Automation and Artificial Intelligence · Topic 6 of 7

Embedded Event Manager Applets

Build Embedded Event Manager applets on IOS XE: syslog and timer events, CLI actions, manual runs, and the commands that verify and debug them.

6 min

In a nutshell

EEM runs applets that consist of an event and actions.
An applet is created with event manager applet NAME.
event syslog pattern triggers on a log message, and event timer cron triggers on a schedule.

What it is

Embedded Event Manager (EEM) lets a Cisco device react to events on its own, by running a script that you write in the configuration.

An applet has two parts. An event says what to watch for, such as a syslog message or a time.

An action says what to do, such as run commands or log a message. This turns the router into its own automation engine.

How it works

An applet is created in global configuration mode, and its actions run in order.

Applet structure

Router(config)# event manager applet LINK-DOWN-ALERT
Router(config-applet)# event syslog pattern "Interface GigabitEthernet0/1, changed state to down"
Router(config-applet)# action 1.0 syslog msg "Uplink Gi0/1 went down"

The name follows event manager applet.

The event line says what triggers it. Each action line has a label, which is a number such as 1.0, followed by the action type and its arguments. Actions run in the order of their labels, sorted as strings, so keep the numbering consistent.

Common event detectors

Event	Triggers on
`event syslog pattern "TEXT"`	A syslog message that matches the pattern
`event timer cron cron-entry "0 2 * * *"`	A schedule, using cron syntax
`event timer watchdog time 300`	A repeating timer, in seconds
`event cli pattern "TEXT" sync yes`	A command typed at the command line
`event none`	Nothing, so the applet runs only when you start it by hand

The pattern for a syslog event is a regular expression that is matched against the message text. A pattern that is too general can trigger far more often than you want.

Common actions

Action	Use
`action N cli command "TEXT"`	Run an IOS command
`action N syslog msg "TEXT"`	Write a message to the log
`action N set VARIABLE VALUE`	Set a variable
`action N puts "TEXT"`	Print text to the console
`action N info type routername`	Read a value, such as the host name

CLI actions work like a person typing. You must enter configuration mode first, and enter each mode in turn.

Automating configuration

This applet shuts down an interface when a syslog message shows a problem on it. It could be used for a flapping port.

Router(config)# event manager applet SHUT-FLAPPING
Router(config-applet)# event syslog pattern "LINEPROTO-5-UPDOWN.*GigabitEthernet0/2.*down"
Router(config-applet)# action 1.0 cli command "enable"
Router(config-applet)# action 2.0 cli command "configure terminal"
Router(config-applet)# action 3.0 cli command "interface GigabitEthernet0/2"
Router(config-applet)# action 4.0 cli command "shutdown"
Router(config-applet)# action 5.0 syslog msg "EEM shut down Gi0/2"

Each CLI line is a separate action, and the labels set the order. The interface is entered in action 3.0 and shut down in action 4.0.

Automating data collection

Collect output at a set time and keep it for later.

Router(config)# event manager applet NIGHTLY-ROUTES
Router(config-applet)# event timer cron cron-entry "0 2 * * *"
Router(config-applet)# action 1.0 cli command "enable"
Router(config-applet)# action 2.0 cli command "show ip route | append flash:routes.txt"

The schedule uses five cron fields. This one means 02:00 every day. The output is appended to a file in flash, so you build up a history.

Automating troubleshooting

An applet can capture data at the moment a fault appears. For example, when a routing neighbour is lost, it can run the show commands that help to explain why, and write them to a file or the log. This keeps evidence that would disappear by the time you log in.

Running by hand

An applet with event none does not start by itself.

Router(config)# event manager applet RUN-CHECK
Router(config-applet)# event none
Router(config-applet)# action 1.0 cli command "enable"
Router(config-applet)# action 2.0 cli command "show version"
Router# event manager run RUN-CHECK

This is handy for testing an applet before you attach a real trigger to it.

Verifying and debugging

Router# show event manager policy registered
Router# show event manager history events
Router# debug event manager action cli

show event manager policy registered lists the applets and their events. show event manager history events shows when each applet last ran and whether it worked. The debug command shows the CLI actions as they execute, so you can see where a step fails.

Good practice

Test with event none and event manager run first.
Make the event pattern as specific as possible.
Write a syslog message in your applet, so that you can see when it ran.
Keep the actions short, and avoid commands that wait for input.

What to remember for the exam

Eight facts cover most questions on this topic.

EEM runs applets that consist of an event and actions.
An applet is created with event manager applet NAME.
event syslog pattern triggers on a log message, and event timer cron triggers on a schedule.
event none creates an applet that runs only with event manager run NAME.
Actions are numbered, and they run in label order.
action N cli command runs an IOS command, and you must enter configuration mode in steps.
action N syslog msg writes a log message.
show event manager policy registered and show event manager history events verify applets.

Exam tip

When an applet changes configuration, read the CLI actions in order. First comes enable, then configure terminal, then the interface, then the command.

Common mistakes

These four mistakes appear often.

Forgetting to enter configuration mode. A configuration command inside a CLI action fails without configure terminal.

Using a pattern that is too broad. The applet runs more often than you intend.

Leaving out enable. CLI actions may start in user mode.

Using out of order labels. Labels are sorted as text, so 10.0 may run before 2.0.

Watch out

An applet that changes configuration can lock you out if it shuts the wrong interface, so test it on a lab device first.

Check yourself

Work through these three questions.

What are the two parts of an EEM applet?
An event that says what to watch for, and actions that say what to do.
Which event type makes an applet run only when you start it by hand?
event none, started with event manager run NAME.
Why does a configuration applet start with enable and configure terminal actions?
CLI actions work like typed commands, so the applet must enter privileged and configuration mode before the commands it needs.

Topic 6 of 7 in Automation and Artificial Intelligence

Test yourself on Automation and Artificial Intelligence

The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.