Cisco Embedded Event Manager and its usefullness for TAC

A few years ago I had a TAC case open with Cisco. The case was centered around an unusually high CPU condition on a Cisco 3800ISR series router. This router was only routing traffic between the Ethernet interfaces, doing some SNAT (stateful NAT), and basic BGP routing – so the CPU should not have been in the 90%+ range. Well, TAC wanted me to run some commands every 60 minutes 24×7 for a few days to see what was going on. Now we all now that that is not an easy thing to do, so what I decided to do was grab an existing EEM script from Cisco’s website and modify it to provide all the information that the TAC engineer wanted.
Needless to say, the case was solved about 2 days later when we upgraded the code per their suggestion because of the identification of the bug. 🙂 I am guessing that having a router send you the logs and command output every hour either provided them the information they needed, or more likely, the engineer realized that – well, you know.
So, for this post I have decided to post the EEM configuration as well as the EEM script in case you ever need to do something similar. If I can save you some time, I am all for that. I still use this script today – albeit in a different manner. I now use it to get “Daily Health Checks” from the routers in the field. Every day at noon they send me standard output commands so that we can check on them without having to log into each and every one of them.
So, without further typing – here is the script broken down: (to download this script, you can click here – HealthCheck_BLOG.tcl
Router Configuration:
First thing we will need to do is configure the Event Manager variables on the router:
The variables that we will use are:

Mail Server (SMTP) – 10.11.11.254
Receipt E-Mail address – Flynn@Domain.Com
From E-Mail address – CluRouter@Domain.Com
TCL file location – flash:/
User who runs the eem – eem_user

First we configure the EEM Environment using the event manager commands
Router(config)#event manager environment _email_server 10.11.11.254
Router(config)#event manager environment _email_to Flynn@Domain.Com
Router(config)#event manager environment _email_from CluRouter@Domain.Com
Router(config)#event manager directory user policy “flash:/”
Router(config)#event manager session cli username “eem_user”
!
Next we define the scheduling of this command (here at 16:00 every day)
Router(config)#kron occurrence Daily at 16:00 recurring
Router(config)#policy-list HealthCheck_BLOG
!
Now we can device that happens when this KRON job is run.
Router(config)#kron policy-list HealthCheck_BLOG
Router(config)#cli event manager run HealthCheck_BLOG.tcl
!
Lastly we can define the policy
Router(config)#event manager policy HealthCheck_BLOG.tcl
!
———————————————————————-
EEM Script section
———————————————————————-
This .tcl (originally was sendmail.tcl) file was taken from Cisco’s website and then modified. I will explain only what I have modified in order to accomplish the task of sending logs.
The sections that I have modified are:
#———————– “show commands” —————-
#———————– send mail ———————-
Under the Show Commands section:
To display the clock and store the results in $result:
if [catch {cli_exec $cli(fd) “show clock”} result] {
error $result $errorInfo
}
set show_clock $result
To display the show ip interfaces and store the results in show_ip_interfaces
if [catch {cli_exec $cli(fd) “show ip interfaces”} result] {
error $result $errorInfo
}
set show_ip_interfaces $result
To show the command show align and store the results in the show_align variable
if [catch {cli_exec $cli(fd) “show align”} result] {
error $result $errorInfo
}
set show_align $result
To execute the command show buffers gig 0/0 dump and store in show_buffers_gig_0_0
if [catch {cli_exec $cli(fd) “show buffers gig 0/0 dump”} result] {
error $result $errorInfo
}
set show_buffers_gig_0_0 $result
Now to send the mail most of the variables where defined in the EEM environment originally, all that I had to do was the subject and body
#———————– send mail ———————-
#
# create mail form
action_syslog msg “Creating mail header…”
set body [format “Mailservername: %s” “$_email_server”]
set body [format “%snFrom: %s” “$body” “$_email_from”]
set body [format “%snTo: %s” “$body” “$_email_to”]
set _email_cc “”
set body [format “%snCc: %s” “$body” “”]
#setting the subject
set body [format “%snSubject: %sn” “$body” “SR TAC CASE NUMBER – $routername…”]
#outputting the command output into the e-mail body
set body [format “%sn%s” “$body” “The body of your msg goes here…”]
set body [format “%sn%s” “$body” “Report Summary:”]
set body [format “%sn%s” “$body” ”   – Show Clock”]
set body [format “%sn%s” “$body” ”   – Show ip interfaces”]
set body [format “%sn%s” “$body” ”   – Show align”]
set body [format “%sn%s” “$body” ”   – Show buffers gig 0/0 dump”]
set body [format “%snn%s” “$body” “———- Show Clock———-“]
set body [format “%snn%s” “$body” “$show_clock”]
set body [format “%snn%s” “$body” “———- Show IP Interfaces ———-“]
set body [format “%snn%s” “$body” “$show_ip_interfaces “]
set body [format “%snn%s” “$body” “———- Show Align ———-“]
set body [format “%snn%s” “$body” “$show_align”]
set body [format “%snn%s” “$body” “———- Show buffers gig 0/0 dump ———-“]
set body [format “%snn%s” “$body” “$show_buffers_gig_0_0”]
Below is a pure dump of the script if you want to look at it in its raw format
###############################################################################################################
#
#     Daily Health Check TCL Script taken from Cisco.Com web site
#
#    Update by Jeff Fry – 9/23/2008
#
###############################################################################################################
# Useful event registration tcl command extensions
# None
::cisco::eem::event_register_none queue_priority low nice 1 maxrun 600
# Watchdog Timer
#::cisco::eem::event_register_timer watchdog name errimt time $errim_period queue_priority low nice 1
# Syslog
#::cisco::eem::event_register_syslog occurs 1 pattern .*STANDBY.*STATECHANGE.* maxrun 90 queue_priority low nice 1
# Object Tracking
#::cisco::eem::event_register_track 1 state up queue_priority low nice 1
# Interface
#::cisco::eem::event_register_interface name $intf parameter txload entry_op ge entry_val 192 entry_val_is_increment FALSE queue_priority low nice 1
# Cron Job
#::cisco::eem::event_register_timer cron name test cron_entry “0 * * * *” queue_priority low nice 1 maxrun 20
#
# Namespace imports
#
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
#— Check required environment variable(s) has been defined
if {![info exists _email_server]} {
set result “EEM Policy Error: variable $_email_server has not been set”
error $result $errorInfo
}
if {![info exists _email_to]} {
set result “EEM Policy Error: variable $_email_to has not been set”
error $result $errorInfo
}
if {![info exists _email_from]} {
set result “EEM Policy Error: variable $_email_from has not been set”
error $result $errorInfo
}
#—————— hostname        ——————-
set routername [info hostname]
#
#——————-   ” cli open”   ——————-
#
if [catch {cli_open} result] {
error $result $errorInfo
} else {
array set cli $result
}
#————— end of “cli open”   ——————-
#
#———————– “show commands” —————-
#
if [catch {cli_exec $cli(fd) “enable”} result] {
error $result $errorInfo
}
if [catch {cli_exec $cli(fd) “show clock”} result] {
error $result $errorInfo
}
set show_clock $result
if [catch {cli_exec $cli(fd) “show ip interfaces”} result] {
error $result $errorInfo
}
set show_ip_interfaces $result
if [catch {cli_exec $cli(fd) “show align”} result] {
error $result $errorInfo
}
set show_align $result
if [catch {cli_exec $cli(fd) “show buffers gig 0/0 dump”} result] {
error $result $errorInfo
}
set show_buffers_gig_0_0 $result
#———————- end of show commands ————
#
#———————– “enable” ———————-
#
if [catch {cli_exec $cli(fd) “enable”} result] {
error $result $errorInfo
}
#
#———————– send mail ———————-
#
# create mail form
action_syslog msg “Creating mail header…”
set body [format “Mailservername: %s” “$_email_server”]
set body [format “%snFrom: %s” “$body” “$_email_from”]
set body [format “%snTo: %s” “$body” “$_email_to”]
set _email_cc “”
set body [format “%snCc: %s” “$body” “”]
set body [format “%snSubject: %sn” “$body” “SR TAC CASE NUMBER – $routername…”]
set body [format “%sn%s” “$body” “The body of your msg goes here…”]
set body [format “%sn%s” “$body” “Report Summary:”]
set body [format “%sn%s” “$body” ”   – Show Clock”]
set body [format “%sn%s” “$body” ”   – Show ip interfaces”]
set body [format “%sn%s” “$body” ”   – Show align”]
set body [format “%sn%s” “$body” ”   – Show buffers gig 0/0 dump”]
set body [format “%snn%s” “$body” “———- Show Clock———-“]
set body [format “%snn%s” “$body” “$show_clock”]
set body [format “%snn%s” “$body” “———- Show IP Interfaces ———-“]
set body [format “%snn%s” “$body” “$show_ip_interfaces “]
set body [format “%snn%s” “$body” “———- Show Align ———-“]
set body [format “%snn%s” “$body” “$show_align”]
set body [format “%snn%s” “$body” “———- Show buffers gig 0/0 dump ———-“]
set body [format “%snn%s” “$body” “$show_buffers_gig_0_0”]
if [catch {smtp_send_email $body} result] {
action_syslog msg “smtp_send_email: $result”
}
action_syslog msg “E-mail sent!”
#—————— end of send mail ——————–
#
#——————— cli close ————————
#
cli_close $cli(fd) $cli(tty_id)
# eeeeeeeeeeeeeeeeeeeeeeeeeeee    End of sendmail.tcl eeeeeeeeeeeeeeeeeeeeee

Fryguy's Blog

~ A Network Blog by a Network Engineer

Cisco Embedded Event Manager and its usefullness for TAC

Share this: