EEM applet not triggering when interface state changes

[jsilver-jiga]

I'm testing an EEM applet on an IOS-XE switch and I'm having trouble getting it to trigger when an interface changes state.

The basic event I'm testing is an interface state change, and the applet should simply write a syslog message when the event occurs. The interface itself changes state normally, but I'm not seeing the expected EEM action.

I've already checked that EEM is enabled and that the applet is present in the configuration.

What commands would you normally use to troubleshoot whether the EEM event detector is actually seeing the interface-state event?

I'm particularly interested in the best way to verify the event registration and see whether EEM is receiving the event before I start changing the applet itself.

[aleabrahao]

@jsilver-jiga 

Can you try these commands and show us the result?

show event manager policy registered
show event manager statistics policy
debug event manager detector all
debug event manager server event
monitor terminal

[Leo Laohoo]

---

@jsilver-jiga wrote:
The basic event I'm testing is an interface state change, and the applet should simply write a syslog message when the event occurs. 

---

Wut?  Is link-logging on the interface disabled?

[liviu.gheorghe]

Hi @jsilver-jiga ,

you don't need EEM to generate a syslog message when the interface changes state, you just need to configure logging to your syslog server:

logging host <IP address of syslog server>

Hope this helps.

[Jens Albrecht]

Hi @jsilver-jiga,

you did not mention the platform and software version and you also did not mention how you try to detect the event.

The good old method uses syslog messages:

event manager applet EEM-Gi1-0-5-Link-Up-Down
 description Log Gi1/0/5 link state transitions
 event syslog pattern "%LINK-3-UPDOWN: Interface GigabitEthernet1/0/5, changed state to (up|down)"
 action 1.0 syslog priority notifications msg "EEM: Gi1/0/5 physical link change: $_syslog_msg"

This method requires you to exactly match the syslog pattern.
So any typo will render it useless and this pattern can e.g. not detect if a port goes into err-disabled state or is shutdown.
The easiest way to avoid typos is to generate the desired syslog message and then copy it into your applet.

Newer hardware and software allows you to detect link-events via neighbor-discovery:

event manager applet EEM-Gi1-0-7-Link-Event
 description Log Gi1/0/7 link state transitions
 event neighbor-discovery interface GigabitEthernet1/0/7 link-event all
 action 1.0 syslog priority notifications msg "EEM: $_nd_short_local_intf_name physical link state changed to $_nd_intf_linkstatus"

Beside 'link-event all' which catches all state changes, you can also explicitly look for specific state changes if you want.

On a Catalyst 9200 running IOS-XE 17.9.7 you get the following output:

Syslog msg:
*Sep 13 15:43:16.515: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/5, changed state to down
*Sep 13 15:43:17.517: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/5, changed state to down
*Sep 13 15:43:17.523: %HA_EM-5-LOG: EEM-Gi1-0-5-Link-Up-Down: EEM: Gi1/0/5 physical link change:
*Sep 13 15:43:17.517: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/5, changed state to down

Link-event:
*Sep 13 15:43:27.927: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/7, changed state to up
*Sep 13 15:43:27.937: %HA_EM-5-LOG: EEM-Gi1-0-7-Link-Event: EEM: Gi1/0/7 physical link state changed to up
*Sep 13 15:43:28.928: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/7, changed state to up

*Sep 13 15:43:47.284: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/7, changed state to down
*Sep 13 15:43:48.285: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/7, changed state to down
*Sep 13 15:43:48.294: %HA_EM-5-LOG: EEM-Link-State-Change-2: EEM: Gi1/0/7 physical link state changed to down

*Sep 13 15:44:00.077: %LINK-5-CHANGED: Interface GigabitEthernet1/0/7, changed state to administratively down
*Sep 13 15:44:00.084: %HA_EM-5-LOG: EEM-Link-State-Change-2: EEM: Gi1/0/7 physical link state changed to admindown

HTH!