ArubaOS-CX NAE: Scripts, Agents and Alerting

Most switch monitoring is external: SNMP polling every few minutes, a threshold nobody tunes, and an alert that tells you a port went down after the fact. ArubaOS-CX ships the Network Analytics Engine (NAE) inside the switch, with no licence and no extra software. NAE runs Python script agents that watch internal database values, raise alerts when they drift out of range, keep a time-series graph of what happened, and can even take corrective action. This guide explains the model, how to get scripts onto the switch, and the error messages you will meet on day one.

What NAE Gives You on the Switch Itself

The framework is made of four pieces of platform, and understanding them explains its limits:

• A configuration and state database — the switch's own source of truth, which NAE agents can read (and, with rights, act on).
• A time-series database — every monitor writes data points here, which is what you see on the Analytics graph in the Web UI.
• The AOS-CX REST API — scripts reach switch data through REST URIs.
• Python sandboxes — each agent runs isolated, which is why a runaway script cannot take the switch down but can hit a sandbox timeout.

The Four Building Blocks: Monitor, Rule, Condition, Action

Every NAE script follows the same logical structure, and confusing these terms makes debugging much harder than it needs to be:

The agent also plots an automatically generated time-series graph, with configuration checkpoints marked on the timeline — that pairing of "metric moved" and "config changed" is the part that saves hours in a post-incident review.

Uploading Scripts and Creating Agents

There are exactly two supported paths, plus one special case:

1. Web UI (Analytics section): upload the script, then create an agent from it and pick the parameters — this is where base64 conversion and syntax validation happen automatically.
2. REST API: useful for automation and for keeping scripts in version control. The file content must be base64-encoded in the request body.
3. NAE-Lite: scripts written directly in the CLI, which AOS-CX itself converts into Python. They are visible and editable as Python in the Web UI, which makes them a good starting point for engineers who prefer CLI to code.

Creating, deleting, enabling or reconfiguring agents requires administrator authority, because agents can execute CLI commands as remediation. Agents that need to execute commands on the switch must have the right privileges — an agent running with insufficient authority fails at the action step, not at the monitor step.

# List what is on the switch (exact syntax varies by AOS-CX release; see the NAE Guide for your version)
show nae-script
show nae-agent
show running-config | include nae

Writing an Agent That Does Not Misbehave

The NAE Guide documents design constraints that are easy to ignore in a lab and expensive in production: resource usage grows with the number of agents and monitors, and each agent's monitors poll on their own interval. Practical rules:

• Monitor the smallest useful set of URIs; one agent per resource class rather than one per interface where possible.
• Use sensible intervals — a one-second monitor on 48 interfaces fills the time-series database and burns CPU for data nobody reads.
• Make remediations idempotent and log them; an action that flips a port state on every poll causes an outage loop, not a fix.

Common NAE Errors and What They Mean

Where NAE Fits With Your Existing Monitoring

NAE is not a replacement for a central NMS — it is the on-switch early warning layer that can react in seconds without waiting for a polling cycle. The usual split: NAE handles per-switch, high-frequency conditions and immediate remediation (interface flapping, sudden CPU/queue spikes, VSF/VSX membership loss); the central platform keeps the long retention, cross-device correlation and on-call routing. Keep scripts in Git, export them with the rest of the config, and review them when AOS-CX is upgraded, since URI availability changes between releases.

相关阅读：ArubaOS-CX REST API 与 Postman 自动化、ArubaOS-CX VSX 脑裂：ISL、Keepalive 与恢复 以及 ArubaOS-CX Access 与 Trunk 端口验证。

原文链接：HPE Aruba Networking Developer Hub - Getting Started with NAE