PDF(15.4 KB) View with Adobe Reader on a variety of devices
ePub(79.0 KB) View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle)(77.5 KB) View on Kindle device or Kindle app on multiple devices
Updated:November 22, 2017
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This document describes how to use the Cisco IOS® Embedded Event Manager (EEM) subsystem in order to monitor high CPU utilization on Cisco Catalyst series switches.
This document assumes that user has knowledge of Cisco IOS Embedded Event Manager (EEM).
The information in this document is based on the Cisco Catalyst series switches.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
This section includes several examples of the use of EEM scripts to monitor CPU utilization. Catalyst 2960 and 3750 switches allow EEM to use non-volatile RAM (NVRAM); Catalyst 4500 switches allow EEM to write to bootflash; and Catalyst 6500 switches allow EEM to use disk0 and sup-bootdisk.
This script emails an alert when CPU utilization goes above 50 percent. The body of the email is the output of the show process cpu sorted command.
event manager applet highcpu event snmp oid 184.108.40.206.220.127.116.11.18.104.22.168.1.3.1 get-type exact entry-op ge entry-val 50poll-interval 0.5 action 1.0 cli command "enable" action 2.0 cli command "show proc cpu sorted" action 3.0 mail server "192.168.1.1" to "firstname.lastname@example.org" from "email@example.com" subject "High CPU Alert" body "$_cli_result"
The definitions of italicized variables are:
highcpu - name of the event manager app
22.214.171.124.126.96.36.199.188.8.131.52.1.3.1 - Object identifier (OID) for polling the total CPU utilization of the route processor (RP)
50 - CPU utilization that triggers the script
poll-interval 0.5 - Frequency (every 0.5 seconds) the script monitors the CPU
184.108.40.206 - IP of the mail server
Append Output to Local File
This script appends required outputs to a file in the local file system. Replace file system with the appropriate file system on the switch.
This script appends the output of the show process cpu sorted command to a file in the local file system, then removes itself once completed. Replace file system with the appropriate file system on the switch.
event manager scheduler script thread class default number 1 event manager applet High_CPU event snmp oid 220.127.116.11.18.104.22.168.22.214.171.124.1.3.1 get-type exact entry-op gt entry-val 50 poll-interval 0.5 action 0.0 syslog msg "High CPU DETECTED. Please wait - logging Information to flash:high_cpu.txt" action 0.1 cli command "enable" action 0.2 cli command "term exec prompt timestamp" action 1.3 cli command "show process cpu sorted | append file system:high_cpu.txt" action 1.4 cli command "show process cpu sorted | append file system:high_cpu.txt" action 1.4 cli command "show process cpu sorted | append file system:high_cpu.txt" action 5.1 syslog msg "Finished logging information to file system:high_cpu.txt..." action 5.1 syslog msg "Self-removing applet from configuration..." action 5.2 cli command "term no exec prompt timestamp" action 9.1 cli command "configure terminal" action 9.2 cli command "no event manager applet High_CPU" action 9.3 cli command "end"
Collect Output and Write to Local File
This script uses a syslog-based trigger in order to run and collect required outputs and write those outputs to the local file system. Replace file system with the appropriate file system on the switch.
process cpu threshold type total rising 70 interval 15 event manager applet DETECT_CPU event syslog pattern ".*SYS-1-CPURISINGTHRESHOLD.*" action 1 cli command "en" action 2 cli command "show clock | append file system:cpuinfo" action 3 cli command "show proc cpu sort | append file system:cpuinfo" action 4 cli command "show line | append file system:cpuinfo"
Monitor CPU Utilization on Modular IOS
The Cisco EEM can also be used to monitor CPU utilization on modular IOS. Because of the differences in how the CPU is monitored on modular IOS, you can use the Simple Network Management Protocol (SNMP) OID (126.96.36.199.188.8.131.52.184.108.40.206.1.3.1) in order to check CPU utilization by the IOS base process.
This script uses the OID as a trigger and writes required outputs to the local file system. Replace file system with the appropriate file system on the switch.