• Arista Custom Event Handler To Take Action Based On Interface Utilization

 
 
Print Friendly, PDF & Email

Introduction

An EOS event handler executes a Linux Bash shell command in response to a specific system event. An event handler consists of a Bash command, a trigger and a delay; when the trigger event occurs, the action is scheduled to run after a delay in seconds. With the particular customer, I was working with they wanted to shut down a mirror session when a bandwidth threshold was reached. The main reason for the custom event-handler was because they were heavily oversubscribing a mirror session destination and were worried about affecting their production traffic. In the scenario, they had several 1 gig interfaces mirrored to a single 1 gig interface attached to a sniffer, which had a high likelihood of being oversubscribed.

Configuration

 

1. Create the Event Handler:

 The name of the Event Handler, in this case, will be ” shut-session”.

switch1(config)#event-handler shut-session

2. Define the trigger action: 

While still in the event handler context enter the below command. In simple terms, the below logic says, when the “EVENT_COUNT” is greater than 0 run the CLI command “no monitor session 1”.

*The event count will be incremented when the trigger condition is met that we will create in a later step.

switch1(config-handler-shut-session)#action bash if [ $EVENT_COUNT -gt 0 ] ;then FastCli -p15 -c $’conf\n no monitor session 1′;fi

3. Define the delay in seconds before running the action:

*This is the time to wait to run the action after the trigger has been met. While still in the event handler context enter the below command that says wait 1 second before executing.

switch1(config-handler-shut-session)# delay 1

4. Enter the “asynchronous” command:

While still under the event-handler context. The asynchronous command specifies that the action is to run immediately after the delay period, instead of being queued till previous triggered actions finish:

switch1(config-handler-shut-session)# asynchronous

5. Define the trigger:

Then the below-defined trigger when met will execute the action from Step2:

 The below bash command is using the Linux awk command to parse the output of the ‘show interface counters rates’ command. It grabs the line from the output starting with “/Et11/” and prints the decimal value of column 7, which is the “Out Mbps” column, from that line. It then looks at the value of column 7 and check to see if it is over 500Mbps. If the criteria is met the trigger is fired.

switch1(config-handler-shut-session)# trigger on-counters
switch1(config-handler-shut-session-counters)# poll interval 2 switch1(config-handler-shut-session-counters)# condition bashCmd."FastCli -c 'show interface counters rates' | awk '/Et11/{printf \"%d\\n\", $7}'" > 500

 

6. Verify that the above configuration:

Let’s verify we are  looking at the correct values from the “show interface counters rates” output:

To manually check the value of the column in question to verify that you are looking at the correct data you can execute the following commands

The command with its native output: 

*nz  below specifies display non zero values only

switch1# show interface counters rates | nz     

 

 

7. Let’s verify that the mirror session is active:

8. Now let’s test our Event Handler:

Now that everything is configured with the custom Event Handler lets monitor traffic and verify that the mirror session shuts down when traffic exceeds 500MBs outbound on Ethernet11.

a. To do this we will run the following command. This command will actually run the command in real time continuously so you do not have to keep entering it. Notice that the changes are highlighted as they occur. Let’s monitor this till we see the “Out Mbps” exceed 500 and then check that the trigger threshold was met.

b. The trigger threshold has been reached in the below output. Now let’s make sure the monitor session has been removed.

 

9. Verify that the desired behavior was achieved when the trigger threshold was met:

 

Follow

Get every new post on this blog delivered to your Inbox.

Join other followers: