EEM: Embedded Event Manager Applets and Scripts

The one-sentence mental model

EEM is a while True: watch for X, do Y loop inside every Cisco router. No Python server, no NETCONF client: the box reacts to itself.

Anatomy of an applet

event manager applet CATCH-BGP-FLAP
  event syslog pattern "BGP-5-ADJCHANGE.*Down"
  action 1.0 cli command "enable"
  action 2.0 cli command "show ip bgp summary"
  action 3.0 cli command "show ip bgp neighbors"
  action 4.0 syslog msg "EEM captured BGP flap"
  action 5.0 mail server "10.0.0.50" to "netops@corp.com" ...

Three parts:

1. Applet name: must be unique.
2. Event: the trigger. Choose from ~30 event types.
3. Actions: the response, numbered so the order is predictable.

Common event types

Actions you have available

• cli command ”..”: run a CLI command, capture output ($_cli_result).
• syslog msg ”..”: log an EEM-generated message.
• mail server X to Y subject ”..” body ”..”: send email (must have SMTP server reachable).
• snmp-trap: send an SNMP trap.
• puts / info / regexp: string manipulation.
• counter name X op set|add value N: bump an internal counter.
• set var VALUE: assign a variable, used later with $var.
• wait 5: sleep 5 seconds.

Classic use cases

Auto-collect on OSPF adjacency flap

event manager applet OSPF-FLAP-CAPTURE
  event syslog pattern "OSPF.*Neighbor Down"
  action 1.0 cli command "enable"
  action 2.0 cli command "show ip ospf neighbor detail"
  action 3.0 cli command "show ip ospf interface"
  action 4.0 cli command "show logging"
  action 5.0 file open OUTPUT flash:/eem-ospf-flap.log w
  action 6.0 file puts OUTPUT "$_cli_result"
  action 7.0 file close OUTPUT

Next time OSPF flaps at 3 AM, the diagnostics are already on flash. No “please try to catch it next time”.

Config-change auto-rollback (config-replace pattern)

event manager applet CONFIG-CONFIRM
  event none maxrun 700
  action 1.0 cli command "enable"
  action 2.0 cli command "copy running-config flash:pre-change.cfg" pattern "filename"
  action 2.1 cli command ""
  action 3.0 wait 600
  action 4.0 cli command "configure replace flash:pre-change.cfg force"

Trigger it manually before a risky change with event manager run CONFIG-CONFIRM. After 10 minutes the config rolls back to the saved copy, so a change that cut off your access undoes itself. Saves careers. The catch: this applet always rolls back, so for a confirm-or-rollback workflow use the built-in timer below.

IOS also has this built in, without EEM: configure terminal revert timer 10, make the change, then configure confirm once you’ve verified it. If you lose access and never confirm, the router rolls back on its own. (It needs archive with a path configured first.)

Disable an interface after a CRC storm

event manager applet CRC-STORM
  event interface name GigabitEthernet0/1 parameter input_errors_crc entry-op ge entry-val 1000 entry-type increment poll-interval 60
  action 1.0 cli command "enable"
  action 2.0 cli command "configure terminal"
  action 3.0 cli command "interface Gi0/1"
  action 4.0 cli command "shutdown"
  action 5.0 syslog msg "EEM shut Gi0/1 after CRC storm"

Tcl scripts vs applets

If your logic needs loops, conditionals more complex than a single if, or arithmetic, move up to Tcl scripts:

event manager directory user policy flash:/eem-scripts/
event manager policy check-bandwidth.tcl

The .tcl file is a full Tcl program with access to the same event / action library. 90% of real EEM use stays in applets. Tcl is there when you need it.

Verification

show event manager policy registered
show event manager history events
show event manager statistics
debug event manager action cli                 ! see actions live

history events is invaluable: shows recent EEM triggers and their outcomes (the last N events, set with event manager history size events).

Common exam / real-world mistakes

1. Missing event manager applet privilege. Applets run with the applet’s configured priv (default 15). Actions like cli command "enable" are needed because applet default doesn’t inherit enable mode.
2. Bad regex. Cisco’s syslog patterns use POSIX regex-like syntax and are case sensitive. Test against actual log strings: "neighbor down" never matches Neighbor Down.
3. Blocking on wait/mail. If SMTP is down, mail server blocks. Watch out on frequent-fire applets.
4. Not versioning applets. They live in config. Treat them like code. Copy to a repo, apply via config management (Ansible / NetMiko).
5. Firing recursively. A syslog-triggered applet that itself generates syslog can re-trigger. Add a guard condition or set a variable to break the loop.

Cheat strip

Job         event-driven automation inside the router itself
Trigger     syslog | snmp | timer | interface | track | cli | none
Actions     cli / syslog / mail / snmp-trap / file / regexp / wait / set

Applet      short, config-embedded
Tcl script  larger, file on flash

Classic uses:
 - auto-collect debug on adjacency flap
 - config auto-rollback if not confirmed
 - shut interface after error threshold
 - alert on config change

Verify   show event manager policy registered
         show event manager history events