cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Cisco EEM Basic Overview and Sample Configurations

77341
Views
53
Helpful
26
Comments

 

Introduction:

The EEM(Embedded Event manager is a software component of cisco IOS, XR, and NX-OS makes life easier for administrators by tracking and classifying events that take place on a router and providing notification options for those events. EEM allows you to automate tasks, perform minor enhancements and create workarounds.


There are two independent pieces: Applets and Scripting
-> Applets are a collection of CLI commands
-> Scripts are actions coded up in TCL(interpreter language)

EEM uses event detectors and actions to provide notifications of those events:

EEM detectors can be:
1) SNMP:-Monitoring SNMP objects.
2) Syslog:-Responds to various syslog messages, allowing for matching on regular expressions.
3) Counter: Monitoring and responding to interface counter when cross threshold settings.
4) CLI events: Screening CLI input for a regular expression match.
5) None: This event detector is use to test EEM script/applet using "event manager run" command.
6) Timers :(Countdown, watchdog and CRON)
7) IP SLA and Netflows events.

 

Common regular expressions:

^  =  Start of string

$  =  End of string

.   =  Any single character

*  =  Zero or more instances

+ =  One or more instance

?  =  Zero or one instance

 

EEM Actions can be:


1)Sending a email messages
2)Executing a cisco command.
3)Generating SNMP traps
4)Reloading the router
5)Generating priotized syslog messages
6)Switching to a secondary processor in a redundant platform
7)requesting system information when an event occurs(like sh tech,sh proccess cpu history).

Sample EEM Scripts:

A) Syslog Event detector:
This example shows the syslog event detector. When the ISP1 interface has been shutdown, the below applet run to turn on the interface and send the alert to the below mention mail id with logged in users information.

 

Configuration:

event manager applet interface_Shutdown
event syslog pattern "Interface FastEthernet1/0, changed state to administratively down"
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface fa1/0"
action 2.5 cli command "no shutdown"
action 3.0 cli command "end"
action 3.5 cli command "who"
action 4.0 mail server "192.168.1.1" to ".engineer@cisco.com." from ".EEM@cisco.com." subject ".ISP1_Interface_fa1/0_SHUT." body "Current users $_cli_result"

 

Enabling debug detector to get closer view and shutdown the interface fa1/0.

 

R1#debug event manager action cli
Debug EEM action cli debugging is on
R1#conf tEnter configuration commands, one per line.  End with CNTL/Z.R1(config-if)#int fa1/0
R1(config-if)#sh


*Nov 17 23:06:24.215: %LINK-5-CHANGED: Interface FastEthernet1/0, changed state to administratively down
*Nov 17 23:06:24.283: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : CTL : cli_open called.
*Nov 17 23:06:24.295: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1>
*Nov 17 23:06:24.299: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN  : R1>enable
*Nov 17 23:06:24.319: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1#
*Nov 17 23:06:24.319: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN  : R1#config t
*Nov 17 23:06:24.343: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : Enter configuration commands, one per line.  End with CNTL/Z.
R1(config-if)#
*Nov 17 23:06:24.347: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1(config)#
*Nov 17 23:06:24.347: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN  : R1(config)#interface fa1/0
*Nov 17 23:06:24.467: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1(config-if)#
*Nov 17 23:06:24.467: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN  : R1(config-if)#no shutdown
*Nov 17 23:06:24.587: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1(config-if)#
*Nov 17 23:06:24.587: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN  : R1(config-if)#end
*Nov 17 23:06:24.643: %SYS-5-CONFIG_I: Configured from console by  on vty0 (EEM:interface_Shutdown)
*Nov 17 23:06:24.655: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1#
*Nov 17 23:06:24.655: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN  : R1#who
*Nov 17 23:06:24.727: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :     Line       User
R1(config-if)#Host(s)              Idle       Location
*Nov 17 23:06:24.731: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :    0 con 0                idle                 00:00:02
*Nov 17 23:06:24.731: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : *  2 vty 0                idle                 00:00:00 EEM:interface_Shutdown
*Nov 17 23:06:24.735: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
*Nov 17 23:06:24.735: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :   Interface    User               Mode         Idle     Peer Address
*Nov 17 23:06:24.735: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
*Nov 17 23:06:24.739: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1#
R1(config-if)#
*Nov 17 23:06:26.487: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to up

 

B) CLI Event detector:
In this example applet has created to stop "debugging" command on the CLI. If anyone enter the debug command it will have no effect, also clock and user’s information will be stored in flash.

 

Configuration:

event manager applet Stop_Debug
event cli pattern "debug" sync no skip yes
action 1.0 cli command "enable"
action 2.0 cli command "sh users | append flash:Debug"
action 3.0 cli command "sh clock | append flash:Debug_clock"

 

Verification:

Checking the registered applet with following command:

 

R1#sh event manager policy registered
No.  Class   Type    Event Type          Trap  Time Registered           Name
1    applet  user    cli                 Off   Fri Mar 1 00:08:05 2002   Stop_Debug
pattern {debug} sync no skip yes
maxrun 20.000
action 1.0 cli command "enable"
action 2.0 cli command "sh users | append flash:Debug"
action 3.0 cli command "sh clock | append flash:Debug_clock"

R1#debug all
R1#debug event manager action cli
R1#sh debugging......(Not showing any debug running on device)

R1#sh flash:
System CompactFlash directory:
File  Length   Name/status
1   1614     Debug.....(User info is append to flash)
2   204      Debug_clock......(Clock time when debug entered is also append to flash)
R1#more flash:Debug
Line       User       Host(s)              Idle       Location
0 con 0                idle                 00:00:00
* 66 vty 0             idle                 00:00:00    XYZ
Interface   User      Mode                 Idle     Peer Address


R2#more flash:Debug_Clock
12:43:15.263 UTC Sun Nov 18 2012
R2#

 

C) Interface Events:

In this example applet is configure to measure rxload on the interface.

 

Two applets are configure:

1) When Rx load is above 50% then router will apply access-list on the interface fa0/1 to allow only important traffic and block the unwanted traffic.
2) When Rx load goes below 25, the router will remove applied access-list from the interface fa0/1 to allow all traffic.

 

Configuration:

event manager applet Interface_Load_UP
event tag 1 interface name FastEthernet1/0 parameter rxload entry-op gt entry-val 127 entry-type value poll-interval 30
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "int fa1/0"
action 1.3 cli command "ip access-group IMP_TRAFFIC in "
action 1.4 cli command "end"
event manager applet Interface_Load_Down
event tag 1 interface name FastEthernet1/0 parameter rxload entry-op lt entry-val 25 entry-type value poll-interval 30
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "int fa1/0"
action 1.3 cli command "no ip access-group IMP_TRAFFIC in "
action 1.4 cli command "end"

 

Verification:

 

R1#sh int fa1/0 | in load
     reliability 255/255, txload 1/255, rxload 1/255..(Rxload is 1)
R1#debug event manager action cli
Debug EEM action cli debugging is on
R1#sh int fa1/0 | in load
     reliability 255/255, txload 139/255, rxload 139/255....(Rxload is increase more 50% i.e.139)
R1#(As soon Rxload increase by 50%, causing to triggered 1 st event)
*Nov 18 02:19:55.403: %HA_EM-6-LOG: Interface_Load : DEBUG(cli_lib) : : CTL : cli_open called.
*Nov 18 02:19:55.423: %HA_EM-6-LOG: Interface_Load : DEBUG(cli_lib) : : OUT : R1>
*Nov 18 02:19:55.427: %HA_EM-6-LOG: Interface_Load : DEBUG(cli_lib) : : IN  : R1>enable
 : R1#conf t
 : R1(config)#int fa1/0
 : R1(config-if)#ip access-group IMP_TRAFFIC in....(Access-list apply to interface)
*Nov
R1#18 02:19:55.827: %HA_EM-6-LOG: Interface_Load : DEBUG(cli_lib) : : OUT : R1(config-if)#
*Nov 18 02:19:55.831: %HA_EM-6-LOG: Interface_Load : DEBUG(cli_lib) : : IN  : R1(config-if)#end
*Nov 18 02:19:55.839: %SYS-5-CONFIG_I: Configured from console by  on vty0 (EEM:Interface_Load)
*Nov 18 02:19:55.851: %HA_EM-6-LOG: Interface_Load : DEBUG(cli_lib) : : OUT : R1#
*Nov 18 02:19:55.855: %HA_EM-6-LOG: Interface_Load : DEBUG(cli_lib) : : CTL : cli_close called.
R1#sh ip access-lists
Extended IP access list IMP_TRAFFIC
10 permit tcp any any eq www
20 permit tcp any any eq telnet
30 deny icmp any any (10 matches)............(Router Start dropping ICMP packets)
R1#sh run int fa1/0
Building configuration...
Current configuration : 159 bytes
!
interface FastEthernet1/0
bandwidth 64
ip address 10.1.1.1 255.255.255.0
ip access-group IMP_TRAFFIC in
load-interval 30
duplex full
speed 100
!
end

R1#sh int fa1/0 | in load
reliability 255/255, txload 19/255, rxload 19/255(As soon as Rxload goes below 25, R1 trigger 2nd event)
R1#
*Nov 18 02:21:31.367: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : CTL : cli_open called.
*Nov 18 02:21:31.375: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : OUT : R1>
*Nov 18 02:21:31.379: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : IN  : R1>enable
*Nov 18 02:21:31.395: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : OUT : R1#
*Nov 18 02:21:31.399: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : IN  : R1#conf t
*Nov 18 02:21:31.423: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : OUT : Enter configuration commands, one per line.  End with CNTL/Z.
R1#
*Nov 18 02:21:31.423: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : OUT : R1(config)#
*Nov 18 02:21:31.427: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : IN  : R1(config)#int fa1/0
*Nov 18 02:21:31.455: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : OUT : R1(config-if)#
*Nov 18 02:21:31.459: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : IN  : R1(config-if)#no ip access-group IMP_TRAFFIC in....(Removing Access-list)
*Nov 18 02:21:31.579: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : OUT : R1(config-if)#
*Nov 18 02:21:31.579: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : IN  : R1(config-if)#end
*Nov 18 02:21:31.587: %SYS-5-CONFIG_I: Configured from console by  on vty0 (EEM:Interface_Load_Down)
*Nov 18 02:21:31.599: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : OUT : R1#
*Nov 18 02:21:31.603: %HA_EM-6-LOG: Interface_Load_Down : DEBUG(cli_lib) : : CTL : cli_close called.

 

D) SNMP event Detector:

 

In this example EEM applet reads the SNMP variable and it will be triggered when the CPU goes above 60 %.you can customized applet according to the need. However, caution should be exercised to consider the file system free space before deploying the applet.

 

For SNMP OID you can use SNMP Object Navigator

 

Configuration:

 

event manager applet HIGH-CPU
!
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3 get-type next entry-op gt entry-val 60 poll-interval 5
!
action 0.1 cli command "enable"
action 0.2 syslog msg "Capturing high cpu information to flash:"
action 0.3 cli command "term length 0"
action 1.1 cli command "show process cpu sorted | append flash:EEM_CPU"
action 1.4 cli command "show ip traffic | append flash:EEM_TRAFFIC"
action 1.4 cli command "show logging | append flash:EEM_LOGS"
action 4.2 syslog msg "Removing EEM APPLET from running_config"
action 9.2 cli command "configure terminal"
action 9.3 cli command "no event manager applet HIGH-CPU"
action 9.4 cli command "end"
action 9.5 cli command "term default length"

 

Verification:

 

R2#
*Nov 18 12:30:53.139: %HA_EM-6-LOG: HIGH-CPU: Capturing high cpu information to flash:
*Nov 18 12:30:53.371: %HA_EM-6-LOG: HIGH-CPU: Removing EEM APPLET from running_config

R2#sh flash:
System CompactFlash directory:
File  Length   Name/status
1   22477     EEM_CPU
2   2665      EEM_LOGS

 

E) TCL (Tool Control Language) is a scripting language used extensively by Cisco to facilitate the testing and automating of various functions in the IOS.

In this example, small TCL script configured to check reachability of Branch devices from the Core router.

R1#tclsh
R1(tcl)#
R1(tcl)#foreach VAR {
+>(tcl)#192.168.1.1
+>(tcl)#192.168.2.1
+>(tcl)#192.168.3.1
+>(tcl)#192.168.4.1
+>(tcl)#} { puts [exec "ping $VAR"] }
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/58/120 ms

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/40/104 ms

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/72/128 ms

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.4.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R1(tcl)#

 

Related Information

Writing Embedded Event Manager Policies Using the Cisco IOS CLI
Cisco EEM Best Practices
Embedded Event Manager Overview
emm through event manager scheduler script
Writing Embedded Event Manager Policies Using Tcl

EEM Script For Periodically Clearing Interface Counters Using Regular Expression

 

                                   

Base Initial configuration:

 

Comments
Beginner

Thanks! it works great

 

But i did something different at the end, is this:

event manager applet Backup
 event timer cron name Backup cron-entry "27 17 9  * *"
 action 0.1 info type routername
 action 1.0 cli command "enable"
 action 1.1 cli command "copy run tftp" pattern "Address"
 action 1.2 cli command "172.16.20.123" pattern "filename"
 action 1.3 cli command "$_info_routername-confg"
 action 2.0 syslog priority informational msg "Test1"

 

And it worked for scheduled backups, it just has to have minute, hour and day, it didn't work only with the minute indicated.

 

Thanks for your help Florian.

 

Best regards!

Beginner

Thank you Ashirkar, great job

Beginner

Hi 

 

I would like to run an "event manager applet" but I can't on my ASR9K / IOS XR / Version: 4.3.2..... Where can i apply it?

Beginner

I need to run EEM  to specific time

For example 8pm at night to remove  10 Mbps existing policy map under interface and place 20 Mbps policy map and 6:00 am to remove 20 Mbps policy map and place 10 Mpbs policy map

Someone has any ideas

Community Member

Nice document...

I have a question, can someone correct me.

Lets see say for example, I have taken one applet from above example.

event manager applet Interface_Load_UP
event tag 1 interface name FastEthernet1/0 parameter rxload entry-op gt entry-val 127 entry-type value poll-interval 30
action 1.0 cli command "enable"
action 1.1 cli command "conf t"
action 1.2 cli command "int fa1/0"
action 1.3 cli command "ip access-group IMP_TRAFFIC in "
action 1.4 cli command "end"

Lets say, the Interface stayed UP more than 50% for 10mins, at first time when the interface hits more than 50% will apply the ACL, after that also interface percentage is more than 50% and same state stayed for 10mins.

Will the command execute every time, it applet runs?

If thats correct means, we will have high number of entries to config mode and Router unnecessary hit by the same command again and again.

 

Any suggestion.

 

Regards,

Manny

Beginner

@ashirkar

https://supportforums.cisco.com/users/ashirkar

I would like to know if you can point me to a link on how to do an EEM script or template for BGP failover if the circuit is not 100% reliable or if the link quality is degrading?

 

Thanks,

Beginner

Hello.

If my mail server work in othe port than 25. How I can use it for send message?

Cisco Employee

- If user config any random command as a parameter, even we do sanity check in the script, we can not block the command to run:

event manager applet sleep
event none
action 1.0 publish-event sub-system <number>  type <number>  arg1 "a;sleep 127"

- Execute the script:
event manager run sleep

- Find the process on the system:

[bru-ultra:/]$ ps -ef | grep sleep
root 17303 16355 0 11:08 ? 00:00:00 sleep 300
root 19546 18355 0 11:08 ? 00:00:00 sleep 3600
root 24190 21886 0 11:10 ? 00:00:00 sleep 60
root 24192 23003 0 11:10 ? 00:00:00 sh -c /opt/cisco/restful_api/aws_ha_event.sh a;sleep 127 <--

How we should do about this?

Beginner

Hi Experts,

I am being trying to run EEM in my production environment for taking all the show command output periodically. But i am unable to get the command syntax along with the output. For a long list of show commands it is difficult to identify the output. 

For example:- Below is the output from output file.

Actual Output:-

---------------------------------------------------------------------------------------

09:04:05.788 CST Fri Mar 11 2016

 

JKN12x01 uptime is 6 years, 39 weeks, 22 hours, 18 minutes

---------------------------------------------------------------------------------------

Expected Output:-

---------------------------------------------------------------------------------------

JKN12x01#sho clock

09:04:05.788 CST Fri Mar 11 2016

 

JKN12x01#sh version | in uptime

JKN12x01 uptime is 6 years, 39 weeks, 22 hours, 18 minutes

---------------------------------------------------------------------------------------

Please assist me in the above query.

 

Thanks in Advance :)

 

Regards,

Jenish Nagoria

Thank you , really helpfull !!!

Explorer

Can anyone tell me what is wrong with this EEM script? I received the following message again and again but the script never kicks on. Is my syntax wrong?

*Jun 8 13:48:41.656: %SNMP-3-INPUT_QFULL_ERR: Packet dropped due to input queue full
*Jun 8 13:48:53.017: %SNMP-3-INPUT_QFULL_ERR: Packet dropped due to input queue full
*Jun 8 13:50:33.974: %SNMP-3-INPUT_QFULL_ERR: Packet dropped due to input queue full

I have done EEM before but I don't see my mistake.

event manager applet SNMP_Restart
event syslog pattern "%SNMP-3-INPUT_QFULL_ERR: Packet dropped due to input queue full"
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "no snmp-server"
action 2.5 cli command "end"
action 3.0 cli command "config t"
action 3.1 cli command "snmp-server group xxx v3 priv"
action 3.2 cli command "snmp-server community xxx RO SNMP-ACL"
action 3.3 cli command "snmp-server community xxx RO SNMP-ACL"
action 3.4 cli command "snmp-server host x.x.x.x version 3 priv xxx"
action 3.5 syslog msg "SNMP restarted via EEM"
action 3.6 cli command "end"
action 4.0 cli command "wr mem"

CreatePlease to create content
Content for Community-Ad
August's Community Spotlight Awards