Embedded Event Manager Examples

The Cisco Embedded Event Manager is a powerful tool which can pretty much do anything you want it do.

I will go through a few simple embedded event manager examples and step through the configuration line by line.

Embedded Event Manager Example #1

This EEM example will monitor if an interface goes down and will generate a custom syslog message.

There are three steps to creating this EEM applet.

1: Create the applet and give it a name
2: Tell the applet what to look out for
3: What do you want the router to do when it sees what you have defined in step 2 – simple!

Ok, so we are going to watch out for anybody shutting down interface f0/0

For this example I just have one router fired up in GNS3

Before you start creating the applet, you need to discover the syslog msg you are looking for, to get that just shut down the interface.

[stextbox id=”black”]R6(config)#int f0/0
R6(config-if)#shut
*Mar 1 00:50:56.719: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Mar 1 00:50:57.719: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down[/stextbox]

You now need to select the important info and enclose it in quotes and add .* the beginning to ignore the timestamp and a .* at the end to cover any other text that may show

“.*%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down.*”

This is the syslog pattern you will be watching for copy this ready for the configuration

Step 1 – create the applet and give it a name

[stextbox id=”black”]R6(config)#event manager applet INTERFACE_SHUT_DOWN
R6(config-applet)#[/stextbox]

Step 2 – tell the router what you are looking for – event syslog pattern and the paste the line from above

[stextbox id=”black”]R6(config-applet)#event syslog pattern “.*%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down.*”
R6(config-applet)#[/stextbox]

Step 3 – what do you want the router to do when it sees this syslog pattern – for this example we are going to bring the interface back up again. And generate a syslog message saying LEAVE F0/0 ALONE!

[stextbox id=”black”]R6(config-applet)#action 1.0 cli command “enable”
R6(config-applet)#action 2.0 cli command “conf t”
R6(config-applet)#action 2.0 cli command “int f0/0”
R6(config-applet)#action 3.0 cli command “no shut”
R6(config-applet)#$syslog priority informational msg “LEAVE F0/0 ALONE!”
R6(config-applet)#end[/stextbox]

Now let’s test it

[stextbox id=”black”]R6(config)#int f0/0
R6(config-if)#shut
R6(config-if)#
*Mar 1 01:05:50.755: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Mar 1 01:05:51.043: %HA_EM-6-LOG: INTERFACE_SHUT_DOWN: LEAVE F0/0 ALONE!
R6(config-if)#
*Mar 1 01:05:51.059: %SYS-5-CONFIG_I: Configured from console by vty0
R6(config-if)#
*Mar 1 01:05:52.983: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
R6(config-if)#[/stextbox]

It works! – This is a very simple example but it shows the power of EEM and the possibilities are endless.

You can configure it to track config changes, routing updates, adjacencies

You can also configure the router to email you when any of these events occur.

Check out my other posts below for more examples