EEM Applet - Teach your router to monitor itself

Faced with a small system and a smaller budget?  No space to put up a server that can collect performance data?  Does your corporate procurement process keep pushing the delivery of your monitoring system to the right? How about letting your router monitor itself?  This simple applet will run every 5 minutes and capture your 5 minute output rate and outbound queue drops for the specified interfaces.

!Tested with a Cisco 1841 running 15.1T Advanced Enterprise Services.
event manager applet CONGESTION-TRACKER
 event timer cron name every 5_MINUTES cron-entry "*/5 * * * *"
 action 1.0010     set interfaces "FastEthernet0/0,FastEthernet0/1/0"
 action 1.0020     cli command "enable"
 action 1.0030     foreach iface "$interfaces" ","
 action 1.0030.010  cli command "sho interfaces $iface | i Input queue"
 action 1.0030.020  set outdrop "0"
 action 1.0030.030  set result "none"
 action 1.0030.040  regexp "Total output drops: ([0-9]+)" "$_cli_result" result outdrop
 action 1.0030.050  cli command "sho interfaces $iface | i Output queue"
 action 1.0030.060  set outqueuedrop "0"
 action 1.0030.070  regexp "Output queue: [0-9]+/[0-9]+/([0-9]+)" "$_cli_result" result outqueuedrop
 action 1.0030.080  add $outdrop $outqueuedrop
 action 1.0030.090  set drops "$_result"
 action 1.0030.100  set outrate "0"
 action 1.0030.110  cli command "sho interfaces $iface | i output rate"
 action 1.0030.120  regexp "output rate ([0-9]+) bits" "$_cli_result" result outrate
 action 1.0030.130  puts "Output Update $iface: Current_rate=$outrate, Drops=$drops"
 action 1.0040     end
 action 1.0050     exit

It works by using the Cisco Embedded Event Manager Applet feature.  The event is schedule to run every 5 minutes using cron.  It then sets the interfaces that are going to be monitored as a variable named "interfaces".  You can add more interfaces by adding a comma and the new interface name.
The applet will run a loop for every interface in the array, interfaces, which it calls iface.  Show interfaces is then filtered to find the 5 minute output average and add together the two locations where outbound queue drops can be found.  The output is set into the syslog so if you do not have a syslog server, you may want to specify a larger logging buffer with "logging buffered XXXX".
The information can then be pulled over time and seen with "show log".  You can then run an external script to put the data into a database or graph.  Or read it directly if you are just interested to know what level or times you are having peek traffic.

One great modification to this may be to create a complementary applet that collects the averages out of the logs and emails them to you once daily.   Maybe a future post...