

Router(config-applet)# action 2.0 regexp"(.*) (.*) (.*)" "red blue green" _match _sub1

//In this example, an input string of ‘redblue green’ is

specified. When the expression patternmatches the input

string, the entire result red blue green isstored in the

variable _match and the submatch redisstored in the

variable _sub1

Incrementing the Values of Variables

Router(config)# event manager appletincrement

Router(config-applet)#action 1.0 setvarname 20

Router(config-applet)#action 2.0 increment varname 12

// In this example, the value of thevariable is incremented by 12

Configuring Event SNMP Object

Router(config)# event manager appletmanual-policy

Router(config-applet)# event snmp-objectoid 1.9.9.9.9 type gauge sync yes

action 1 syslog msg "oid =$_snmp_oid"

action 2 syslog msg "request =$_snmp_request"

action 3 syslog msg "request_type =“$_snmp_request_type"

Disabling AAA Authorization

Router(config-applet)# event manager appletone class A authorization bypass

//event manager applet applet-name[authorization bypass][class class-options] [trap]

// allow EEM policies to bypass AAAauthorization when triggered

Description of EEM

event manager applet applet-name

description line

Application-Specific Event Detector

event manager applet EventPublish_A

event timer watchdog time 20.0 //每20秒执行一次

action 1.0 syslog msg "AppletEventPublish_A"

action 2.0 publish-event sub-system 798 type 1arg1 twenty //公布事件（用于触发）

exit

event manager applet EventPublish_B

event application sub-system 798 type 1 //触发事件

action 1.0 syslog msg "AppletEventPublish_B arg1 $_application_data1"

//事件a的执行出发事件b的执行，事件a如果不执行，事件b也不执行：

CLI Event Detector

event manager applet cli-match

event cli pattern "write mem.*" syncyes // yes the event detector isnotified when this policy completes running

action 1.0 syslog msg "$_cli_msg CommandExecuted"

set 2.0 _exit_status 1 // The exit status of the policy determineswhether the CLI command will be executed the policy exit status is set to oneand the CLI command runs

另一个例子：

Counter Event Detector and Timer Event Detector

event manager applet EventCounter_A

eventtimer watchdog time 60.0

action 1.0 syslog msg “EventCounter_A”

action 2.0 counter name critical_errors op incvalue 1

exit

event manager applet EventCounter_B

event counter name critical_errors entry-op gtentry-val 3 exit-op lt exit-val 3

action1.0 syslog msg “EventCounter_B”

action 2.0 counter name critical_errors op setvalue 0

aa运行4次bb运行1次，不断重复：

Interface Counter Event Detector（监测接口）

event manager applet EventInterface

event interface name FastEthernet0/0 parameterreceive_throttle entry-op ge entry-val 5

entry-val-is-increment true poll-interval 90

action 1.0 syslog msg "AppletEventInterface"

Resource Event Detector（监测资源）

event manager applet policy-one

event resource policy cpu-high

action 1.0 syslog msg “CPU high at$_resource_current_value percent”

SNMP Event Detector

The following example shows how to specifyan EEM applet to run when the CPU usage is greater than 75 percent. When theEEM applet runs, the CLI commands enable and show cpu processes are run, and ane-mail containing the result of the show cpu processes command is sent to anengineer.

event manager appletsnmpcpuge75

event snmpoid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge entry-val 1 poll-interval10

action 1.0cli command "enable"

action 2.0cli command "show process cpu"

action 3.0 mail server"192.168.1.146" to "engineer@cisco.com" from"devtest@cisco.com"

subject "B25 PBX Alert" body"$_cli_result"

event manager applet memory-demo

event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1get-type exact entry-op lt entry-val 5120000

poll-interval 90

action 1.0 syslog priority critical msg"Memory exhausted; current available memory is

$_snmp_oid_val bytes"

action 2.0 force-switchover

// The applet will run when the

available memory on the primary RP fallsbelow the specified threshold of 5,120,000 bytes. The applet

actions are to write a message to syslogthat indicates the number of bytes of memory available and to

switch to the secondary RP

Syslog Event Detector

event manager applet interface-down

event syslog pattern “.*UPDOWN.*Ethernet1/0.*”occurs 4

action 1.0 syslog msg "Ethernet interface1/0 changed state 4 times"

事件的嵌套：

vent manager applet manual-policy

event none

action 1.0 syslog msg "Manual-policytriggered"

exit

event manager applet manual-policy-two

event none

action 1.0 policy manual-policy

end

event manager run manual-policy-two

Tracking a Stub Object Using EEM

track 10 stub-object

default-state down

event manager applet track-ten

event track 10 state any

action 1.0 track set 10 state up

action 2.0 track read 10

Embedded Event Manager Watchdog System Monitor (Cisco IOSwsmon) Event Detector

cpu:

event manager applet c

event ioswdsysmon sub1 cpu-proc taskname"Exec" op lt val 20 period 10

action 1 syslog msg "cpu c"

memory:

event manager applet c

event ioswdsysmon sub1 mem-proc taskname"Net Input" op lt val 90 is-percent true period 10

action 1 syslog msg "mem c"

Configuration SNMP Library Extensions Examples

Thefollowing example shows how to send a get request to the local host

Router(config)# event manager applet snmp

Router(config-applet)# event snmp oid

1.3.6.1.2.1.1.1.0 get-type exact entry-op

ltentry-val

5120000 poll-interval

Router(config-applet)# action 1.3 info typesnmp oid

1.3.6.1.2.1.1.1.0 get-type exact

community

public

Router(config-applet)# action 1.3 info typesnmp oid

1.3.6.1.2.1.1.4.0get-type next community

public

Thefollowing example shows how to send a get request to a remote host

Router(config)# event manager applet snmp

Router(config-applet)# event snmp oid

1.3.6.1.2.1.1.1.0 get-type exact entry-op

ltentry-val

5120000 poll-interval

Router(config-applet)# action 1.3 info typesnmp oid

1.3.6.1.2.1.1.4.0 get-type next community

public ipaddr

172.17.16.69

Router(config-applet)# action 1.3 info typesnmp getid

1.3.6.1.2.1.1.1.0 community

public ipaddr

172.17.16.69

Managing EEM Policies

Router(config)# event manager directory user library disk0:/usr/lib/tcl

//Specifies a directory to use for storinguser library files or user-defined EEM policies

action label2 multiply 23 25

乘法，结果存在$_result中

除法的余数存在$_remainder

除法：

本文出自 “flyclc” 博客，请务必保留此出处http://flyclc.blog.51cto.com/1385758/1539304

声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉：投诉/举报工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。

联系
我们

首页 > 代码库 > CCIE学习笔记之EEM