Understanding Cisco EEM by examples Part 1

    What is EEM ?:

    EEM (Embedded Event manager is a software component of cisco IOS, XR, and NX-OS


    EEM gives you high abilities to admin your cisco device by tracking and monitoring events that take place on your Cisco device and then apply action you already decided early , EEM by giving you this ability , it allow you to automate many tasks .


    EEM Types:

    There are two EEM independent pieces (types): Applets and Scripting

    -> Applets are a collection of CLI commands

    -> Scripts are actions coded up in TCL(interpreter language)


    I will give 11 examples for applets and lets put in our minds that we can have Only one event per applet with single or  Multiple actions run in sequence.



    EEM Event detectors:

    EEM  use Event detectors to understand that event occured, some of these dectectors are :


    SNMP:-Monitoring SNMP objects.



    Syslog:-Responds to various syslog messages, allowing for matching on regular expressions.


    Counter: Monitoring and responding to interface counter when cross threshold settings.


    CLI events: Screening CLI input for a regular expression match.


    None: This event detector is use to test EEM script/applet using "event manager run" command.


    Timers:(Countdown, watchdog and CRON)


    IP SLA and Net flows events.



    EEM Actions:

    EEM can take many actions once event happens , actions could be :

    • Sending a email messages
    • Executing or disabling a cisco command.
    • Generating SNMP traps
    • Reloading the router
    • Generating priotized syslog messages
    • Switching to a secondary processor in a redundant platform
    • Requesting system information when an event occurs(like sh tech,sh proccess cpu history).



    Common regular expressions:


    during creating your EEM Applet you can use some regular expressions , the following are common used ones :

    ^ = Start of string

    $ = End of string

    . = Any single character

    * = Zero or more instances

    + = One or more instance

    ? = Zero or one instance



    How to write EEM applet ?:

    you write three pieces of information in your applet.

    first you will give (Applet Name) then you will decide what (Event Detector) will be used to detect specific event then finally what (Actions) you would like to automatically run  once this event occur .


    what if i do not want actions run automatically ?

    you can write emm applet so eem applet so it will be manual triggerd , this can be done using event none , as you will see later in examples


    example one :

    Lets create manually triggerd applet , once we run it will trun router interface up and give it ip address .


    R1(config)#event manager applet set_ip

    (this commands create EEM applet with name set_ip )

    R1(config-applet)#event none sync yes

    (event none mean this eem applet is to be manual trigger

    sync yes mean run the commands synchronously which mean run each command and wait tell it execute then run the nest one.)


    now we start typing our Actions which will be like this

    1.0 is just number of actions and better to use gaps between numbers so maybe you return back to add another missing action

    cli mean we will use cli to type a command , this command will be typed on your behalf .

    command "enable" is your command

    R1(config-applet)#action 1 cli command "enable"

    R1(config-applet)#action 2 cli command "config t"

    R1(config-applet)#action 3 cli command "interface fa0/0"

    R1(config-applet)#action 4 cli command "ip add"

    R1(config-applet)#action 5 cli command "no sh"

    R1(config-applet)#action 6 cli command "end"



    finally once you want to run this EEM Applet , just type the following command :

    R1#event manager run set_ip


    you can run R1#show event manager policy  available , to see the eems in your router.


    example two:

    lets create manually triggerd EEM applet  which show a syslog message once we run it

    R1(config)#event manager applet cbtme

    R1(config-applet)#event none

    R1(config-applet)#action 1.0 syslog msg "cbtme welcome you"



    R1#event manager run cbtme


    *Mar  1 00:07:47.731: %HA_EM-6-LOG: cbtme: cbtme welcome you



    example three:

    this eem will save configurtaion , show console message about going to reload the router and then reload the router


    R1(config)#event manager applet reload

    R1(config-applet)#event none sync yes

    R1(config-applet)#action 1.0 cli command "enable"

    R1(config-applet)#action 2.0 cli command "wr"

    R1(config-applet)#action 3.0 syslog msg "router about to relaod"

    R1(config-applet)#action 4.0 reload (note no "" since its avilable as command if you type action 4.0 ?)



    R1#event manager run reload


    example four:

    lets create automatically running EEM applet which once fas0/0 goes down will make router return it back and then send email to admin


    R1(config-applet)#event syslog pattern "Interface FastEthernet0/0, changed state to administratively down"

    R1(config-applet)#action 1.0 cli command "enable"

    R1(config-applet)#action 1.5 cli command "config t"

    R1(config-applet)#action 2.0 cli command "int fas 0/0"

    R1(config-applet)#action 2.5 cli command "no sh"

    R1(config-applet)#action 3.0 cli command "end"

    R1(config-applet)#action 3.5 cli command "who"

    R1(config-applet)#action 4.0 mail server "" to "info@yasserauda.com" from " eem@cisco.com" subject "kokowawa" body "current users $_cli_result"



    ok in Part two of this Document i will show you more

    including how disable some routers commands , use EEM for backup links , creating event manager environment for emails  and more .


    Yasser Auda

    Certified Cisco Systems Instructor  CCSI #  34215