This document describes how to configure a Cisco IOS® Embedded Event Manager (EEM) applet in order to capture the output from the show stacks command. The Cisco Technical Assistance Center (TAC) usually needs this output in order to troubleshoot high CPU utilization issues caused by the Simple Network Management Protocol (SNMP).
Cisco recommends that you have knowledge of these topics:
Simple Network Management Protocol (SNMP)
Cisco IOS Embedded Event Manager (EEM)
The information in this document is based on these software and hardware versions:
Cisco IOS Release 15.1(4)M6
Cisco 2811 Integrated Services Router
Note: The configurations in this document should work with earlier Cisco IOS software versions, since both applets use EEM Version 3.0, which is supported in Cisco IOS Release 12.4(22)T or later. However, this has not been tested.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
These EEM applets automate the process to capture output from the show stacks command. Note that:
Both applets use the Process ID (PID) of the SNMP engine. Enter the show processes cpu command in order to find the PID; in this example, the PID is 188:
2811#show processes cpu | include SNMP ENGINE PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 188 40 1 40000 0.00% 0.04% 0.01% 0 SNMP ENGINE 2811#
EEM Version 3.0 or later is required in order to use the wait actions. Enter the show event manager version command in order to detect the EEM version.
Cisco IOS software devices that use Authentication, Authorization, and Accounting (AAA) should define which user can execute CLI actions. Use the event manager session cli username user command for this configuration, where user is a username authorized to execute all CLI commands in EEM applets.
Some file systems might not be supported with the 'append' option to redirect the output. Before you configure the applet, test this manually in order to ensure that you can redirect output to your file system.
The show stacks command displays the tasks that are being handled by the specified process. When troubleshooting high CPU utilization issues, it is useful to find out which tasks are being executed when the condition occurs.
CPU Utilization Above 50%
This EEM applet detects when CPU utilization goes above 50%. At that time, output from the show stacks command is sampled over nine seconds and recorded in a file called SNMP_STACK.txt within the flash. This information helps TAC identify the cause of the high CPU utilization.
This example investigates a high CPU condition caused by SNMP; you can use a similar EEM applet in order to collect a different set of outputs to investigate high CPU issues caused by a different process.
This EEM applet is activated if the %SNMP-3-INPUT_QFULL_ERR syslog message is generated. At that time, output from the show stacks command is sampled over nine seconds and recorded in a file called SNMP_STACK.txt within the flash. This information helps TAC identify the cause of the high CPU utilization.