Introduction
This document describes how to configure a Cisco IOS® Embedded Event Manager (EEM) applet in order to capture the output from the show stacks command. The Cisco Technical Assistance Center (TAC) usually needs this output in order to troubleshoot high CPU utilization issues caused by the Simple Network Management Protocol (SNMP).
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
- Simple Network Management Protocol (SNMP)
- Cisco IOS Embedded Event Manager (EEM)
- Syslog
Components Used
The information in this document is based on these software and hardware versions:
- Cisco IOS Release 15.1(4)M6
- Cisco 2811 Integrated Services Router
Note: The configurations in this document should work with earlier Cisco IOS software versions, since both applets use EEM Version 3.0, which is supported in Cisco IOS Release 12.4(22)T or later. However, this has not been tested.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Configure
These EEM applets automate the process to capture output from the show stacks command. Note that:
The show stacks command displays the tasks that are being handled by the specified process. When troubleshooting high CPU utilization issues, it is useful to find out which tasks are being executed when the condition occurs.
CPU Utilization Above 50%
This EEM applet detects when CPU utilization goes above 50%. At that time, output from the show stacks command is sampled over nine seconds and recorded in a file called SNMP_STACK.txt within the flash. This information helps TAC identify the cause of the high CPU utilization.
This example investigates a high CPU condition caused by SNMP; you can use a similar EEM applet in order to collect a different set of outputs to investigate high CPU issues caused by a different process.
event manager applet SNMP_STACK
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.10.1 get-type exact entry-op gt
entry-val "50" exit-op lt exit-val "15" poll-interval 2 maxrun 20
action 0.0 syslog msg "High CPU DETECTED"
action 0.1 cli command "enable"
action 1.1 cli command "show clock | append flash:SNMP_STACK.TXT"
action 1.2 cli command "show proc cpu sort | append flash:SNMP_STACK.TXT"
action 2.1 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.2 wait 1
action 2.3 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.4 wait 1
action 2.5 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.6 wait 1
action 2.7 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 2.8 wait 1
action 2.9 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.1 wait 1
action 3.2 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.3 wait 1
action 3.4 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.5 wait 1
action 3.6 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.7 wait 1
action 3.8 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
%SNMP-3-INPUT_QFULL_ERR Syslog Message
This EEM applet is activated if the %SNMP-3-INPUT_QFULL_ERR syslog message is generated. At that time, output from the show stacks command is sampled over nine seconds and recorded in a file called SNMP_STACK.txt within the flash. This information helps TAC identify the cause of the high CPU utilization.
event manager applet SNMP_STACK
event syslog pattern "%SNMP-3-INPUT_QFULL_ERR"
action 1.0 cli command "enable"
action 2.1 cli command "show clock | append flash:SNMP_STACK.TXT"
action 2.2 cli command "show proc cpu sort | append flash:SNMP_STACK.TXT"
action 3.1 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.2 wait 1
action 3.3 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.4 wait 1
action 3.5 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.6 wait 1
action 3.7 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 3.8 wait 1
action 3.9 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.1 wait 1
action 4.2 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.3 wait 1
action 4.4 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.5 wait 1
action 4.6 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.7 wait 1
action 4.8 cli command "show stacks 188 | append flash:SNMP_STACK.TXT"
action 4.9 wait 1
Verify
There is currently no verification procedure available for this configuration.
Troubleshoot
There is currently no specific troubleshooting information available for this configuration.
Related Information