EEM — Embedded Event Manager Applets and Scripts

The one-sentence mental model

EEM is a while True: watch for X, do Y loop inside every Cisco router. No Python server, no NETCONF client — the box reacts to itself.

Anatomy of an applet

event manager applet CATCH-BGP-FLAP
  event syslog pattern "BGP-5-ADJCHANGE.*Down"
  action 1.0 cli command "enable"
  action 2.0 cli command "show ip bgp summary"
  action 3.0 cli command "show ip bgp neighbors"
  action 4.0 syslog msg "EEM captured BGP flap"
  action 5.0 mail server "10.0.0.50" to "netops@corp.com" ...

Three parts:

1. Applet name — must be unique.
2. Event — the trigger. Choose from ~30 event types.
3. Actions — the response, numbered so the order is predictable.

Common event types

Event	Fires when
syslog pattern "REGEX"	Any log line matches the regex.
snmp oid X.Y.Z threshold ...	SNMP polled value crosses a threshold.
interface name Gi0/1 parameter input-errors ...	Interface counter changes.
timer cron ...	On a schedule (“every 5 min”, “at 03:00 daily”).
timer countdown ...	Once, after N seconds.
timer watchdog time ...	Repeatedly, every N seconds.
`track object X state up	down`
cli pattern "REGEX"	An admin types a matching command.
none	Manual trigger with event manager run APPLET.

Actions you have available

• cli command ”…” — run a CLI command, capture output ($_cli_result).
• syslog msg ”…” — log an EEM-generated message.
• mail server X to Y subject ”…” body ”…” — send email (must have SMTP server reachable).
• snmp-trap — send an SNMP trap.
• puts / info / regexp — string manipulation.
• counter name X op set|add value N — bump an internal counter.
• set var VALUE — assign a variable, used later with $var.
• wait 5 — sleep 5 seconds.

Classic use cases

Auto-collect on OSPF adjacency flap

event manager applet OSPF-FLAP-CAPTURE
  event syslog pattern "OSPF.*Neighbor Down"
  action 1.0 cli command "enable"
  action 2.0 cli command "show ip ospf neighbor detail"
  action 3.0 cli command "show ip ospf interface"
  action 4.0 cli command "show logging | last 100"
  action 5.0 file open OUTPUT flash:/eem-ospf-flap.log w
  action 6.0 file puts OUTPUT "$_cli_result"
  action 7.0 file close OUTPUT

Next time OSPF flaps at 3 AM, the diagnostics are already on flash. No “please try to catch it next time”.

Config-change auto-rollback (config-replace pattern)

event manager applet CONFIG-CONFIRM
  event none
  action 1.0 cli command "enable"
  action 2.0 cli command "archive"
  action 3.0 cli command "path flash:pre-change"
  action 4.0 cli command "end"
  action 5.0 cli command "archive config"
  action 6.0 wait 600
  action 7.0 cli command "configure replace flash:pre-change force"

Trigger it manually before a risky change with event manager run CONFIG-CONFIRM. If you don’t cancel it in 10 minutes, the config auto-rolls back. Saves careers.

Disable a flapping interface

event manager applet CRC-STORM
  event snmp oid 1.3.6.1.2.1.31.1.1.1.10.10101 get-type exact entry-op ge entry-val 1000 poll-interval 60
  action 1.0 cli command "enable"
  action 2.0 cli command "configure terminal"
  action 3.0 cli command "interface Gi0/1"
  action 4.0 cli command "shutdown"
  action 5.0 syslog msg "EEM shut Gi0/1 after CRC storm"

Tcl scripts vs applets

If your logic needs loops, conditionals more complex than a single if, or arithmetic, move up to Tcl scripts:

event manager directory user policy flash:/eem-scripts/
event manager policy check-bandwidth.tcl

The .tcl file is a full Tcl program with access to the same event / action library. 90% of real EEM use stays in applets — Tcl is there when you need it.

Verification

show event manager policy registered
show event manager history events
show event manager statistics
debug event manager action cli                 ! see actions live

history events is invaluable — shows every EEM trigger and its outcome for the last N days.

Common exam / real-world mistakes

1. Missing event manager applet privilege. Applets run with the applet’s configured priv (default 15). Actions like cli command "enable" are needed because applet default doesn’t inherit enable mode.
2. Bad regex. Cisco’s syslog patterns use POSIX regex-like syntax. Test against actual log strings — %OSPF-5-ADJCHG: is different from OSPF-5-ADJCHG.
3. Blocking on wait/mail. If SMTP is down, mail server blocks. Watch out on frequent-fire applets.
4. Not versioning applets. They live in config — treat them like code. Copy to a repo, apply via config management (Ansible / NetMiko).
5. Firing recursively. A syslog-triggered applet that itself generates syslog can re-trigger. Add a guard condition or set a variable to break the loop.

Cheat strip

Job         event-driven automation inside the router itself
Trigger     syslog | snmp | timer | interface | track | cli | none
Actions     cli / syslog / mail / snmp-trap / file / regexp / wait / set

Applet      short, config-embedded
Tcl script  larger, file on flash

Classic uses:
 - auto-collect debug on adjacency flap
 - config auto-rollback if not confirmed
 - shut interface after error threshold
 - alert on config change

Verify   show event manager policy registered
         show event manager history events