Thursday, June 20, 2013

Detect High CPU on a Cisco Switch

Recently, I have had an issue on a Core Switch. This switch was running at 80% of CPU for 3 days. The CPU was not monitored and we have not received a syslog message on our server.
Also, I have decided to use the following command (on 4k5) in order to trigger a syslog alert in case of High CPU:

process cpu threshold type total rising 60 interval 20

This command trigger a syslog alert if the CPU exceeds 60 percent for a period of 20 seconds.

Saturday, June 8, 2013

EEM - Generate a customized syslog message



In order to generate a customized syslog message, you can use EEM (Embedded Event Manager). This is a Cisco tool. It helps to monitor events and generates an action when an particular event occur. In my case, I would like generate a customized Cisco log message if my primary WAN link is down. This message will have an 'alerts' level with my own description. By default, if an interface goes down it will only generate a 'informational' message. The policy of my syslog server is to generate an email only if I receive an 'error' level message.
I monitor interface giga1/1. If this this interface goes down (log message), I generate my customized message. You can see below the configuration:


event manager applet WanMonitor
 event syslog pattern "Interface GigabitEthernet1/1, changed state to administratively down"
 action 1.0 syslog priority alerts msg "PRIMARY WAN LINK is DOWN on Core 1"