Embedded Event manager:
What is EEM ?:
EEM (Embedded Event manager is a software component of cisco IOS, XR, and NX-
OS
EEM gives you high abilities to admin your cisco device by tracking and monitoring
events that take place on your Cisco device and then apply action you already decided
early , EEM by giving you this ability , it allow you to automate many tasks .
EEM Types:
There are two EEM independent pieces (types): Applets and Scripting
-> Applets are a collection of CLI commands
-> Scripts are actions coded up in TCL(interpreter language)
I will give 11 examples for applets and lets put in our minds that we can have Only one
event per applet with single or Multiple actions run in sequence.
EEM Event detectors:
EEM use Event detectors to understand that event occured, some of these dectectors
are :
SNMP:-Monitoring SNMP objects.
Syslog:-Responds to various syslog messages, allowing for matching on regular
expressions.
Counter: Monitoring and responding to interface counter when cross threshold settings.
CLI events: Screening CLI input for a regular expression match.
None: This event detector is use to test EEM script/applet using "event manager run"
command.
Timers:(Countdown, watchdog and CRON)
IP SLA and Net flows events.
EEM Actions:
EEM can take many actions once event happens , actions could be :
Sending a email messages
Executing or disabling a cisco command.
Generating SNMP traps
Reloading the router
Generating priotized syslog messages
Switching to a secondary processor in a redundant platform
Requesting system information when an event occurs (like sh tech,sh proccess
cpu history).
Common regular expressions:
during creating your EEM Applet you can use some regular expressions , the
following are common used ones :
^ = Start of string
$ = End of string
. = Any single character
* = Zero or more instances
+ = One or more instance
? = Zero or one instance
How to write EEM applet ?:
you write three pieces of information in your applet.
first you will give (Applet Name) then you will decide what (Event Detector) will
be used to detect specific event then finally what (Actions) you would like to
automatically run once this event occur
what if i do not want actions run automatically ?
you can write emm applet so eem applet so it will be manual triggerd , this can
be done using event none , as you will see later in examples
example one :
Lets create manually triggerd applet , once we run it will trun router interface up
and give it ip address .
R1(config)#event manager applet set_ip
(this commands create EEM applet with name set_ip )
R1(config-applet)#event none sync yes
(event none mean this eem applet is to be manual trigger
sync yes mean run the commands synchronously which mean run each command and
wait tell it execute then run the nest one.)
now we start typing our Actions which will be like this
1.0 is just number of actions and better to use gaps between numbers so maybe you
return back to add another missing action
cli mean we will use cli to type a command , this command will be typed on your behalf .
command "enable" is your command
R1(config-applet)#action 1 cli command "enable"
R1(config-applet)#action 2 cli command "config t"
R1(config-applet)#action 3 cli command "interface fa0/0"
R1(config-applet)#action 4 cli command "ip add 10.1.1.1 255.255.255.0"
R1(config-applet)#action 5 cli command "no sh"
R1(config-applet)#action 6 cli command "end"
R1(config-applet)#exit
finally once you want to run this EEM Applet , just type the following command :
R1#event manager run set_ip
you can run R1#show event manager policy available , to see the eems in your router.
example two:
lets create manually triggerd EEM applet which show a syslog message once we
run it
R1(config)#event manager applet cbtme
R1(config-applet)#event none
R1(config-applet)#action 1.0 syslog msg "cbtme welcome you"
R1(config-applet)#end
R1#event manager run cbtme
R1#
*Mar 1 00:07:47.731: %HA_EM-6-LOG: cbtme: cbtme welcome you
R1#
example three:
this eem will save configurtaion , show console message about going to reload
the router and then reload the router
R1(config)#event manager applet reload
R1(config-applet)#event none sync yes
R1(config-applet)#action 1.0 cli command "enable"
R1(config-applet)#action 2.0 cli command "wr"
R1(config-applet)#action 3.0 syslog msg "router about to relaod"
R1(config-applet)#action 4.0 reload (note no "" since its avilable as command if you type
action 4.0 ?)
R1(config-applet)#exit
R1#event manager run reload
example four:
lets create automatically running EEM applet which once fas0/0 goes down will
make router return it back and then send email to admin
R1(config-applet)#event syslog pattern "Interface FastEthernet0/0, changed state to
administratively down"
R1(config-applet)#action 1.0 cli command "enable"
R1(config-applet)#action 1.5 cli command "config t"
R1(config-applet)#action 2.0 cli command "int fas 0/0"
R1(config-applet)#action 2.5 cli command "no sh"
R1(config-applet)#action 3.0 cli command "end"
R1(config-applet)#action 3.5 cli command "who"
R1(config-applet)#action 4.0 mail server "11.0.0.2" to "info@yasserauda.com" from
" eem@cisco.com" subject "kokowawa" body "current users $_cli_result"
R1(config-applet)#exit
ok in Part two of this Document i will show you more
including how disable some routers commands , use EEM for backup links , creating
event manager environment for emails and more .
Yasser Auda
Certified Cisco Systems Instructor CCSI # 34215
