• Skip to main content
  • Skip to header right navigation
  • Skip to site footer

Roger Perkin

Network Automation Architect

  • Network Automation
    • Network Automation Courses
    • What is NetDevOps?
    • Workflow Orchestration
    • Ansible Automation Platform
    • Ansible Workshop
    • What is Network Automation?
    • Network Automation Tools
    • ContainerLab
    • Ansible Training
      • What is Ansible?
      • Ansible Tutorial for Beginners
      • Ansible Network Automation
      • Ansible Inventory Example
    • Python Network Automation
      • Nornir
      • Python Network Automation Course
      • Python for Network Engineers
      • Python VENV / Virtual Environment Tutorial
      • Python Tutorial for Beginners
      • pyATS
    • Network Source of Truth
      • NetBox
      • Infrahub
    • NetDevops
    • DevOps Tutorial
      • Git Training
      • Terraform Training
      • Linux Training
      • Kubernetes Training
      • Devops Training Course
      • Azure Devops Training
    • Terraform
    • GIT
      • Git Commands
      • What is GitHub?
    • Docker Training
    • Confluence
    • Microsoft Azure
  • Cisco
    • ISE
    • SD WAN Training
    • Password Recovery
    • Software-Upgrade-Guides
    • BGP
    • Data Center
    • WIRELESS
  • CCIE
  • Blog
  • About
    • My Red Special Guitar
  • Contact

Embedded Event Manager Examples

Home » EEM

The Cisco Embedded Event Manager is a powerful tool which can pretty much do anything you want it do.

I will go through a few simple embedded event manager examples and step through the configuration line by line.

Embedded Event Manager Example #1

This EEM example will monitor if an interface goes down and will generate a custom syslog message.

There are three steps to creating this EEM applet.

1: Create the applet and give it a name
2: Tell the applet what to look out for
3: What do you want the router to do when it sees what you have defined in step 2 – simple!

Ok, so we are going to watch out for anybody shutting down interface f0/0

For this example I just have one router fired up in GNS3

Before you start creating the applet, you need to discover the syslog msg you are looking for, to get that just shut down the interface.

[stextbox id=”black”]R6(config)#int f0/0
R6(config-if)#shut
*Mar  1 00:50:56.719: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Mar  1 00:50:57.719: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down[/stextbox]

You now need to select the important info and enclose it in quotes and add .* the beginning to ignore the timestamp and a .* at the end to cover any other text that may show

“.*%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down.*”

This is the syslog pattern you will be watching for copy this ready for the configuration

Step 1 – create the applet and give it a name

[stextbox id=”black”]R6(config)#event manager applet INTERFACE_SHUT_DOWN
R6(config-applet)#[/stextbox]

Step 2 – tell the router what you are looking for – event syslog pattern and the paste the line from above

[stextbox id=”black”]R6(config-applet)#event syslog pattern “.*%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down.*”
R6(config-applet)#[/stextbox]

Step 3 – what do you want the router to do when it sees this syslog pattern – for this example we are going to bring the interface  back up again. And generate a syslog message saying LEAVE F0/0 ALONE!

[stextbox id=”black”]R6(config-applet)#action 1.0 cli command “enable”
R6(config-applet)#action 2.0 cli command “conf t”
R6(config-applet)#action 2.0 cli command “int f0/0”
R6(config-applet)#action 3.0 cli command “no shut”
R6(config-applet)#$syslog priority informational msg “LEAVE F0/0 ALONE!”
R6(config-applet)#end[/stextbox]

Now let’s test it

[stextbox id=”black”]R6(config)#int f0/0
R6(config-if)#shut
R6(config-if)#
*Mar  1 01:05:50.755: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Mar  1 01:05:51.043: %HA_EM-6-LOG: INTERFACE_SHUT_DOWN: LEAVE F0/0 ALONE!
R6(config-if)#
*Mar  1 01:05:51.059: %SYS-5-CONFIG_I: Configured from console by vty0
R6(config-if)#
*Mar  1 01:05:52.983: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
R6(config-if)#[/stextbox]

It works! – This is a very simple example but it shows the power of EEM and the possibilities are endless.

You can configure it to track config changes, routing updates, adjacencies

You can also configure the router to email you when any of these events occur.

Check out my other posts below for more examples

Category: EEMTag: eem
ansible course for network engineers
Get Access to my Ansible Course NOW
Previous Post:How to Study for the CCIE Lab Exam
Next Post:CCIE Lab Attempt #1 Brussels – Close but no Cigar!

Sidebar

Hi I'm Roger Perkin,
Based in the UK working as a Network Automation Architect, CCIE #50038
About Roger | Twitter | Linkedin

python course for network engineers

Topics

Network Automation
Ansible
Python for Network Automation
CCIE
Cisco ISE
F5 Certification
BGP
OSPF
Network Automation Conferences
auvik promo banner
Pluralsight Trial

Git for Network Engineers

Ansible vs Nornir

Start learning today with my Network Automation Courses

Master Ansible, Python, Git, Nornir, Jenkins and more..


Buy me a coffeeBuy me a coffee

ansible network automation course

Have you seen my YouTube Channel?

YouTube Subscribe

Let’s get started

Take a look at my premium courses on Ansible, Nornir & Git or buy them all with the Network Automation Bundle!

Network Automation Courses

Navigation

Python VENV Tutorial
Python for Network Engineers

Network Automation
Network Automation Courses
Network Discovery Tools
Network Automation Conferences
Ansible Training
What is Ansible?
Devops Tutorial
Network Source of Truth
DevOps Glossary
Network Monitoring Software

Contact

Contact

Get in touch with me here

[email protected]

  • Twitter
  • LinkedIn
  • YouTube
Buy me a coffeeBuy me a coffee

Copyright © 2025 · Roger Perkin · All Rights Reserved · Privacy Policy – Terms