How can memory utilization events on Cisco switches display what the instance name is? (Legacy KB ID CNC TS32029 )

Document ID : KB000051851
Last Modified Date : 14/02/2018
Show Technical Document Details

This solution only works for devices that support the Cisco-Memory-Pool-MIB. 

You will need to modify the EventDisp file in the <SPECROOT>/custom/Events directory and add the following section:

# when we receive a high memory utilization event, try to enhance the

# event with the name of the memory pool, then create a new event,

# 0xffff0f06, which contains that name in varbind 13 (In this example, we use the index

# (3) + 10, to not clash with other varbinds here)


# The event is generated on the device, but the attributes live on

# the mem app model.  The procedure first checks all models associated

# to the device via the 'Manages' association, and processes the one

# which is of the correct type (0x21006c, Cisco_Mem_App)

# It then reads the memory pool name (0x210a5d) with the correct varbind

# (ie,  varbind id 3), and puts the resulting value in varbind 13, and it also

# retains all other varbinds of the original event

0x00010f06 E 50 P " \

ForEach( \

GetModelsByRelationName( \


{ S \"Manages\" }, \


{ Variable applicationModelHandle }, \

{ Variable unused }, \

{ I 0 }, \

If( \

Equals( \

ReadAttribute( \

{ V applicationModelHandle }, \

{ H 0x10001 } ), \

{ H 0x21006c } ), \

CreateEventWithAttributes( \


{ H 0xffff0f06 }, \

SetEventAttribute( \

GetEventAttributeList(), \

{ U 13 }, \

ReadAttributeInstance( \

{ V applicationModelHandle }, \

{ H 0x210a5d }, \

GetEventAttribute( { U 3 } )))), \


# create memory threshold exceeded alarm, with

# same event info as in the 0x10f06 event, plus

# the memory pool name in variable 13

0xffff0f06 E 50 A 2,0x10f06

Save the file.

Copy the following text into a file named Eventffff0f06 and then place the Eventffff0f06 file in the <SPECROOT>/custom/Events/CsEvFormat directory. You can modify the text to meet your needs, just make sure that the {S 13} entry is in there:

{d "%w- %d %m-, %Y - %T"} - High Memory Utilization.  The Memory Utilization of {C 1}% for Memory instance {C 3} which is named {S 13} has exceeded the {C 0}% threshold on model {m} for more than the acceptable time period. (event [{e}])

Once you have made these modifications, navigate to the Start Console page for OneClick (http://machinename) and click on the Administration link. Click on the EvFormat/CsPCause Configuration on the left and click on the Reload button.

Then, in OneClick, navigate to the VNM model. In the information view, select SpectroSERVER Control. Click on the "Update Event Configuration" button.

Once complete the next memory alarm you see will have the name of the instance in the event.



Related Issues/Questions:
How can memory utilization events on Cisco switches display what the instance name is?

Tue 19 May, 2009 - 12:49:17 - High Memory Utilization. The Memory Utilization of 90% for Memory instance 3 has exceeded the 85% threshold on model <name>  for more than the acceptable time period. (event [0x00010f06])

Can events in OC show the name of the instance instead of just instance 1 for Cisco memory utilization alarms?

Problem Environment:

Causes of this problem:
The instance value needs to be read off the device and placed into an event condition rule to be displayed in OneClick. Please note that this solution only works for Cisco devices that support the Cisco-Memory-Pool-MIB

Additional Information:
Please keep in mind that if you have many Cisco devices with lots of memory thresholds set, you could see a spike in your cpu or memory utilization because of the processing this causes.
You can use a different hex number instead of ffff0f06 if need be.

(Legacy KB ID CNC TS32029 )