Cisco IOS Embedded Event Manager Command Reference

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.

All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.

Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1721R)
© 2020 Cisco Systems, Inc. All rights reserved.
 CONTENTS

CHAPTER 1 A through action snmp Commands 1

A through action snmp Commands 2

action add 2
action append 3
action break 4
action cli 4
action cns-event 6
action comment 7
action context retrieve 8
action context save 9
action continue 10
action counter 11
action decrement 13
action divide 14
action else 15
action elseif 17
action end 18
action exit 20
action file 21
action force-switchover 22
action foreach 23
action gets 25
action if 26
action ifgoto 28
action increment 30
action info 31

Cisco IOS Embedded Event Manager Command Reference

iii
 Contents

action info type interface-names 35

action info type snmp getid 36
action info type snmp inform 38
action info type snmp oid 39
action info type snmp trap 42
action info type snmp var 44
action mail 46
action multiply 49
action policy 51
action publish-event 52
action puts 53
action regexp 54
action reload 56
action set (EEM) 57
action snmp-object-value 58
action snmp-trap 60

CHAPTER 2 action string through D Commands 63

action string through D Commands 64

action string compare 64
action string equal 65
action string first 66
action string index 67
action string last 69
action string length 70
action string match 71
action string range 72
action string replace 73
action string tolower 75
action string toupper 76
action string trim 77
action string trimleft 78
action string trimright 80
action subtract 81

Cisco IOS Embedded Event Manager Command Reference

iv
 Contents

action syslog 82
action track read 84
action track set 85
action while 86
attribute (EEM) 88
description (EEM) 89

CHAPTER 3 E through event manager Commands 91

E through event manager Commands 92

event application 92
event cli 93
event counter 98
event gold 100
event identity 103
event interface 105
event ioswdsysmon 111
event ipsla 114
event manager applet 117
event manager detector routing 120
event manager detector rpc 121
event manager directory user 122
event manager directory user repository 124
event manager environment 124
event manager history size 126
event manager policy 127
event manager run 129
event manager scheduler 132
event manager scheduler clear 133
event manager scheduler hold 135
event manager scheduler modify 137
event manager scheduler release 138
event manager scheduler script 140
event manager scheduler suspend 141
event manager session cli username 142

Cisco IOS Embedded Event Manager Command Reference

v
 Contents

event manager update user policy 143

CHAPTER 4 event mat through R Commands 147

event mat through R Commands 148

event mat 148
event neighbor-discovery 149
event nf 151
event none 154
event oir 155
event process 156
event resource 158
event rf 159
event routing 162
event rpc 164
event snmp 166
event snmp-notification 170
event snmp-object 174
event syslog 176
event timer 179
event track 182
event wdsysmon 184

CHAPTER 5 S through Z Commands 189

S through Z Commands 190

set (EEM) 190
show event manager detector 191
show event manager directory user 195
show event manager environment 196
show event manager history events 197
show event manager history traps 200
show event manager metric processes 201
show event manager policy active 203
show event manager policy available 205
show event manager policy pending 207

Cisco IOS Embedded Event Manager Command Reference

vi
 Contents

show event manager policy registered 209

show event manager scheduler 213
show event manager session cli username 214
show event manager statistics 215
show event manager version 216
track stub-object 218
trigger (EEM) 220

Cisco IOS Embedded Event Manager Command Reference

vii
Contents

Cisco IOS Embedded Event Manager Command Reference

viii
A through action snmp Commands
• A through action snmp Commands, on page 2

Cisco IOS Embedded Event Manager Command Reference

1
 A through action snmp Commands
A through action snmp Commands

A through action snmp Commands

action add
To specify the action of adding values of two variables when an an Embedded Event Manager (EEM) applet
is triggered, use the action add command in applet configuration mode. To undo the add action, use the no
form of this command.

action label add {long-integervariable-name} {long-integervariable-name}

no action label add

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

add Adds the values of two variables.

variable-name String value to be placed as the variable name.

long-integer Long integer value to be added to a variable.

Command Default By default, there is no change in the value of variables configured within an EEM applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to add the values of two variables. The result is stored in the variable named
$_result. The value of the variable must be a long integer, else the action will fail.

Examples The following example shows how to configure an EEM applet to add the values of two variables:

Router(config)#event manager applet one

Router(config-applet)#action 1.0 set $var1 10
Router(config-applet)#action 1.0 set $var2 20
Router(config-applet)#action 1.0 add $var1 $var2
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

Cisco IOS Embedded Event Manager Command Reference

2
 A through action snmp Commands
action append

action append
To specify the action of appending the given string value to the current value of a variable when an Embedded
Event Manager (EEM) applet is triggered, use the action append command in applet configuration mode.
To undo the append action, use the no form of this command.

action label append variable-name [variable-value]

no action label add

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

append Appends the given string value to the current value of the variable specified.

variable-name String value to be placed as the variable name.

variable-value (Optional) Long integer value to be appended tothe value of the variable name specified.

Command Default By default, there is no change in the value of variables configured within an EEM applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to append the given string value to the current value of variable. If the variable
does not exist, it will be created and set to the given value.

Examples The following example shows how to configure an EEM applet to append given string value to the
current value of the variable specified:

Router(config)#event manager applet one

Router(config-applet)#action 1.0 set $var1 10
Router(config-applet)#action 1.0 append $var1 12
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

Cisco IOS Embedded Event Manager Command Reference

3
 A through action snmp Commands
action break

action break
To specify the action of exiting from a loop of actions when an Embedded Event Manager (EEM) applet is
triggered, use the action break command in applet configuration mode. To disable the break action, use the
no form of this command.

action label break

no action label break

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

break Causes an immediate exit from a loop of actions.

Command Default By default, there is no exit from a loop of actions configured within an EEM applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to skip all the actions down to the related end action.

Examples The following example shows how to configure an EEM applet to break from a loop of actions:

Router(config)# event manager applet loop

Router(config-applet)# event none
Router(config-applet)# action 1 while 1 eq 1
Router(config-applet)# action 2 break
Router(config-applet)# action 3 end

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action cli
To specify the action of executing a Cisco IOS command-line interface (CLI) command when an Embedded
Event Manager (EEM) applet is triggered, use the action clicommand in applet configuration mode. To remove
the action of executing a CLI command, use the no form of this command.

action label cli command cli-string [pattern pattern-string]

Cisco IOS Embedded Event Manager Command Reference

4
 A through action snmp Commands
action cli

no action label cli command cli-string

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

command Specifies the message to be sent to the Cisco IOS CLI.

cli-string CLI command to be executed. If the string contains embedded blanks, enclose it in double
quotation marks.

pattern (Optional) Specifies the regular expression response pattern for the command cli-stringonly
when the command string solicits input.

pattern-string (Optional) Specifies the action to be specified with the pattern keyword. You are required
to specify a regular expression pattern-string that will match the next solicited prompt.

Command Default No CLI commands are executed when an EEM applet is triggered.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2(33)SXH The pattern keyword was added.

Usage Guidelines Use the action cli command to specify the action of executing a Cisco IOS CLI command when an EEM
applet is triggered. The pattern keyword is optional and is used only when the command string solicits input.
There are two types of Cisco IOS CLI commands:
• Normal--Those Cisco IOS CLI commands that produce output followed by a display of the normal router
prompt. The action cli command ends when the normal router prompt is received.
• Solicited--Those Cisco IOS CLI commands that ask one or more questions before the normal router
prompt is displayed, such as “confirm,” which has to be completed with a “yes” or a “no”input.

The action clicommand ends when the solicited prompt as specified in the optional pattern keyword is
received. You are required to specify a regular expression pattern that will match the next solicited prompt.
Specifying an incorrect pattern will cause the action cli command to wait forever until the applet execution
times out due to the maxrun timer expiration.

Cisco IOS Embedded Event Manager Command Reference

5
 A through action snmp Commands
action cns-event

The vty lines are allocated from the pool of vty lines that are configured using the line vty CLI configuration
command. EEM will use a vty line when a vty line is not being used by EEM and there are available vty lines.
EEM will also use a vty line when EEM is already using a vty line and there are three or more vty lines
available. Be aware that the connection will fail when fewer than three vty lines are available, preserving the
remaining vty lines for Telnet use.
The table below shows the built-in variable that is set when the action cli command is run.

Table 1: EEM Built-in Variables for action cli Command

Built-in Variable Description

$_cli_result The result of the execution of the CLI command.

Examples The following example shows how to specify an EEM applet to run when the Cisco IOS interface
loopback CLI command is configured three times. The applet executes the no shutdown command
to ensure that the loopback interfaces are operational.

Router(config)# event manager applet cli-match

Router(config-applet)# event cli command {.*interface loopback*} sync yes occurs 3
Router(config-applet)# action 1.0 cli command "no shutdown"

The following example shows how to specify an EEM applet to run when the pattern keyword
specifies the confirm argument for the clear counters Ethernet0/1 command.

Router(config)# event manager applet cli-match

Router(config-applet)# action 1.0 cli command "enable"
Router(config-applet)# action 2.0 cli command "clear counters Ethernet0/1" pattern "confirm"
Router(config-applet)# action 3.0 cli command "y"
!

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action cns-event
To specify the action of sending a message to the CNS Event Bus when an Embedded Event Manager (EEM)
applet is triggered, use the action cns-eventcommand in applet configuration mode. To remove the action of
sending a message to the CNS Event Bus, use the no form of this command.

action label cns-event msg msg-text

no action label cns-event msg msg-text

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it
in double quotation marks.

msg Specifies the message to be sent to the CNS Event Bus.

Cisco IOS Embedded Event Manager Command Reference

6
 A through action snmp Commands
action comment

msg-text Character text, an environment variable, or a combination of the two. If the string contains
embedded blanks, enclose it in double quotation marks.

Command Default No messages are sent to the CNS Event Bus.

Command Modes
Applet configuration

Command History Release Modification

12.0(26)S This command was introduced.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.3(2)XE This command was integrated into Cisco IOS Release 12.3(2)XE.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Examples The following example shows how to specify a message to be sent to the CNS Event Bus when the
memory-fail applet is triggered:

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op
lt entry-val 5120000 poll-interval 10
Router(config-applet)# action 1.0 cns-event msg "Memory exhausted; current available memory
is $_snmp_oid_val bytes"

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action comment
To specify the action of adding comments to an applet when an Embedded Event Manager (EEM) applet is
triggered, use the action comment command in applet configuration mode. To disable the comment, use the
no form of this command.

action label comment string

no action label comment

Cisco IOS Embedded Event Manager Command Reference

7
 A through action snmp Commands
action context retrieve

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

comment Adds comments to an applet.

string Series of characters, including embedded spaces, to be placed as the comment.

Command Default By default, there are no comments added to an applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to add comments to applets. This results in a no-op when the applet is run.

Examples The following example shows how to add comments to an applet:

Router(config)#event manager applet one

Router(config-applet)#action 1.0 comment keyvalue
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action context retrieve

To specify the action of retrieving variables identified by a given set of context name keys, when an Embedded
Event Manager (EEM) applet is triggered, use the action context retrievecommand in applet configuration
mode. To undo the retrieve action, use the no form of this command.

action label context retrieve key key-name variable variable-name-pattern

no action label context retrieve

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run
in ascending alphanumeric key sequence using the label as the sort key.
If the string contains embedded blanks, enclose it in double quotation
marks.

context retrieve Used to retrieve variables identified by the given context name keys.

Cisco IOS Embedded Event Manager Command Reference

8
 A through action snmp Commands
action context save

key key-name Provides the context name key.

variable variable-name-pattern Provides description of the variable.

Command Default By default, no variables specified by a given set of context name keys are retrieved.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to retrieve the variable(s) identified by a given set of context name keys. Information
that is retrieved is automatically deleted from the context database.
The information for the variable specified in the command is retrieved, only if a variable with the same name
was saved in the corresponding context save call, using the action context savecommand.

Examples The following example shows how to configure an EEM applet to retrieve variables identified by a
given set of context name keys:

Router(config)#event manager applet one

Router(config-applet)#action 1.0 context retrieve key pki-72a variable var1
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action context save This command is used to save information across multiple policy triggers.

action context save

To specify the action of saving information across multiple policy triggers, when an Embedded Event Manager
(EEM) applet is triggered, use the action context savecommand in applet configuration mode. To remove
the saved the information, use the no form of this command.

action label context save key key-name variable variable-name-pattern

no action label context save

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run
in ascending alphanumeric key sequence using the label as the sort key.
If the string contains embedded blanks, enclose it in double quotation
marks.

Cisco IOS Embedded Event Manager Command Reference

9
 A through action snmp Commands
action continue

context save Used to save information across multiple policy triggers.

key key-name Provides the context name key.

variable variable-name-pattern Provides description of the variable.

Command Default By default, no infomration in saved across multiple policy triggers.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

Usage Guidelines You can use the action context savecommand to save information across multiple policy triggers. The
command saves variables that match the given pattern with the context name key as identification. Saved
information can be retrieved by a different applet using the action context retrievecommand.
Once the saved information is retrieved, it is automatically deleted from the context database. To save the
same information from the applet that retrieved it, you must run the action context savecommand on that
applet again.

Examples The following example shows how to configure an EEM applet to save information across multiple
policy triggers:

Router(config)#event manager applet one

Router(config-applet)#action 1.0 context save key pki-72a variable var1
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action context retrieve Retrieves variables identified by the given context name keys.

action continue
To specify the action of continuing with a loop of actions, when an Embedded Event Manager (EEM) applet
is triggered, use the action continuecommand in applet configuration mode. To stop the continue action, use
the no form of this command.

action label continue

no action label continue

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded blanks,
enclose it in double quotation marks.

Cisco IOS Embedded Event Manager Command Reference

10
 A through action snmp Commands
action counter

continue Causes the loop to continue with the next iteration.

Command Default By default, there is no loop of actions configured within an EEM applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to continue with a loop of actions.

Examples The following example shows how to configure an EEM applet to continue with a loop of actions:

Router(config)# event manager applet loop

Router(config-applet)# event none
Router(config-applet)# action 1 while 1 eq 1
Router(config-applet)# action 2 continue
Router(config-applet)# action 3 end

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action counter
To specify the action of setting or modifying a named counter when an Embedded Event Manager (EEM)
applet is triggered, use the action countercommand in applet configuration mode. To restore the default value
to the counter, use the no form of this command.

action label counter name counter-name value counter-value op {dec | inc | nop | set}
no action label counter name counter-name value counter-value op {dec | inc | nop | set}

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

name Specifies the name of the counter to be set or modified.

counter-name Name of the counter to be set or modified. The counter name is referenced in a registered
counter type policy.

value Specifies the value to be used to set or modify the counter.

counter-value Number in the range from -2147483648 to 2147483647, inclusive.

Cisco IOS Embedded Event Manager Command Reference

11
 A through action snmp Commands
action counter

op Indicates the operator to be used with the counter-value to set or modify the specified
counter.

dec Specifies that the counter is decreased in value by the amount specified in the
counter-valueargument.

inc Specifies that the counter is increased in value by the amount specified in the
counter-valueargument.

nop Specifies that the counter value is read from the environment variable
$_counter_value_remain.

set Specifies that the counter is set to the value specified in the counter-value argument.

Command Default No counter values are set or modified.

Command Modes
Applet configuration

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Usage Guidelines Use the action counter command when an event occurs periodically and you want an action to be implemented
after a specified number of occurrences of that event. When the action counter command completes, an
environment variable is updated as shown in the table below.
The table below shows the built-in variable that is set when the action counter command is run.

Table 2: EEM Built-in Variables for action counter Command

Built-in Variable Description

$_counter_value_remain The value of the counter after the execution of the action counter command.

Use the event counter command with the action counter command when an event occurs periodically and
you want an action to be implemented after a specified number of occurrences of the event.

Examples The following example shows an EEM applet called IPSLAping1 being registered to run when there
is an exact match on the value of a specified SNMP object ID that represents a successful IP SLA
ICMP echo operation (this is equivalent to a ping command). Four actions are triggered when the

Cisco IOS Embedded Event Manager Command Reference

12
 A through action snmp Commands
action decrement

echo operation fails, and event monitoring is disabled until after the second failure. A message saying
that the ICMP echo operation to a server failed is sent to syslog, an SNMP trap is generated, EEM
publishes an application-specific event, and a counter called IPSLA1F is incremented by a value of
one.

Router(config)# event manager applet IPSLAping1

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.4 get-type exact
entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 5
Router(config-applet)# action 1.0 syslog priority critical msg "Server IP echo failed:
OID=$_snmp_oid_val"
Router(config-applet)# action 1.1 snmp-trap strdata "EEM detected server reachability
failure to 10.1.88.9"
Router(config-applet)# action 1.2 publish-event sub-system 88000101 type 1 arg1 10.1.88.9
arg2 IPSLAEcho arg3 fail
Router(config-applet)# action 1.3 counter name _IPSLA1F value 1 op inc

The following example shows a policy--EventCounter_A--that is configured to run once a minute

and to increment a well-known counter called critical_errors. A second policy--EventCounter_B--is
registered to be triggered when the well-known counter called critical_errors exceeds a threshold of
3. When policy EventCounter_B runs, it resets the counter back to 0.

Router(config)# event manager applet EventCounter_A

Router(config-applet)# event timer watchdog time 60.0
Router(config-applet)# action 1.0 syslog msg “EventCounter_A”
Router(config-applet)# action 2.0 counter name critical_errors value 1 op inc
Router(config-applet)# exit

action decrement
To specify the action of decrementing the value of a variable, when an Embedded Event Manager (EEM)
applet is triggered, use the action decrement command in applet configuration mode. To remove the action
from the applet, use the no form of this command.

action label decrement variable-name long-integer

no action label decrement

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

decrement Decrements the value of the variable with the integer specified.

variable-name String value to be placed as the variable name.

long-integer Long integer value by which the variable gets decremented.

Command Default By default, there is no change in the value of variables configured within an EEM applet.

Command Modes
Applet configuration (config-applet)

Cisco IOS Embedded Event Manager Command Reference

13
 A through action snmp Commands
action divide

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to decrement the value of a variable.

Examples The following example shows how to configure an EEM applet to decrement the value of a variable:

Router(config)#event manager applet one

Router(config-applet)#action 1.0 set varname 20
Router(config-applet)#action 1.0 decrement varname 12
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action divide
To divide the dividend value by the given divisor value when an Embedded Event Manager (EEM) applet is
triggered, use the action divide command in applet configuration mode. To remove the calculation process,
use the no form of this command.

action label divide [{long-integer-1variable-name-1}] [{long-integer-2variable-name-2}]

no action label divide

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

long-integer-1 (Optional) First dividend integer value for the division.

variable-name-1 (Optional) First dividend variable name for the division. The value stored in the dividend
variable name must be a long integer value or else the action will fail.

long-integer-2 (Optional) Second divisor integer value for the division.

variable-name-2 (Optional) Second divisor variable name for the division. The value stored in the divisor
variable name must be a long integer value or else the action will fail.

Command Default If the command is not entered within applet configuration mode, the respective applet is not registered when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Cisco IOS Embedded Event Manager Command Reference

14
 A through action snmp Commands
action else

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action dividecommand to divide the dividend value with a given divisor value. All arithmetic
calculations are performed as long integers without any checks for overflow. If a statement is not associated
with this applet, events are still triggered without any action or result. A warning message stating that no
statements are associated with this applet is displayed at the exit time of the configuration. All the results of
the divide action command except the remainder value are saved in $_result. The remainder value of the
divided integer is saved in $_remainder. Floating points (decimal) are not supported.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data are written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command after entering
global configuration mode. In applet configuration mode, the config prompt changes to (config-applet)#. The
applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to divide the value of the dividend by the value of the divisor.

Router(config)# event manager applet action

Router(config-applet)# action label2 divide 45 15

Related Commands Command Description

action add Adds the value of the variable by the given value when an EEM applet is triggered.

action multiply Multiplies the value of the variable by the given value when an EEM applet is triggered.

action subtract Subtracts the value of the variable by the given value when an EEM applet is triggered.

action else
To identify the beginning of an else conditional action block in an if/else conditional action block when an
Embedded Event Manager (EEM) applet is triggered, use the action else command in applet configuration
mode. To remove the else conditional action block, use the no form of this command.

Cisco IOS Embedded Event Manager Command Reference

15
 A through action snmp Commands
action else

action label else

no action label else

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

Command Default If the command is not entered within applet configuration mode, the respective applet is not registered when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action elsecommand to identify the else conditional action block. If a statement is not associated with
this applet, events are still triggered without any action or result. A warning message stating that no statements
are associated with this applet is displayed at the exit time of the configuration.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data are written using the CLI applet-submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command after entering
global configuration mode. In applet configuration mode the config prompt changes to (config-applet)#. The
applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to identify the beginning of an else action block:

Router(config)# event manager applet action

Router(config-applet)# action label if $var eq 0
Router(config-applet)# action label2 else
Router(config-applet)# end

Cisco IOS Embedded Event Manager Command Reference

16
 A through action snmp Commands
action elseif

Related Commands Command Description

action elseif Identifies the beginning of an elseif conditional action block when an EEM applet is triggered.

action if Identifies the beginning of an if conditional action block when an EEM applet is triggered.

action elseif
To identify the beginning of the elseif conditional action block in the else/if conditional action block when
an Embedded Event Manager (EEM) applet is triggered, use the action elseif command in applet configuration
mode. To remove the elseif conditional action block, use the no form of this command.

action label elseif [string-op-1] {eq | gt | ge | lt | le | ne} [string-op-2]

no action label elseif

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string-op-1 (Optional) Sequence of characters that will replace the range of characters in the string.

eq Equal To keyword used for comparing two strings.

gt Greater Than keyword used for comparing two strings.

ge Greater Than or Equal To keyword used for comparing two strings.

lt Less Than keyword used for comparing two strings.

le Less Than or Equal To keyword used for comparing two strings.

ne Not Equal To keyword used for comparing two strings.

string-op-2 (Optional) Sequence of characters that will replace the range of characters in the string.

Command Default If the command is not specified within applet configuration mode, the respective applet is not registered when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action elseifcommand to identify the beginning of the else conditional action block in the else/if
conditional action block. All arithmetic calculations are performed as long integers without any checks for
overflow. If a statement is not associated with this applet, events are still triggered without any action or result.

Cisco IOS Embedded Event Manager Command Reference

17
 A through action snmp Commands
action end

A warning message stating that no statements are associated with this applet is displayed at the exit time of
the configuration.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data is written using the CLI applet-submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command in global
configuration mode. In applet configuration mode, the config prompt changes to (config-applet)#. Applet
configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that cause this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to identify the beginning of the elseif conditional action block.

Router(config)# event manager applet action

Router(config-applet)# event none
Router(config-applet)# action 1.0 set x "5"
Router(config-applet)# action 2.0 if $x lt 3
Router(config-applet)# action 3.0 puts "$x is less than 3"
Router(config-applet)# action 4.0 elseif $x lt 10

Router(config-applet)# action 5.0 puts "$x is less than 10"

Router(config-applet)# action 6.0 end

Router# event manager run action
5 is less than 10
Router#

Related Commands Command Description

action else Identifies the beginning of the else conditional action block when an EEM applet is triggered.

action if Identifies the beginning of an if conditional action block when an EEM applet is triggered.

action ifgoto Signifies the applet to jump to the given label if the condition is true when an EEM applet
is triggered.

action end
To identify the end of a conditional action block in the if/else and while conditional action block when an
Embedded Event Manager (EEM) applet is triggered, use the action end command in applet configuration
mode. To remove the end conditional action block, use the no form of this command.

Cisco IOS Embedded Event Manager Command Reference

18
 A through action snmp Commands
action end

action label end

no action label end

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

Command Default If the commands are not specified within applet configuration mode, the respective applet is removed when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

Usage Guidelines Use the action endcommand to identify the end of a conditional action block in the if/else and while conditional
action block.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data are written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command after entering
global configuration mode. In applet configuration mode the config prompt changes to (config-applet)#. The
applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows hoe to identify the end of a conditional action block:

Router(config)# event manager applet action

Router(config-applet)# event none
Router(config-applet)# action 1.0 set x "5"
Router(config-applet)# action 2.0 if $x lt 10
Router(config-applet)# action 3.0 puts "$x is less than 10"
Router(config-applet)# action 4.0 end

Cisco IOS Embedded Event Manager Command Reference

19
 A through action snmp Commands
action exit

Related Commands Command Description

action else Identifies the beginning of the else conditional action block when an EEM applet is triggered.

action if Identifies the beginning of an if conditional action block when an EEM applet is triggered.

action exit
To immediately exit from the running applet configuration when an Embedded Event Manager (EEM) applet
is triggered, use the action exit command in applet configuration mode. To cancel the process of immediate
exit from the running applet, use the no form of this command.

action label exit [result]

no action label exit

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

result (Optional) Parameter word for the exit result.

Command Default If the commands are not specified within applet configuration mode, the respective applet is removed when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action exit command to immediately exit from the running applet configuration. All arithmetic
calculations are performed as long integers without any checks for overflow. If a statement is not associated
with this applet, events are still triggered without any action or result. A warning message stating that no
statements are associated with this applet is displayed at the exit time of the configuration.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• The event specification criteria are written in Tcl in the Tcl-based implementation.
• The event specification data are written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.

Cisco IOS Embedded Event Manager Command Reference

20
 A through action snmp Commands
action file

To enter applet configuration mode, use the event manager applet applet-name command after entering
global configuration mode. In applet configuration mode the config prompt changes to (config-applet)#. The
applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to exit the applet configuration:

Router(config)# event manager applet action

Router(config-applet)# action label2 exit 25

action file
To configure the Embedded Event Manager (EEM) applet file operations, use the action file command in
applet configuration mode. To disable the configuration, use the no form of this command.

action label file{close file-descriptor | delete file-descriptor | gets file-descriptor variable-name | open
file-descriptor file-name access-permission | puts file-descriptor {string | nonewline string} | read
file-descriptor variable-name number | write file-descriptor string number}
no action label file

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

close Specifies the file to close.

filename Name of the file.

delete Specifies the file to delete.

gets Specifies the information or file to get.

variable-name Variable name to store the get result.

open Specifies the file to open

file-access File access. Valid values are

puts

string

nonewline Specifies that no new line should be added.

read Specifies the file to read.

number Specifies the file to write information.

Cisco IOS Embedded Event Manager Command Reference

21
 A through action snmp Commands
action force-switchover

write

Command Default
Command Modes Applet configuration (config-applet)

Command History Release Modification

15.2(2)T This command was introduced.

15.1(1)SY This command was integrated into Cisco IOS Release 15.1(1)SY.

Usage Guidelines
Examples

Related Commands Command Description

event manager applet Registers an event applet with EEM and enters applet configuration mode.

action force-switchover
To specify the action of switching to a secondary processor in a fully redundant environment when an Embedded
Event Manager (EEM) applet is triggered, use the action force-switchovercommand in applet configuration
mode. To remove the action of switching to a secondary processor, use the no form of this command.

action label force-switchover

no action label force-switchover

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

Command Default A switch to a secondary processor is not made.

Command Modes
Applet configuration

Command History Release Modification

12.0(26)S This command was introduced.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.3(2)XE This command was integrated into Cisco IOS Release 12.3(2)XE.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

Cisco IOS Embedded Event Manager Command Reference

22
 A through action snmp Commands
action foreach

Release Modification

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Usage Guidelines Before using the action force-switchover command, you must install a backup processor in the device. If the
hardware is not fully redundant, the switchover action will not be performed.

Examples The following example shows how to specify a switch to the secondary Route Processor (RP) when
the memory-fail applet is triggered:

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op
lt entry-val 5120000 poll-interval 10
Router(config-applet)# action 2.0 force-switchover

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action foreach
To specify the iteration of an input string using the delimiter as a tokenizing pattern, use the action foreach
command in applet configuration mode. To remove iteration of the input string, use the no form of this
command.

action label foreach [string-iterator] [string-input] [string-delimiter]

no action label foreach

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string-iterator (Optional) Series of characters that acts as an iterator. If the string contains embedded
blanks, enclose it in double quotation marks.

string-input (Optional) Series of characters that acts as an input. If the string contains embedded blanks,
enclose it in double quotation marks.

string-delimiter (Optional) Series of characters that acts as a delimiter. If the string contains embedded
blanks, enclose it in double quotation marks. The default delimiter is whitespace.

Cisco IOS Embedded Event Manager Command Reference

23
 A through action snmp Commands
action foreach

Command Default If the commands are not specified within applet configuration mode, the respective applet is removed when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action foreach command to iterate an input string using the delimiter as a tokenizing pattern. The
delimiter is a regular expression pattern string. The token found in each iteration is assigned to the given
iterator variable. All arithmetic calculations are performed as long integers without any checks for overflow.
If a statement is not associated with this applet, events are still triggered without any action or result. A warning
message stating that no statements are associated with this applet is displayed at the exit time of the
configuration.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• The event specification criteria are written in Tcl in the Tcl-based implementation.
• The event specification data are written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-namecommand after entering
global configuration mode. In applet configuration mode the config prompt changes to (config-applet)#. The
applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to iterate an input string using the delimiter as a tokenizing pattern:

Router(config)# event manager applet action

Router(config-applet)# event none
Router(config-applet)# action 1 foreach _iterator "red blue green orange"
Router(config-applet)# action 2 puts "iterator is $_iterator"
Router(config-applet)# action 3 end
Router# event manager run action
iterator is red
iterator is blue
iterator is green
iterator is orange
Router#

Cisco IOS Embedded Event Manager Command Reference

24
 A through action snmp Commands
action gets

action gets
To get an input from the local tty in a synchronous applet and store the value in the given variable when an
Embedded Event Manager (EEM) applet is triggered, use the action gets command in applet configuration
mode. To cancel the process of receiving an input from the local tty, use the no form of this command.

action label gets variable

no action label gets

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it
in double quotation marks.

variable Variable word that stores the input value from the synchronous applet.

Command Default If the commands are not specified within applet configuration mode, the respective applet is removed when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action gets command to get an input from the local tty in a synchronous applet and store the value
in the given variable. This command is not operational for asynchronous applets. The applet continues without
any error but does not set the variable. All arithmetic calculations are performed as long integers without any
checks for overflow. If a statement is not associated with this applet, events are still triggered without any
action or result. A warning message stating that no statements are associated with this applet is displayed at
the exit time of the configuration.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data are written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command after entering the
global configuration mode. In applet configuration mode the config prompt changes to (config-applet)#. The
applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.

Cisco IOS Embedded Event Manager Command Reference

25
 A through action snmp Commands
action if

• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to get the input from the local tty in a synchronous applet and
store the value:

Router(config)# event manager applet action

Router(config-applet)# event none
Router(config-applet)# action label2 gets input
Router(config-applet)# action label3 syslog msg “Input entered was \”$input\“”

Related Commands Command Description

action puts Prints data directly to the local tty in a synchronous applet when an EEM applet is triggered.

action if
To identify the beginning of an if conditional block when an Embedded Event Manager (EEM) applet is
triggered, use the action if command in applet configuration mode. To remove the if conditional action block,
use the no form of this command.

action label if [string-op-1] {eq | gt | ge | lt | le | ne} [string-op-2]

no action label if

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string-op-1 (Optional) Sequence of characters that will replace the range of characters in the string.

eq Equal To keyword used for comparing two strings.

gt Greater Than keyword used for comparing two strings.

ge Greater Than or Equal To keyword used for comparing two strings.

lt Less Than keyword used for comparing two strings.

le Less Than or Equal To keyword used for comparing two strings.

ne Not Equal To keyword used for comparing two strings.

string-op-2 (Optional) Sequence of characters that will replace the range of characters in the string.

Command Default If the commands are not specified within applet configuration mode, the respective applet is removed when
you exit the configuration.

Command Modes
Applet configuration (config-applet)

Cisco IOS Embedded Event Manager Command Reference

26
 A through action snmp Commands
action if

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action ifcommand to identify the beginning of the if conditional action block. All arithmetic calculations
are performed as long integers without any checks for overflow. If the goto label option is used, the if
functionality will not identify the beginning of a action block, but will signify the applet to jump to the given
label if the condition is true.
If a statement is not associated with this applet, events are still triggered without any action or result. A warning
message stating that no statements are associated with this applet is displayed at the exit time of the
configuration.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data are written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet based implementation
because the Tcl based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command after entering
global configuration mode. In applet configuration mode the config prompt changes to (config-applet)#. The
applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to identify the beginning of an if conditional block:

Router(config)# event manager applet action

Router(config-applet)# event none
Router(config-applet)# action 1.0 set x "5"
Router(config-applet)# action 2.0 if $x lt 10
Router(config-applet)# action 3.0 puts "$x is less than 10"
Router(config-applet)# action 4.0 end
Router# event manager run action
5 is less than 10
Router#

Related Commands Command Description

action elseif Identifies the beginning of the else conditional action block in the else/if conditional block
when an EEM applet is triggered.

Cisco IOS Embedded Event Manager Command Reference

27
 A through action snmp Commands
action ifgoto

Command Description

action ifgoto Signifies the applet to jump to the given label if the condition is true when an EEM applet
is triggered.

action ifgoto
To instruct the applet to jump to a given label if the specified condition is true when an Embedded Event
Manager (EEM) applet is triggered, use the action ifgoto command in applet configuration mode. To cancel
the process of applet jump, use the no form of this command.

action label-1 if [string-op-1] {eq | gt | ge | lt | le | ne} [string-op-2] goto label-2

no action label ifgoto

Syntax Description label-1 Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string-op-1 (Optional) Sequence of characters that will replace the range of characters in the string.

eq Equal To keyword used for comparing two strings.

gt Greater Than keyword used for comparing two strings.

ge Greater Than Or Equal To keyword used for comparing two strings.

lt Less Than keyword used for comparing two strings.

le Less Than Or Equal To keyword used for comparing two strings.

ne Not Equal To keyword used for comparing two strings.

string-op-2 (Optional) Sequence of characters that will replace the range of characters in the string.

label-2 Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

Command Default If the command is not specified within applet configuration mode, the respective applet is removed when you
exit the configuration.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

Cisco IOS Embedded Event Manager Command Reference

28
 A through action snmp Commands
action ifgoto

Release Modification

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action ifgotocommand to signify the applet to jump to a given label if the specified condition is true.
If the goto labeloption is used, the action if command will not identify the beginning of an action block. Goto
actions are supported only within the if/goto format. To simulate a goto without if, use a test that is always
true. All arithmetic calculations are performed as long integers without any checks for overflow. If a statement
is not associated with this applet, events are still triggered without any action or result. A warning message
stating that no statements are associated with this applet is displayed at the exit time of the configuration.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data is written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command in the global
configuration mode. In applet configuration mode, the config prompt changes to (config-applet)#. Applet
configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that cause this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to instruct the applet to jump to a given label:

Router(config)# event manager applet action

Router(config-applet)# event none
Router(config-applet)# action 1 set x "5"
Router(config-applet)# action 2 if $x lt 10 goto 4
Router(config-applet)# action 3 puts "skipping this"
Router(config-applet)# action 4 puts "jumped to action 4"
Router(config-applet)# action 5 end
Router# event manager run action
jumped to action 4

Related Commands Command Description

action else Identifies the beginning of the else conditional action block when an EEM applet is triggered.

action if Identifies the beginning of an if conditional action block when an EEM applet is triggered.

Cisco IOS Embedded Event Manager Command Reference

29
 A through action snmp Commands
action increment

action increment
To specify the action of incrementing the value of a variable, when an Embedded Event Manager (EEM)
applet is triggered, use the action increment command in applet configuration mode. To remove the action
from the applet, use the no form of this command.

action label increment variable-name long-integer

no action label increment

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

increment Increments the value of the variable with the long integer specified.

variable-name String value to be placed as the variable name.

long-integer Long integer value by which the variable is incremented.

Command Default By default, there is no change in the value of variables configured within an EEM applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this command to increment the value of a variable. The value of the variable must be a long
integer, else the action will fail.

Examples The following example shows how to configure an EEM applet to increment the value of a variable:

Router(config)#event manager applet one

Router(config-applet)#action 1.0 set varname 20
Router(config-applet)#action 1.0 increment varname 12
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

Cisco IOS Embedded Event Manager Command Reference

30
 A through action snmp Commands
action info

action info
To specify the action of obtaining system information when an Embedded Event Manager (EEM) applet is
triggered, use the action infocommand in applet configuration mode. To remove the action info command
from the configuration, use the no form of this command.

action label info type {cli frequency | cli history | syslog frequency | syslog history | routername
| snmp oid oid-value get-type {exact | next}}
no action label info type {cli frequency | cli history | syslog frequency | syslog history | routername
| snmp oid oid-value get-type {exact | next}}

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

type Specifies the type of information requested.

cli frequency Requests information about the frequency of recent command-line interface (CLI)
commands.

cli history Requests information about the history of recent CLI commands.

syslog frequency Requests information about the frequency of syslog messages.

syslog history Requests information about the history of recent syslog messages.

routername Requests the name of the specified router.

snmp oid Requests the value of the SNMP object as specified by the SNMP object identifier
(object ID).

oid-value Object ID (OID) value of the data element, in Simple Network Management Protocol
(SNMP) dotted notation. An OID is defined as a type in the associated MIB,
CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value. Monitoring
of some OID types is supported. The following types are valid:
• INTEGER_TYPE
• COUNTER_TYPE
• GAUGE_TYPE
• TIME_TICKS_TYPE
• COUNTER_64_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE

Cisco IOS Embedded Event Manager Command Reference

31
 A through action snmp Commands
action info

get-type Specifies that a type of SNMP get operation is to be applied to the object ID specified
by the oid-value argument.
• exact --Retrieves the object ID specified by the oid-value argument.
• next --Retrieves the object ID that is the alphanumeric successor to the object ID
specified by the oid-value argument.

Command Default No system information is requested.

Command Modes
Applet configuration

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Usage Guidelines Use the action info command when an event occurs and you want to request some system information. When
the snmp oid keyword is used, an error message is returned when the OID is not one of the defined types.
The table below shows the built-in variables that are set for the various action info keywords. The notation
[1-N] represents that the built-in variable ends in a sequential number starting at 1 up to the maximum number
of entries returned.

Table 3: EEM Built-in Variables for action info Command

Built-in Variable Description

action info cli frequency

$_info_cli_freq_num_entries The number of CLI event entries.

$_info_cli_freq_pattern_[1-N] A regular expression used to perform CLI command pattern

matching.

$_info_cli_freq_time_sec_[1-N] The seconds in Posix timer units since January 1, 1970, which
represents the time the last CLI event was raised.

$_info_cli_freq_time_msec_[1-N] The milliseconds in Posix timer units since January 1, 1970, which
represents the time the last CLI event was raised.

$_info_cli_freq_match_count_[1-N] The number of times that a CLI command matches the pattern
specified by this CLI event specification.

Cisco IOS Embedded Event Manager Command Reference

32
A through action snmp Commands
action info

Built-in Variable Description

$_info_cli_freq_raise_count_[1-N] The number of times that this CLI event was raised.

$_info_cli_freq_sync_[1-N] A “yes” means that event publish should be performed

sychronously. The event detector will be notified when the Event
Manager Server has completed publishing the event. The Event
Manager Server will return a code that indicates whether or not
the CLI command should be executed.

$_info_cli_freq_skip_[1-N] A “yes” means that the CLI command should not be executed if
the sync flag is not set.

$_info_cli_freq_occurs_[1-N] Number of occurrences before an event is raised; if this argument

is not specified an event is raised on the first occurrence.

$_info_cli_freq_period_sec_[1-N] Number of occurrences must occur within this number of seconds

in order to raise event; if not specified, does not apply.

$_info_cli_freq_period_msec_[1-N] The number of occurrences must occur within this number of

milliseconds in order to raise the event; if not specified, the period
check does not apply.

action info cli history

$_info_cli_hist_num_entries The number of cli history entries.

$_info_cli_hist_cmd_[1-N] The text of the CLI command.

$_info_cli_hist_time_sec_[1-N] The time, in seconds, when the CLI command occurred.

$_info_cli_hist_time_msec_[1-N] The time, in milliseconds, when the CLI command occurred.

action info routername

$_info_routername The name of the router.

action info snmp

$_info_snmp_oid The SNMP object ID.

$_info_snmp_value The value string of the associated SNMP data element.

action info syslog frequency

$_info_syslog_freq_num_entries The number of syslog entries.

$_info_syslog_freq_pattern_[1-N] A regular expression used to perform syslog message pattern

matching.

$_info_syslog_freq_time_sec_[1-N] The seconds in Posix timer units since January 1, 1970, which
represents the time the last event was raised.

$_info_syslog_freq_time_msec_[1-N] The milliseconds in Posix timer units since January 1, 1970, which
represents the time the last event was raised.

Cisco IOS Embedded Event Manager Command Reference

33
 A through action snmp Commands
action info

Built-in Variable Description

$_info_syslog_freq_match_count_[1-N] The number of times that a syslog message matches the pattern
specified by this syslog event specification since event registration.

$_info_syslog_freq_raise_count_[1-N] The number of times that this syslog event was raised.

$_info_syslog_freq_occurs_[1-N] The number of occurrences needed in order to raise the event; if

not specified, the event is raised on the first occurrence.

$_info_syslog_freq_period_sec_[1-N] The number of occurrences must occur within this number of Posix
timer units in order to raise the event; if not specified, the period
check does not apply.

$_info_syslog_freq_period_msec_[1-N] The number of occurrences must occur within this number of Posix
timer units in order to raise the event; if not specified, the period
check does not apply.

action info syslog history

$_info_syslog_hist_num_entries The number of syslog history entries.

$_info_syslog_hist_msg_[1-N] The text of the syslog message.

$_info_syslog_hist_time_sec_[1-N] The seconds since January 1, 1970 which represent the time the
syslog message was logged.

$_info_syslog_hist_time_msec_[1-N] The milliseconds since January 1, 1970 which represent the time
the syslog message was logged.

Examples The following example shows how to configure an EEM applet to intercept configuration commands
that attempt to access any loopback interface. The applet also performs a no shutdown command
on the interface that is selected, and logs a message with the number of times that any “interface
loopback” has been attempted. The console output is shown with the configuration because the final
line displays the log message.

Note CLI commands that are issued from within a policy do not participate in CLI event pattern matching,
and this prevents recursion.

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# event manager applet cli-match
Router(config-applet)# event cli pattern ".*interface Loopback.*" sync yes
Router(config-applet)# action 1.0 cli command "enable"
Router(config-applet)# action 1.1 cli command "$_cli_msg"
Router(config-applet)# action 1.2 cli command "no shutdown"
Router(config-applet)# action 1.3 info type cli frequency
Router(config-applet)# action 1.4 syslog msg "There have been
$_info_cli_freq_match_count_1 '$_info_cli_freq_pattern_1' matches."

Router(config-applet)# set 1.5 _exit_status 0

Router(config-applet)# end

Cisco IOS Embedded Event Manager Command Reference

34
 A through action snmp Commands
action info type interface-names

Router#
00:37:30: %SYS-5-CONFIG_I: Configured from console by console
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# interface loopback0
Router(config)#
00:37:43: %HA_EM-6-LOG: cli-match: There have been 27 '.*interface Loopback.*' matches.

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action info type interface-names

To obtain interface names when an Embedded Event Manager (EEM) applet is triggered, use the action info
type interface-namescommand in applet configuration mode. To disable the action of obtaining interface
names, use the no form of this command.

action label info type interface-names [{include string-operator | exclude string-operator | regexp
regular-expression}]
no action label info type

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains
embedded blanks, enclose it in double quotation marks.

include (Optional) Includes all interface names that contain the string pattern.

exclude (Optional) Excludes all interface names that contain the string pattern.

string-operator (Optional) String pattern for including or excluding the interface names.

regexp (Optional) Obtains all the interfaces that match the specified regular expression.

regular-expression (Optional) Regular expression pattern. For example, [^abc].

Command Default All the current interface names are obtained from the database.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The action info type interface-namescommand obtains the current interface names and stores them as a
space-separated list in the $_info_interface_names built-in variable.

Cisco IOS Embedded Event Manager Command Reference

35
 A through action snmp Commands
action info type snmp getid

Examples The following example shows how to specify that interface names that include “eth” are obtained:

Router# configure terminal

Router(config)# event manager applet interface-app
Router(config-applet)# action 1.2 info type interface-names include eth

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action info type snmp getid

To retrieve the individual variables from a Simple Network Management Protocol (SNMP) entity during the
SNMP get operation, use the action info type snmp getidcommand in applet configuration mode. To disable
the retrieving of individual variables from SNMP, use the no form of this command.

action label info type snmp getid oid-value [community community-string] [ipaddr ip-address]
no action label info type

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

getid Retrieves SNMP variables.

oid-value Object ID value of the data element, in SNMP dotted notation. An object identifier is
expressed as a series of integers or text strings. For example, the object name for the
interfaces MIB can be expressed as 1.3.6.1.2.1.2 or iso.internet.mgmt.mib-2.interfaces.
An OID is defined as a type in the associated MIB,
CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value. Monitoring
of some OID types is supported. The following types are valid:
• INTEGER_TYPE
• COUNTER_TYPE
• GAUGE_TYPE
• TIME_TICKS_TYPE
• COUNTER_64_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE

community (Optional) Specifies the community string to access the SNMP entity.

Cisco IOS Embedded Event Manager Command Reference

36
 A through action snmp Commands
action info type snmp getid

community-string (Optional) SNMP community string. Community string functions like passwords to
access the SNMP entity. The string can consist of 1 to 32 alphanumeric characters and
can be set to any of the following types of community strings:
• ro --Sets the read-only access to the SNMP entity. The default value for this
community string is public.
• rw --Sets read-write access to the SNMP entity. The default value for this
community string is private.

ipaddr (Optional) Specifies the IP address of the SNMP entity.

ip-address (Optional) IP address of Network Management System (NMS) from which the objects
are retrieved for SNMP get and set operations.

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The table below shows the built-in variables in which the variables retrieved from the SNMP get operation
are stored.

Table 4: EEM Built-in Variables for action info Command

Built-in Variable Description

$_info_snmp_sysname_oid The OID value of the sysName variable.

$_ info_snmp_sysname_value The value string for the sysName variable.

$_info_snmp_syslocation_oid The OID value of the sysLocation variable.

$_info_snmp_syslocation_value The value string for the sysLocation variable.

$_info_snmp_sysdescr_oid The OID value of the sysDescr variable.

$_info_snmp_sysdescr_value The value string for the sysDescr variable.

$_info_snmp_sysobjectid_oid The OID value of the sysObjectID variable.

$_info_snmp_sysobjectid_value The value string for the sysObjectID variable.

$_info_snmp_sysuptime_oid The OID value of the sysUptime variable.

$_info_snmp_sysuptime_value The value string for the sysUptime variable.

$_info_snmp_syscontact_oid The OID value of the sysContact variable.

$_info_snmp_syscontact_value The value string for the sysContact variable.

Examples The following example shows how to retrieve the sysDescr.0 variable from an SNMP entity:

Cisco IOS Embedded Event Manager Command Reference

37
 A through action snmp Commands
action info type snmp inform

Router(config)# event manager applet

Router(config-applet)# action 1.3 info type snmp getid 1.3.6.1.2.1.1.1.0 community public
ipaddr 172.17.16.69
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

snmp-server community Sets the community access string to enable access to the SNMP entity.

action info type snmp inform

To send Simple Network Management Protocol (SNMP) inform requests when an Embedded Event Manager
(EEM) applet is triggered, use the action info type snmp informcommand in applet configuration mode. To
disable the sending of SNMP inform requests, use the no form of this command.

action label info type snmp inform trap-oid trap-oid-value trap-var trap-variable community
community-string ipaddr ip-address
no action label info type

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

trap-oid Specifies the object identifier of the object generating the SNMP trap.

trap-oid-value The OID value of the object generating the SNMP trap.

trap-var Specifies the variable associated with the instance of the object generating the trap.

trap-variable The variable value of the object generating SNMP trap.

community Specifies the community string to access the SNMP entity.

community-string SNMP community string. Community string functions like passwords to access the
SNMP entity. The string can consist of 1 to 32 alphanumeric characters and can be set
to any of the following:
• ro --Sets the read-only access to the SNMP entity. The default value for this
community string is public.
• rw --Sets read-write access to the SNMP entity. The default value for this
community string is private.

ipaddr Specifies the IP address of the SNMP entity.

ip-address IP address of Network Management System (NMS) from which the objects are retrieved
for SNMP get and set operations.

Command Default No SNMP inform requests are sent by default.

Cisco IOS Embedded Event Manager Command Reference

38
 A through action snmp Commands
action info type snmp oid

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines SNMP inform requests are the SNMP notifications that alert the SNMP manager to a network condition and
request for confirmation of receipt from the SNMP manager.

Examples The following example shows how to send an SNMP inform request:

Router(config)# event manager applet

Router(config-applet)# action 1.4 info type snmp inform trap-oid 1.3.6.1.4.1.1.226.0.2.1
trap-var sysUpTime community public ipaddr 172.69.16.2
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

snmp-server community Sets the community access string to enable access to the SNMP entity.

snmp-server enable traps Enables all SNMP notification types available on your system.

action info type snmp oid

To specify the type of Simple Network Management Protocol (SNMP) get operation and the object to retrieve
during the SNMP set operation, when an Embedded Event Manager (EEM) applet is triggered, use the action
info type snmp oidcommand in applet configuration mode. To disable this function, use the no form of this
command.

action label info type snmp oid oid-value {get-type {exact | next} [community community-string]
| set-type oid-type oid-type-value community community-string} [ipaddr ip-address]
no action label info type

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

oid Requests the value of the SNMP object as specified by the SNMP object identifier (OID).

Cisco IOS Embedded Event Manager Command Reference

39
 A through action snmp Commands
action info type snmp oid

oid-value Object ID value of the data element, in SNMP dotted notation. An object identifier is
expressed as a series of integers or text strings. For example, the object name for the
interfaces MIB can be expressed as 1.3.6.1.2.1.2 or iso.internet.mgmt.mib-2.interfaces.
An OID is defined as a type in the associated MIB,
CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value. Monitoring
of some OID types is supported. The following types are valid:
• INTEGER_TYPE
• COUNTER_TYPE
• GAUGE_TYPE
• TIME_TICKS_TYPE
• COUNTER_64_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE

get-type Specifies the type of SNMP get operation to apply to the object ID specified by the
oid-value argument.
• exact --(Optional) Retrieves the object ID specified by the oid-value argument.
• next --(Optional) Retrieves the object ID that is the alphanumeric successor to the
object ID specified by the oid-value argument.

community Specifies the community string to access the SNMP entity.

community-string SNMP community string. Community string functions like passwords to access the SNMP
entity. The string can consist of 1 to 32 alphanumeric characters and can be set to any of
the following:
• ro --Sets the read-only access to the SNMP entity. The default value for this
community string is public.
• rw --Sets read-write access to the SNMP entity. The default value for this community
string is private.

set-type Specifies the type of object to retrieve during the SNMP set operation. To perform a set
operation, you need to specify the OID, OID type, and value.

Cisco IOS Embedded Event Manager Command Reference

40
 A through action snmp Commands
action info type snmp oid

oid-type The type of OID. The following values are valid:

• counter32 --A 32-bit number with a minimum value of 0. When the maximum value
is reached, the counter resets to 0.
• gauge --A 32-bit number with a minimum value of 0. For example, the interface
speed on a router is measured using a gauge object type.
• integer --A 32-bit number used to specify a numbered type within the context of a
managed object. For example, to set the operational status of a router interface, 1
represents up and 2 represents down.
• ipv4 --IP version 4 address.
• octet string --An octet string in hexadecimal notation used to represent physical
addresses.
• string --An octet string in text notation used to represent text strings.
• unsigned32 --A 32-bit number used to represent decimal value.

oid-type-value Integer or text string value of the OID type specified for the SNMP set operation. The
valid values for each OID type are:
• counter --Integer value in the range from 0 to 4294967295.
• gauge-- Integer value in the range from 0 to 4294967295.
• integer-- Integer value in the range from 0 to 4294967295.
• ipv4-- IPv4 address in dotted decimal notation.
• octet string --Text string.
• string-- Text string.
• unassigned32-- Unsigned integer value in the range from 0 to 4294967295.

ipaddr (Optional) Specifies the IP address of the SNMP entity.

ip-address (Optional) IP address of Network Management System (NMS) from which the objects
are retrieved for SNMP get and set operations.

Command Default No requests for SNMP set or get operations are sent when the EEM applet is triggered.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

Cisco IOS Embedded Event Manager Command Reference

41
 A through action snmp Commands
action info type snmp trap

Release Modification

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.4(22)T The set-type, community,and ipaddr keywords were added.

Usage Guidelines The SNMP set operation sets individual variables in the SNMP entity, whereas the SNMP get operation
retrieves individual variables from the SNMP entity.
The table below shows the built-in variables in which the results of SNMP get and set operations are stored.

Table 5: EEM Built-in Variables for action info Command

Built-in Variable Description

$_info_snmp_oid The SNMP object ID.

$_info_snmp_value The value string of the associated SNMP data element.

Examples The following example shows how to retrieve individual variables of an object from the SNMP
entity:

Router(config)# event manager applet

Router(config-applet)# action 1.3 info type snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type
exact community public ipaddr 172.17.16.69
Router(config-applet)#

The following example shows how to set an individual variable in the SNMP entity:

Router(config)# event manager applet

Router(config-applet)# action 1.4 info type snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 set-type
integer 42220 sysName.0 community public ipaddr 172.17.16.69
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

snmp-server community Sets the community access string to enable access to the SNMP entity.

action info type snmp trap

To send Simple Network Management Protocol (SNMP) trap requests when an Embedded Event Manager
(EEM) applet is triggered, use the action info type snmp trapcommand in applet configuration mode. To
disable the sending of SNMP trap requests, use the no form of this command.

action label info type snmp trap enterprise-oid enterprise-oid-value generic-trapnum

generic-trap-number specific-trapnum specific-trap-number trap-oid trap-oid-value trap-var
trap-variable

Cisco IOS Embedded Event Manager Command Reference

42
 A through action snmp Commands
action info type snmp trap

no action label info type

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains
embedded blanks, enclose it in double quotation marks.

trap Sends SNMP trap requests.

enterprise-oid Specifies the enterprise OID value of the object.

enterprise-oid-value Enterprise OID value of the object generating the SNMP trap. The OID value is
enterprise specific and is expressed as a series of integers or text strings.

generic-trapnum Specifies the generic SNMP trap number.

generic-trap-number The generic trap number. The following generic traps and trap numbers are valid:
• coldStart (0)
• warmStart (1)
• linkDown (2)
• linkUp (3)
• authenticationFaliure(4)
• egpNeighborLoss(5)
• enterpriseSpecific (6)

specific-trapnum Specifies the enterprise-specific trap if the generic trap number is not set to 6.

specific-trap-number The number associated with the trap specific to an enterprise event.

trap-oid Specifies the object identifier of the object generating the SNMP trap.

trap-oid-value The OID value of the object generating the SNMP trap.

trap-var Specifies the variable associated with the instance of the object generating the trap.

trap-variable The variable value of the object generating SNMP trap.

Command Default No SNMP trap requests are sent by default.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Cisco IOS Embedded Event Manager Command Reference

43
 A through action snmp Commands
action info type snmp var

Usage Guidelines Traps are SNMP notifications that alert the SNMP manager or the NMS to a network condition. Unlike SNMP
inform requests, traps do not request the receipt from the SNMP manager.

Examples The following example shows how to send an SNMP trap request:

Router(config)# event manager applet

Router(config-applet)# action 1.4 info type snmp trap enterprise-oid 1.3.6.1.4.1.1
generic-trapnum 4 specific-trapnum 7 trap-oid 1.3.6.1.4.1.1.226.0.2.1 trap-var sysUpTime
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

snmp-server enable traps Enables all SNMP notification types available on your system.

action info type snmp var

To create a variable for a Simple Network Management Protocol (SNMP) object identifier (OID) and its value
from an Embedded Event Manager (EEM) applet, use the action info type snmp varcommand in applet
configuration mode. To remove the variable, use the no form of this command.

action label info type snmp var variable-name oid oid-value oid-type oid-type-value
no action label info type

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

var Specifies the SNMP variable or the object instance of the SNMP MIB object.

variable-name Name of the SNMP variable. For example, sysDescr.0.

oid Requests the value of the SNMP object as specified by the SNMP OID.

Cisco IOS Embedded Event Manager Command Reference

44
A through action snmp Commands
action info type snmp var

oid-value Object ID value of the data element, in SNMP dotted notation. An object identifier is
expressed as a series of integers or text strings. For example, the object name for the
interfaces MIB can be expressed as 1.3.6.1.2.1.2 or iso.internet.mgmt.mib-2.interfaces.
An OID is defined as a type in the associated MIB,
CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value. Monitoring
of some OID types is supported. The following types are valid:
• INTEGER_TYPE
• COUNTER_TYPE
• GAUGE_TYPE
• TIME_TICKS_TYPE
• COUNTER_64_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE

oid-type The type of OID. The following values are valid:

• counter32 --A 32-bit number with a minimum value of 0. When the maximum value
is reached, the counter resets to 0.
• gauge --A 32-bit number with a minimum value of 0. For example, the interface speed
on a router is measured using a gauge object type.
• integer --A 32-bit number used to specify a numbered type within the context of a
managed object. For example, to set the operational status of a router interface, 1
represents up and 2 represents down.
• ipv4 --IP version 4 address.
• octet string --An octet string in hex notation used to represent physical addresses.
• string --An octet string in text notation used to represent text strings.
• unsigned32 --A 32-bit number used to represent decimal value.

oid-type-value Integer or text string value of the OID type specified for creating a variable. The valid
values for each OID type are:
• counter --Integer value in the range from 0 to 4294967295.
• gauge-- Integer value in the range from 0 to 4294967295.
• integer-- Integer value in the range from 0 to 4294967295.
• ipv4-- IPv4 address in dotted decimal notation.
• octet string --Text string.
• string-- Text string.
• unassigned32-- Unsigned integer value in the range from 0 to 4294967295.

Cisco IOS Embedded Event Manager Command Reference

45
 A through action snmp Commands
action mail

Command Default No variables are created by default when an EEM applet is triggered.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines A variable is identified by its OID and its instance. The instance is generally specified by appending a .0 to
its OID. For example, sysDescr.0.

Examples The following example shows how to create a variable for an object identifier:

Router(config)# event manager applet

Router(config-applet)# action 1.3 info type snmp var sysDescr.0 oid
1.3.6.1.4.1.9.9.48.1.1.1.6.1 integer 4220
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action mail
To specify the action of sending a short e-mail when an Embedded Event Manager (EEM) applet is triggered,
use the action mail command in applet configuration mode. To remove the action mailcommand from the
configuration, use the no form of this command.

action label mail server server-address to to-address from from-address [cc cc-address] subject
subject body body-text port port-number secure {none | tls} source-address {ipv4-address
ipv6-address} source-interface interface-type interface-number vrf vrf-name
no action label mail server server-address to to-address from from-address [cc cc-address]
subject subject body body-text port port-number secure {none | tls} source-address {ipv4-address
ipv6-address} source-interface interface-type interface-number vrf vrf-name

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in
ascending alphanumeric key sequence using the label as the sort key. If the
string contains embedded blanks, enclose it in double quotation marks.

server Specifies the e-mail server to be used for forwarding the e-mail. The e-mail
server address can be any one of the following template formats:
• username:password@host
• username@host
• host

Cisco IOS Embedded Event Manager Command Reference

46
 A through action snmp Commands
action mail

server-address An optional username and password with the fully qualified domain name
of the e-mail server to be used to forward the e-mail.

to Indicates that a recipient e-mail address is specified.

to-address E-mail address where the e-mail is to be sent.

from Indicates that the originating e-mail address is specified.

from-address E-mail address from which the e-mail is sent.

cc (Optional) Indicates that a copy e-mail address is specified.

cc-address (Optional) E-mail address additional to the recipient listed in the

to-addresswhere the message is to be sent.

subject Specifies the subject line content of the e-mail.

subject Alphanumeric string. If the string contains embedded blanks, enclose it in

double quotation marks.

body Specifies the text content of the e-mail.

body-text Alphanumeric string. If the string contains embedded blanks, enclose it in

double quotation marks.

port port-number Specifies the Simple Mail Transfer Protocol (SMTP) port number. Range for
the port-number argument is from 1 to 65535.

secure Specifies the SMTP security settings.

none Specifies that no SMTP security settings are needed.

tls Species the SMTP transport layer security (TLS) settings.

source-address ipv4-address Specifies the IPv4 or IPv6 address of the source.

ipv6-address

source-interface Specifies the source interface.

interface-type Interface type. For more information, use the question mark (?) online help
function.

interface-number Interface or subinterface number. For more information about the numbering|
syntax for your networking device, use the question mark (?) online help
function.

vrfvrf-name Specifies a VPN routing and forwarding (VRF) instance.

Command Default No e-mails are sent.

Command Modes
Applet configuration (config-applet)

Cisco IOS Embedded Event Manager Command Reference

47
 A through action snmp Commands
action mail

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.4(22)T This command was modified. The server-address argument was modified to include an
optional username and password.

15.2(2)T This command was modified. The port, secure, none, tls, and vrf keywords were added.

15.1(1)SY This command was integrated into Cisco IOS Release 15.1(1)SY.

Usage Guidelines Use the action mail command when an event occurs about which you want to send an e-mail message, such
as informing an administrator about the event.
In EEM 3.0 for Cisco IOS Release 12.4(22)T, the server-address argument includes an optional username
and password along with the fully qualified domain name of the e-mail server to be used to forward the e-mail.
The e-mail server name can be in any one of the following template formats:
• username:password@host
• username@host
• host

For example, username:123456@mailserver.cisco.com, or username@mailserver.cisco.com, or

mailserver.cisco.com. If a username is supplied, the router will attempt to authenticate using the LOGIN
AUTH dialog. If no username is supplied, no authentication is performed.

Examples The following example shows how to send an e-mail when an EEM applet executes. The applet
named EventInterface is triggered every time the receive_throttle counter for Fast Ethernet interface
0/0 is incremented by 5. The polling interval to check the counter is specified to run once every 90
seconds. When the applet is triggered, a syslog message and an e-mail are sent.

Router(config)# event manager applet EventInterface

Router(config-applet)# event interface name FastEthernet0/0 parameter receive_throttle
entry-op ge entry-val 5 entry-val-is-increment true poll-interval 90
Router(config-applet)# action 1.0 syslog msg "Applet EventInterface"
Router(config-applet)# action 1.1 mail server mailserver.example.com to example1@example.com

from example2@example.com cc example-manager@example.com

subject "Receive_throttle counter incremented" body "Receive_throttle counter for
FastEthernet0/0 interface has incremented by 5"

The following example shows how to configure SMTP secure TLS settings:

Cisco IOS Embedded Event Manager Command Reference

48
 A through action snmp Commands
action multiply

Router# configure terminal

Router(config)# event manager applet TEST
Router(config-applet)# event none
Router(config-applet)# action 1.0 mail from example1@example.com to example2@example.com
subject "Hello EEM World" body "I am a Router" server root:example@smtp-server.example.com
port 587 secure tls
Router(config-applet)# end

The following example shows how to configure SMTP custom port settings:

Router(config)#event manager applet TEST

Router(config-applet)#event none
Router(config-applet)#action 1.0 mail from Router@cisco.com to user@cisco.com
subject "Hello EEM World" body "I am Router" server root:lab@smtp-server.cisco.com port 465

Router(config-applet)#end

Related Commands Command Description

event interface Specifies the event criteria for an EEM applet that is run on the basis of a generic
interface counter crossing a threshold or reaching exit criteria.

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action multiply
To specify the action of multiplying the variable value with a specified given integer value when an Embedded
Event Manager (EEM) applet is triggered, use the action multiply command in applet configuration mode.
To remove the calculation process, use the no form of this command.

action label multiply [{long-integer-1variable-name-1}] [{long-integer-2variable-name-2}]

no action label multiply

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

long-integer-1 (Optional) First integer value for the multiplication.

variable-name-1 (Optional) First variable name for the multiplication. The value stored in the multiplier
variable-name must be a long integer value or else the action will fail.

long-integer-2 (Optional) Second integer value for the multiplication.

variable-name-2 (Optional) Second variable name for the multiplication. The value stored in the multiplier
variable-name must be a long integer value or else the action will fail.

Command Default If the command is not entered within applet configuration mode, the respective applet is not registered when
you exit the configuration.

Cisco IOS Embedded Event Manager Command Reference

49
 A through action snmp Commands
action multiply

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action multiplycommand to multiply the value of the variable with a given integer value. All arithmetic
calculations are performed as long integers without any checks for overflow. If a statement is not associated
with this applet, events are still triggered without any action or result. A warning message stating that no
statements are associated with this applet is displayed at the exit time of the configuration. All the results of
the action multiply command are stored in $_result.
To provide a consistent user interface for the customers between the Tool Command Language (Tcl) and the
CLI applet-based EEM policies, the following criteria are followed:
• Event specification criteria are written in Tcl in the Tcl-based implementation.
• Event specification data are written using the CLI applet submode configuration statements in the
applet-based implementation.

Some of the keywords appear to be longer than necessary or hyphenated in the applet-based implementation
because the Tcl-based implementation was developed and deployed first.
To enter applet configuration mode, use the event manager applet applet-name command after entering
global configuration mode. In applet configuration mode the config prompt changes to (config-applet)# .
Applet configuration mode supports three types of configuration statements:
• event --Specifies the event criteria that causes this applet to run.
• action --Performs a built-in action.
• set --Sets an applet variable (currently _exit_status is the only variable supported).

Examples The following example shows how to multiply the stored variable value.

Router(config)# event manager applet action

Router(config-applet)# action label2 multiply 23 25

Related Commands Command Description

action add Adds the value of the variable by the given value when an EEM applet is triggered.

action divide Divides the value of the variable by the given value when an EEM applet is triggered.

action subtract Subtracts the value of the variable by the given value when an EEM applet is triggered.

Cisco IOS Embedded Event Manager Command Reference

50
 A through action snmp Commands
action policy

action policy
To specify the action of manually running an Embedded Event Manager (EEM) policy when an EEM applet
is triggered, use the action policycommand in applet configuration mode. To remove the action policycommand
from the configuration, use the no form of this command.

action label policy policy-filename

no action label policy policy-filename

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

policy-filename Name of the EEM policy to be run manually. The policy must be previously registered
using the event none command and must not be the same as the current policy.

Command Default No EEM policies are run.

Command Modes
Applet configuration

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Usage Guidelines EEM usually schedules and runs policies on the basis of an event specification that is contained within the
policy itself. The event none command allows EEM to identify an EEM policy that can be run manually or
when an EEM applet is triggered. To run the policy, use either the action policy command in applet
configuration mode or the event manager run command in global configuration mode.

Examples The following example shows how to register a policy named policy-manual to be run manually and
then to execute the policy:

Router(config)# event manager applet policy-manual

Router(config-applet)# event none policy-manual
Router(config-applet)# action label1 policy policy-manual

Related Commands Command Description

event manager run Manually runs a registered EEM policy.

Cisco IOS Embedded Event Manager Command Reference

51
 A through action snmp Commands
action publish-event

Command Description

event none Registers an EEM applet that is to be run manually.

show event manager policy registered Displays registered EEM policies.

action publish-event
To specify the action of publishing an application-specific event when the event specified for an Embedded
Event Manager (EEM) applet is triggered, use the action publish-eventcommand in applet configuration
mode. To remove the action of publishing an application-specific event, use the no form of this command.

action label publish-event sub-system sub-system-id type event-type arg1 argument-data [arg2
argument-data] [arg3 argument-data] [arg4 argument-data]
no action label publish-event

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

sub-system Specifies an identifier for the subsystem named in the sub-system-id argument that will
publish the application event.

sub-system-id Identifier of the subsystem. Number in the range from 1 to 4294967295. If the event is
to be published by an EEM policy, the sub-system-id reserved for a customer policy is
798.

type Specifies the value of an event type within the specified event.

event-type Event type value. Number in the range from 1 to 4294967295.

arg1 Specifies that argument data is to be passed to the application-specific event when the
event is published.

argument-data Character text, an environment variable, or a combination of the two. Optional when used
with the arg2, arg3, or arg4 keywords.

arg2 arg3 arg4 (Optional) Specifies that argument data is to be passed to the application-specific event
when the event is published.

Command Default No application-specific events are published.

Command Modes
Applet configuration

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

Cisco IOS Embedded Event Manager Command Reference

52
 A through action snmp Commands
action puts

Release Modification

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Examples The following example shows how a policy named EventPublish_A runs every 20 seconds and
publishes an event to a well-known EEM event type numbered 1. A second policy named
EventPublish_B is registered to run when the well-known EEM event type of 1 occurs. When policy
EventPublish_B runs, it outputs a message to syslog containing the argument 1 argument data passed
from EventPublish_A.

Router(config)# event manager applet EventPublish_A

Router(config-applet)# event timer watchdog time 20.0
Router(config-applet)# action 1.0 syslog msg "Applet EventPublish_A"
Router(config-applet)# action 2.0 publish-event sub-system 798 type 1 arg1 twenty
Router(config-applet)# exit
Router(config)# event manager applet EventPublish_B
Router(config-applet)# event application sub-system 798 type 1
Router(config-applet)# action 1.0 syslog msg "Applet EventPublish_B arg1
$_application_data1"

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action puts
To enable the action of printing data directly to the local tty when an Embedded Event Manager (EEM) applet
is triggered, use the action putscommand in applet configuration mode. To disable this function, use the no
form of this command.

action label puts [nonewline] string

no action label puts

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

nonewline (Optional) Suppresses the display of the new line character.

string Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

Cisco IOS Embedded Event Manager Command Reference

53
 A through action snmp Commands
action regexp

Command Default Data is not printed to the local tty.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The action puts command applies to synchronous events. The output of this command for a synchronous
applet is directly displayed to the tty, bypassing the syslog. This command defaults to the syslog for
asynchronous events. The nonewline keyword suppresses the display of the new line character. The output
of the action puts command for an asynchronous applet is directed to the logger.

Examples The following example shows how to print data directly to the local tty:

Router(config-applet)# event manager applet puts

Router(config-applet)# event none
Router(config-applet)# action 1 regexp "(.*) (.*) (.*)" "one two three" _match _sub1
Router(config-applet)# action 2 puts "match is $_match"
Router(config-applet)# action 3 puts "submatch 1 is $_sub1"
Router# event manager run puts
match is one two three
submatch 1 is one
Router#

Related Commands Command Description

action gets Gets input from the local tty and stores the value in the given variable.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action regexp
To match a regular expression pattern on an input string when an Embedded Event Manager (EEM) applet
is triggered, use the action regexpcommand in applet configuration mode. To disable this function, use the
no form of this command.

action label regexp string-pattern string-input [string-match [string-submatch1] [string-submatch2]

[string-submatch3]]
no action label regexp

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string-pattern The sequence of characters to be used for regular expression pattern matching.

Cisco IOS Embedded Event Manager Command Reference

54
 A through action snmp Commands
action regexp

string-input The sequence of characters to be used as input.

string-match (Optional) The variable name to store the entire match.

string-submatch (Optional) The variable name to store any submatches that are present. A maximum of
three submatch strings can be specified.

Command Default No regular expression patterns are matched.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The string-pattern argument is a regular expression. If some part of the string matches the pattern, it returns
1; otherwise it returns 0. The optional string-match and string-submatch arguments store the results of the
match.
The table below shows the built-in variable in which the results of the action regexpcommand are stored.

Table 6: EEM Built-in Variables for action regexp Command

Built-in Variable Description

$_regexp_result The result of the regular expression pattern matching is stored in this variable.

Examples The following example shows how to define a regular expression match:

Router(config-applet)# event manager applet regexp

Router(config-applet)# event none
Router(config-applet)# action 1 regexp "(.*) (.*) (.*)" "one two three" _match _sub1
Router(config-applet)# action 2 puts "match is $_match"
Router(config-applet)# action 3 puts "submatch 1 is $_sub1"
Router# event manager run regexp
match is one two three
submatch 1 is one
Router#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

55
 A through action snmp Commands
action reload

action reload
To specify the action of reloading the Cisco IOS software when an Embedded Event Manager (EEM) applet
is triggered, use the action reloadcommand in applet configuration mode. To remove the action of reloading
the Cisco IOS software, use the no form of this command.

action label reload

no action label reload

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

Command Default No reload of the Cisco IOS software is performed.

Command Modes
Applet configuration

Command History Release Modification

12.0(26)S This command was introduced.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.3(2)XE This command was integrated into Cisco IOS Release 12.3(2)XE.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Usage Guidelines Before configuring the action reload command, you should ensure that the device is configured to reboot the
software version that you are expecting. Use the show startup-config command and look for any boot
systemcommands.

Examples The following example shows how to reload the Cisco IOS software when the memory-fail applet
is triggered:

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op
lt entry-val 5120000 poll-interval 10
Router(config-applet)# action 3.0 reload

Cisco IOS Embedded Event Manager Command Reference

56
 A through action snmp Commands
action set (EEM)

Related Commands Command Description

boot system Configures the locations from which the router loads software when the router
reboots.

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

show startup-config Displays the configuration to be run when the router reboots.

action set (EEM)

To set the value of a variable when an Embedded Event Manager (EEM) applet is triggered, use the action
setcommand in applet configuration mode. To remove the value of an EEM applet variable, use the no form
of this command.

action label set variable-name variable-value

no action label set

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

variable-name Name assigned to the variable to be set.

variable-value Value of the variable.

Command Default No variable value is set.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced. This command replaces the set (EEM) command.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action set command to set the value of a variable when an EEM applet is triggered.

Examples The following example shows how to set the value of a variable:

Router(config-applet)# event manager applet set

Router(config-applet)# event none
Router(config-applet)# action 1 set str “this is some text”
Router(config-applet)# action 2 string range “$str” 0 6
Router(config-applet)# action 3 puts “$_string_result”
Router# event manager run set
“this is”
Router#

Cisco IOS Embedded Event Manager Command Reference

57
 A through action snmp Commands
action snmp-object-value

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action snmp-object-value
To set the object ID and value to be returned by the Simple Network Management Protocol (SNMP) get
request when an Embedded Event Manager (EEM) applet is triggered, use the action snmp-object-value
command in applet configuration mode. To disable this function, use the no form of this command.

action label snmp-object-value oid-type oid-type-value next-oid oid-value

no action label

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

oid-type The type of OID. The following values are valid:

• counter --A 32-bit number with a minimum value of 0. When the maximum value is
reached, the counter resets to 0.
• counter64 --A 64-bit number with a minimum value of 0.
• gauge --A 32-bit number with a minimum value of 0. A gauge object type is used, for
example, to measure the interface speed on a router.
• int --A 32-bit number used to specify a numbered type within the context of a managed
object. For example, to set the operational status of a router interface, use 1 for “up”
and 2 for “down”.
• ipv4 --IP version 4 address.
• octet --An octet string in hex notation used to represent physical addresses.
• oid --SNMP object identifier (object ID) in dotted notation.
• string --An octet string in text notation used to represent text strings.
• uint --A 32-bit number used to represent decimal value.

Cisco IOS Embedded Event Manager Command Reference

58
 A through action snmp Commands
action snmp-object-value

oid-type-value Integer or text string value of the OID type specified for the SNMP set operation. The valid
values for each OID type are:
• counter --Integer value in the range from 0 to 4294967295.
• counter64 --Text string.
• gauge --Integer value in the range from 0 to 4294967295.
• int --Integer value in the range from 0 to 4294967295.
• ipv4 --IPv4 address in dotted decimal notation.
• octet --Text string.
• oid --Text string.
• string --Text string.
• uint --Unsigned integer value in the range from 0 to 4294967295.

next-oid Requests the value of the next SNMP object as specified by the SNMP OID.

oid-value Object ID value of the data element, in SNMP dotted notation. An object identifier is expressed
as a series of integers or text strings. For example, the object name for the interfaces MIB
can be expressed as 1.3.6.1.2.1.2 or iso.internet.mgmt.mib-2.interfaces.
An OID is defined as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB,
and each type has an object value. Monitoring of some OID types is supported. The following
types are valid:
• COUNTER_64_TYPE
• COUNTER_TYPE
• GAUGE_TYPE
• INTEGER_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE
• TIME_TICKS_TYPE

Command Default By default, no object ID or value is specified.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

15.0(1)M This command was introduced.

15.1(3)T This command was modified. The oid keyword was added.

Cisco IOS Embedded Event Manager Command Reference

59
 A through action snmp Commands
action snmp-trap

Usage Guidelines Use the action snmp-object-value command to set the object ID and value to be returned for the SNMP get
request.

Examples The following example shows how to set the object ID and value to be returned by the SNMP get
request.

Router# configure terminal

Router(config)# event manager applet action
Router(config-applet)# event snmp-object oid 1.9.9.9.9 type gauge sync yes
Router(config-applet)# action 1 syslog msg "oid = $_snmp_oid"
Router(config-applet)# action 2 syslog msg "request = $_snmp_request"
Router(config-applet)# action 3 syslog msg "request_type = $_snmp_request_type"
Router(config-applet)# action 4 syslog msg "value = $_snmp_value"
Router(config-applet)# action 5 snmp-object-value gauge 1111 next-oid 1.2.3.4
Router(config-applet)# action 6 exit 1

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action snmp-trap
To specify the action of generating a Simple Network Management Protocol (SNMP) trap when an Embedded
Event Manager (EEM) applet is triggered, use the action snmp-trapcommand in applet configuration mode.
To remove the action of generating an SNMP trap, use the no form of this command.

action label snmp-trap [intdata1 integer] [intdata2 integer] [strdata string]

no action label snmp-trap

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded blanks,
enclose it in double quotation marks.

intdata1 (Optional) Specifies an integer to be sent in the SNMP trap message to the SNMP agent.

intdata2 (Optional) Specifies a second integer to be sent in the SNMP trap message to the SNMP agent.

integer (Optional) Integer value.

strdata (Optional) Specifies a string to be sent in the SNMP trap message to the SNMP agent.

string (Optional) Sequence of up to 256 characters. If the string contains embedded blanks, enclose it
in double quotation marks.

Command Default No SNMP traps are generated when an EEM applet is triggered.

Command Modes
Applet configuration

Cisco IOS Embedded Event Manager Command Reference

60
 A through action snmp Commands
action snmp-trap

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Usage Guidelines Before configuring this command, you must enable the snmp-server enable traps event-manager command
to permit SNMP traps to be sent from the Cisco IOS device to the SNMP server. Other relevant snmp-server
commands must also be configured.
This command generates an asynchronous message that is sent from the Cisco IOS device to the SNMP agent.
The SNMP agent can be coded to understand customized data such as the optional integer and string data that
can be sent in the SNMP trap message.
The SNMP trap that is generated uses the EEM MIB, CISCO-EMBEDDED-EVENT-MGR-MIB.my. Details
about the MIB can be found using Cisco MIB Locator at the following URL:
http://www.cisco.com/go/mibs

Examples The following example shows an EEM applet called IPSLAping1 being registered to run when there
is an exact match on the value of a specified SNMP object ID that represents a successful IP SLA
ICMP echo operation (this is equivalent to a ping command). Four actions are triggered when the
echo operation fails, and event monitoring is disabled until after the second failure. A message that
the ICMP echo operation to a server failed is sent to syslog, an SNMP trap is generated, EEM
publishes an application-specific event, and a counter called IPSLA1F is incremented by a value of
one.

Router(config)# event manager applet IPSLAping1

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.4 get-type exact
entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 5
Router(config-applet)# action 1.0 syslog priority critical msg "Server IP echo failed:
OID=$_snmp_oid_val"
Router(config-applet)# action 1.1 snmp-trap strdata "EEM detected server reachability
failure to 10.1.88.9"
Router(config-applet)# action 1.2 publish-event sub-system 88000101 type 1 arg1 10.1.88.9
arg2 IPSLAEcho arg3 fail
Router(config-applet)# action 1.3 counter name _IPSLA1F value 1 op inc

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and
enters applet configuration mode.

snmp-server enable traps Permits Embedded Event Manager SNMP traps to be sent from a
event-manager Cisco IOS device to the SNMP server.

Cisco IOS Embedded Event Manager Command Reference

61
 A through action snmp Commands
action snmp-trap

Cisco IOS Embedded Event Manager Command Reference

62
action string through D Commands
• action string through D Commands, on page 64

Cisco IOS Embedded Event Manager Command Reference

63
 action string through D Commands
action string through D Commands

action string through D Commands

action string compare
To compare two unequal strings when an Embedded Event Manager (EEM) applet is triggered, use the action
string comparecommand in applet configuration mode. To disable this function, use the no form of this
command.

action label string compare [nocase] [length integer] string1 string2

no action label string compare

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

nocase (Optional) Specifies case insensitive comparison.

length (Optional) Limits the comparison to the first integer character.

integer (Optional) Valid values for the length argument range from 1 to 4294967295.

string1 Sequence of characters.

string2 Sequence of characters.

Command Default Unequal strings are not compared.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines String comparisons are performed on a byte-by-byte basis from left to right. If the strings are of unequal
length, the longer string is compared greater than the shorter string. The action string compare command
forces a comparison between two unequal strings, which is followed by an integer comparison of the result
of the string comparison.
When two equal strings are compared, the result is 0 and when one string sorts before the other, the result is
-1. For all other comparisons the result is 1. If the strings being compared are converted to integers, the
comparison is performed between the results using the strcmp command.
The table below shows the built-in variable in which the results of the action string compare command are
stored.

Cisco IOS Embedded Event Manager Command Reference

64
 action string through D Commands
action string equal

Table 7: EEM Built-in Variables for action string compare Command

Built-in Variable Description

$_string_result The result of the action string compare command is stored in this variable.

Examples The following example shows how to compare two unequal strings:

Router(config-applet)# event manager applet compare

Router(config-applet)# event none
Router(config-applet)# action 1 set str "this contains some $str"
Router(config-applet)# action 2 string compare nocase length 3 “contains” “$str”

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string equal

To verify whether or not two strings are equal when an Embedded Event Manager (EEM) applet is triggered,
use the action string equalcommand in applet configuration mode. To disable this function, use the no form
of this command.

action label string equal [nocase] [length integer] string1 string2

no action label string equal

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

nocase (Optional) Specifies case insensitive comparison.

length (Optional) Specifies the length of the value to limit the comparison.

integer (Optional) Valid values for the length argument range from 1 to 4294967295.

string1 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

string2 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

Command Default Strings are not verified as equal.

Command Modes
Applet configuration (config-applet)

Cisco IOS Embedded Event Manager Command Reference

65
 action string through D Commands
action string first

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The action string equal command compares two strings and returns 1 if the strings are equal. Use nocase
for case insensitive comparison.
The table below shows the built-in variable in which the results of the action string equal command are
stored.

Table 8: EEM Built-in Variables for action string equal Command

Built-in Variable Description

$_string_result The result of the action string equal command is stored in this variable.

Examples The following example shows how to verify whether or not two strings are equal:

Router(config-applet)# event manager applet equal

Router(config-applet)# event none
Router(config-applet)# action 1 set str "this contains some data"
Router(config-applet)# action 2 string equal "contains" "data"

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string first

To return the index on the first occurrence of string1 within string2 when an Embedded Event Manager (EEM)
applet is triggered, use the action string first command in applet configuration mode. To disable this function,
use the no form of this command.

action label string first string1 string2 [index-value]

no action label string first

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string1 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

string2 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

index-value (Optional) The index value to start the first test. Number in the range from 0 to 4294967295.

Cisco IOS Embedded Event Manager Command Reference

66
 action string through D Commands
action string index

Command Default The index is not returned on the first occurrence of string1 within string2.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines On the first occurrence of string1, the index is placed in string2. If string1 is not found, it returns -1.
The table below shows the built-in variable in which the results of the action string first command are stored.

Table 9: EEM Built-in Variables for action string first Command

Built-in Variable Description

$_string_result The result of the action string first command is stored in this variable.

Examples The following example shows how to return the index on the first occurrence of string1 within
string2:

Router(config-applet)# event manager applet first

Router(config-applet)# event none
Router(config-applet)# action 1 set str "this contains some data"
Router(config-applet)# action 2 string first "contains" "$str"
Router(config-applet)# action 3 puts "$_string_result"
Router# event manager run first
5
Router#

Related Commands Command Description

action string last Returns the index on the last occurrence of string1 within string2.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string index

To return the characters specified at a given index value when an Embedded Event Manager (EEM) applet is
triggered, use the action string indexcommand in applet configuration mode. To disable this function, use
the no form of the command.

action label string index string [{valueend}]

no action label string index

Cisco IOS Embedded Event Manager Command Reference

67
 action string through D Commands
action string index

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

string Sequence of characters. If the string contains embedded blanks, enclose it in double quotation marks.

value (Optional) The index value. Number in the range from 0 to 4294967295. The count starts from 0.

end (Optional) Last character of the string.

Command Default The characters specified at a given index value are not returned.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The index count starts from zero. Use the end argument for the last character of the string.
The table below shows the built-in variable in which the action string index command stores the characters.

Table 10: EEM Built-in Variables for action string index Command

Built-in Variable Description

$_string_result The action string index command stores the characters in this variable.

Examples The following example shows how to return the character specified at a given index value:

Router(config-applet)# event manager applet index

Router(config-applet)# event none
Router(config-applet)# action 1 set str "this is text"
Router(config-applet)# action 2 string index "$str" 8
Router(config-applet)# action 3 puts "$_string_result"
Router# event manager run index
t
Router#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

68
 action string through D Commands
action string last

action string last

To return the index on the last occurrence of string1 within string 2 when an Embedded Event Manager (EEM)
applet is triggered, use the action string lastcommand in applet configuration mode. To disable this function,
use the no form of this command.

action label string last string1 string2 [index-value]

no action label string last

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string1 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

string2 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

index-value (Optional) The index value to start the last test. Number in the range from 0 to 4294967295.

Command Default The index is not returned on the last occurrence of string1 within string2.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines On the first occurrence of string1, the index is placed in string2. If string1 is not found, it returns -1.
The table below shows the built-in variable in which the results of the action string last command are stored.

Table 11: EEM Built-in Variables for action string last Command

Built-in Variable Description

$_string_result The result of the action string last command is stored in this variable.

Examples The following example shows how to return the index on the last occurrence of string1 within string2:

Router(config-applet)# event manager applet last

Router(config-applet)# event none
Router(config-applet)# action 1 set str "this contains some data"
Router(config-applet)# action 2 string last "contains" "$str"
Router(config-applet)# action 3 puts "$_string_result"
Router# event manager run last

Cisco IOS Embedded Event Manager Command Reference

69
 action string through D Commands
action string length

5
Router#

Related Commands Command Description

action string first Returns the index on the first occurrence of string1 within string2.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string length

To return the number of characters in a string when the Embedded Event Manager (EEM) applet is triggered,
use the action string lengthcommand in applet configuration mode. To disable this function, use the no form
of this command.

action label string length string

no action label string length

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

string Sequence of characters. If the string contains embedded blanks, enclose it in double quotation marks.

Command Default The number of characters in a string are not returned.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string length command to specify the action of returning the number of characters in a string
when an EEM applet is triggered.
The table below shows the built-in variable in which the results of the action string length command are
stored.

Table 12: EEM Built-in Variables for action string length Command

Built-in Variable Description

$_string_result The result of the action string length command is stored in this variable.

Examples The following example shows how to return the number of characters in a string:

Cisco IOS Embedded Event Manager Command Reference

70
 action string through D Commands
action string match

Router(config-applet)# event manager applet length

Router(config-applet)# event none
Router(config-applet)# action 1 set str "this contains some data"
Router(config-applet)# action 2 string length "contains"
Router(config-applet)# action 3 puts "$_string_result"
Router# event manager run length
8
Router#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string match

To return 1 to the $_string_result, if the string matches the pattern when an Embedded Event Manager (EEM)
applet is triggered, use the action string match command in applet configuration mode. To disable this action,
use the no form of this command.

action label string match [nocase] string-pattern string

no action label string match

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

nocase (Optional) Specifies case insensitive comparison.

string-pattern The pattern against which comparison is done. If you use a substring, ensure the following
symbols are used to indicate one or more wildcards:
• *–To match against more than one wildcard characters.
• ?– To match against a single wildcard character.

string Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

Command Default Results of the pattern matching of strings are not returned to the $_string_result.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Cisco IOS Embedded Event Manager Command Reference

71
 action string through D Commands
action string range

Usage Guidelines When the string matches the specified pattern, the result is 1; when the pattern does not match, the result is
0.
The table below shows the built-in variable in which the results of the action string matchcommand is stored.

Table 13: EEM Built-in Variables for action string match Command

Built-in Variable Description

$_string_result The result of the action string match command is stored in this variable.

Examples The following example shows how to return 1 to the $_string_result if the string matches the pattern:

Device(config-applet)# event manager applet test

Device(config-applet)# event none
Device(config-applet)# action 1 set str “NULL BBB”
Device(config-applet)# action 2 string match "*NULL*" "$str"
Device(config-applet)# action 3 puts "$_string_result"
Device(config-applet)# end
Device# event manager run test

1
Device#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string range

To store a range of characters in a string when an Embedded Event Manager (EEM) applet is triggered, use
the action string range command in a pplet configuration mode . To disable this function, use the no form
of this command.

action label string range string start-index end-index

no action label string range

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string Sequence of characters which can be up to 4294967295. If the string contains embedded blanks,
enclose it in double quotation marks.

start-index The starting index string value. The range is from 0 to 4294967295.

end-index The ending index string value. The range is from 0 to 4294967295.

Command Default A string is not stored.

Cisco IOS Embedded Event Manager Command Reference

72
 action string through D Commands
action string replace

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string range command to specify the action of storing a range of characters in a string when
an EEM applet is triggered. The start-index and end-indexarguments specify the range of the string on which
to operate.
The table below shows the built-in variable in which the result of the action string range command is stored.

Table 14: EEM Built-in Variables for action string range Command

Built-in Variable Description

$_string_result The result of the action string range command is stored in this variable.

Examples The following example shows how to store a range of characters in a specified string:

Router(config)# event manager applet store

Router(config-applet)#
action 1.0 set string “This is some text”
Router(config-applet)# action 2.0 string range “$string” 0 6
Router(config-applet)# action 3.0 puts “$_string_result”
Router(config-applet)# end
Router# event manager run store
this is
Router#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string replace

To store a new string by replacing the range of characters in the specified string when an Embedded Event
Manager (EEM) applet is triggered, use the action string replacecommand in applet configuration mode. To
disable this function, use the no form of this command.

action label string replace string start-index end-index [new-string]

no action label string replace

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

Cisco IOS Embedded Event Manager Command Reference

73
 action string through D Commands
action string replace

string Sequence of characters, which can be up to 4294967295. If the string contains embedded
blanks, enclose it in double quotation marks.

start-index The starting index string value. The range is from 0 to 4294967295.

end-index The ending index string value. The range is from 0 to 4294967295.

new-string (Optional) The sequence of characters that will replace the range of characters in the string.

Command Default A string is not stored.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string replace command to get a new string by replacing specific characters in a particular
string. If the value for new-string argument is not specified, the characters are replaced with white space.
The table below shows the built-in variable in which the result of the action string replace command is stored.

Table 15: EEM Built-in Variables for action string replace Command

Built-in Variable Description

$_string_result The result of the action string replace command is stored in this variable.

Examples The following example shows how to store the new string made by replacing the specific characters
in a string:

Router(config)# event manager applet replace

Router(config-applet)# event none
Router(config-applet)# action 1.0 set string “This is some text”
Router(config-applet)# action 2.0 string replace “$string” 0 6 “that was”
Router(config-applet)# action 3.0 puts “$_string_result”
Router (config-applet)# end
Router# event manager run replace
that was some text
Router#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

74
 action string through D Commands
action string tolower

action string tolower

To store a specific range of characters of a string in lowercase when an Embedded Event Manager (EEM)
applet is triggered, use the action string tolowercommand in applet configuration mode. To disable this
function, use the no form of this command.

action label string tolower string [start-index] [end-index]

no action label string tolower

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string The sequence of characters that needs to be replaced. If the string contains embedded blanks,
enclose it in double quotation marks.

start-index (Optional) The starting index string value. The range is from 0 to 4294967295.

end-index (Optional) The ending index string value. The range is from 0 to 4294967295.

Command Default A string is not stored.

Command Modes
Applet configuration (applet-config)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string tolower command to store a specific range of characters of a string in lowercase. The
start-index and end-index arguments specify the range of the string on which to operate.
The table below shows the built-in variable in which the result of the action string tolower command is
stored.

Table 16: EEM Built-in Variables for action string tolower Command

Built-in Variable Description

$_string_result The result of the action string tolower command is stored in this variable.

Examples The following example shows how to store a range of characters in a specific string in lowercase:

Router(config)# event manager applet lowercase

Router(config-applet)# action 1.0 set string “This is a STRING”
Router(config-applet)# action 2.0 string tolower “$string” 11 16
Router(config-applet)# action 3.0 puts “$_string_result”
Router(config-applet)# end
Router# event manager run lowercase

Cisco IOS Embedded Event Manager Command Reference

75
 action string through D Commands
action string toupper

string
Router#

Related Commands Command Description

action string toupper Stores a specific range of characters of a string in uppercase.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string toupper

To store a specific range of characters of a string in uppercase when an Embedded Event Manager (EEM)
applet is triggered, use the action string touppercommand in applet configuration mode. To disable this
function, use the no form of this command.

action label string toupper string [start-index] [end-index]

no action label string toupper

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string Specifies the sequence of characters, that needs to be replaced. If the string contains embedded
blanks, enclose it in double quotation marks.

start-index (Optional) The starting index string value. The range is from 0 to 4294967295.

end-index (Optional) The ending index string value. The range is from 0 to 4294967295.

Command Default A string is not stored.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string toupper command to store a specific range of characters of a string in uppercase. The
start-index and end-index arguments specify the range of the string on which to operate.
The table below shows the built-in variable in which the result of the action string toupper command is
stored.

Cisco IOS Embedded Event Manager Command Reference

76
 action string through D Commands
action string trim

Table 17: EEM Built-in Variables for action string toupper Command

Built-in Variable Description

$_string_result The result of the action string toupper command is stored in this variable.

Examples The following example shows how to store a range of characters in a specific string in uppercase:

Router(config)# event manager applet uppercase

Router(config-applet)# action 1.0 set string “This is a string”
Router(config-applet)# action 2.0 string toupper “$string” 11 16
Router(config-applet)# action 3.0 puts “$_string_result”
Router(config-applet)# end
Router# event manager run uppercase
STRING
Router#

Related Commands Command Description

action string tolower Stores a specific range of characters of a string in lowercase.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string trim

To trim a string when an Embedded Event Manager (EEM) applet is triggered, use the action string trim
command in applet configuration mode. To disable this function, use the no form of this command.

action label string trim string1 [string2]

no action label string trim

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

string1 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

string2 (Optional) Sequence of characters. If the string contains embedded blanks, enclose it in double
quotation marks.

Command Default By default, there is no action to trim a string.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

Cisco IOS Embedded Event Manager Command Reference

77
 action string through D Commands
action string trimleft

Release Modification

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string trim command to trim the characters in a string. This command trims the characters in
string2 from both ends of string1. By default, string2 corresponds to white space.
The table below shows the built-in variable in which the result of the action string trim command is stored.

Table 18: EEM Built-in Variables for action string trim Command

Built-in Variable Description

$_string_result The result of the action string trim command is stored in this variable.

Examples The following example shows how to trim a string:

Router(config)# event manager applet trim

Router(config-applet)# action 1.0 set string “Hello How are you?Hello”
Router(config-applet)# action 2.0 string trim “$string” “Hello ”
Router(config-applet)# action 3.0 puts “$_string_result”
Router(config-applet)# end
Router# event manager run trim
How are you?
Router#

Related Commands Command Description

action string trimleft Trims the characters by one string from the left end of another string.

action string trimright Trims the characters by one string from the right end of another string.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action string trimleft

To trim the characters of one string from the left end of another string when an Embedded Event Manager
(EEM) applet is triggered, use the action string trimleftcommand in applet configuration mode. To disable
this function, use the no form of this command.

action label string trimleft string1 [string2]

no action label string trimleft

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

string1 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

Cisco IOS Embedded Event Manager Command Reference

78
 action string through D Commands
action string trimleft

string2 (Optional) Sequence of characters. If the string contains embedded blanks, enclose it in double
quotation marks.

Command Default By default, there is no action to trim a string.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string trimleft command to trim a string from the left end of another string. This command
trims the characters specified by string2 from the left end of string1. By default, string2 corresponds to white
space.
The table below shows the built-in variable in which the result of the action string trimleft command is
stored.

Table 19: EEM Built-in Variables for action string trimleft Command

Built-in Variable Description

$_string_result The result of the action string trimleft command is stored in this variable.

Examples The following example shows how to trim a string from the left side of another string:

Router(config)# event manager applet trimleft

Router(config-applet)# action 1.0 set string “Hello How are you?”
Router(config-applet)# action 2.0 string trimleft “$string” “Hello ”
Router(config-applet)# action 3.0 puts “$_string_result”
Router(config-applet)# end
Router# event manager run trimleft
How are you?
Router#

Related Commands Command Description

action string trim Trims a string.

action string trimright Trims the characters by one string from the right end of another string.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

79
 action string through D Commands
action string trimright

action string trimright

To trim the characters one string from the right end of another string when an Embedded Event Manager
(EEM) applet is triggered, use the action string trimrightcommand in applet configuration mode. To disable
this function, use the no form of this command.

action label string trimright string1 [string2]

no action label string trimright

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric
key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in
double quotation marks.

string1 Sequence of characters. If the string contains embedded blanks, enclose it in double quotation
marks.

string2 (Optional) Sequence of characters. If the string contains embedded blanks, enclose it in double
quotation marks.

Command Default By default, there is no action to trim a string.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action string trimright command to trim a string from the right end of another string. This command
trims the characters specified by string2 from the right end of string1. By default, string2 corresponds to white
space.
The table below shows the built-in variable in which the result of the action string trimright command is
stored.

Table 20: EEM Built-in Variables for action string trimright Command

Built-in Variable Description

$_string_result The result of the action string trimright command is stored in this variable.

Examples The following example shows how to trim a string from the right side of another string:

Router(config)# event manager applet trimright

Router(config-applet)# action 1.0 set string “How are you? Hello”
Router(config-applet)# action 2.0 string trim “$string” “ Hello”
Router(config-applet)# action 3.0 puts “$_string_result”
Router(config-applet)# end
Router# event manager run trimright

Cisco IOS Embedded Event Manager Command Reference

80
 action string through D Commands
action subtract

How are you?

Router#

Related Commands Command Description

action string trim Trims a string.

action string trimleft Trims the characters by one string from the left end of another string.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

action subtract
To specify the action of subtracting the value of a variable from another value, when an Embedded Event
Manager (EEM) applet is triggered, use the action subtract command in applet configuration mode. To undo
the subtract action, use the no form of this command.

action label subtract {variable-namelong-integer} {variable-namelong-integer}

no action label subtract

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

subtract Subtracts the value of a variable from the value of another variable.

variable-name String value to be placed as the variable name.

long-integer Long integer value by which another value gets subtracted.

Command Default By default, there is no change in the value of variables configured within an EEM applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use this action to subtract the value of a variable from the value of another variable. The result is
stored in the variable named $_result. The value of the variable must be a long integer, else the action will
fail.

Examples The following example shows how to configure an EEM applet to subtract the value of a variable
from another value:

Router(config)#event manager applet one

Cisco IOS Embedded Event Manager Command Reference

81
 action string through D Commands
action syslog

Router(config-applet)#action 1.0 set $var1 20

Router(config-applet)#action 1.0 set $var2 10
Router(config-applet)#action 1.0 subtract $var1 $var2
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

action syslog
To specify the action of writing a message to syslog when an Embedded Event Manager (EEM) applet is
triggered, use the action syslogcommand in applet configuration mode. To remove the syslog message event
criteria, use the no form of this command.

action label syslog [priority priority-level] msg msg-text facility string

no action label syslog

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

priority (Optional) Specifies the priority level of the syslog messages. If this keyword is selected,
the priority-level argument must be defined. If this keyword is not selected, all syslog
messages are set at the informational priority level.

priority-level (Optional) Number or name of the desired priority level at which syslog messages are set.
Priority levels are as follows (enter the number or the keyword):
• {0 | emergencies}--System is unusable.
• {1 | alerts}--Immediate action is needed.
• {2 | critical}--Critical conditions.
• {3 | errors}--Error conditions.
• {4 | warnings}--Warning conditions.
• {5 | notifications}--Normal but significant conditions.
• {6 | informational}--Informational messages. This is the default.
• {7 | debugging}--Debugging messages.

msg Specifies the message to be logged.

msg-text Character text, an environment variable, or a combination of the two. If the string contains
embedded blanks, enclose it in double quotation marks.
Note Messages written to syslog from an EEM applet are not screened for EEM
syslog events, which may lead to recursive EEM syslog events. Messages sent
from an EEM applet include the applet name for identification.

Cisco IOS Embedded Event Manager Command Reference

82
 action string through D Commands
action syslog

facility string Specifies the facility.

Command Default No messages are written to syslog.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.0(26)S This command was introduced.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

15.0(1)M This command was modified. The facilitykeyword and the string argument were added.

Examples The following example shows how to specify a message to be sent to syslog when the memory-fail
applet is triggered:

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op
lt entry-val 5120000 poll-interval 10
Router(config-applet)# action 4.0 syslog msg "Memory exhausted; current available memory
is $_snmp_oid_val bytes"

The following example shows how to generate a syslog message when it detects a syslog message
pattern "console", using priority level 3 (errors) and facility EEM-FAC:

Router(config)# event manager applet test

Router(config-applet)# event syslog pattern "console"
Router(config-applet)# action 4.0 syslog priority errors facility
EEM-FAC
msg "TEST MSG"

Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

83
 action string through D Commands
action track read

action track read

To specify the action of reading the state of a tracked object when an Embedded Event Manager (EEM) applet
is triggered, use the action track readcommand in applet configuration mode. To remove the action track
read command from the configuration, use the no form of this command.

action label track read object-number

no action label track read object-number

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

object-number Tracked object number in the range from 1 to 500, inclusive. The number is defined using
the track stub command.

Command Default The state of a tracked object is not read.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(2)T This command was introduced.

12.2(31)SB3 This command was integrated into Cisco IOS Release 12.2(31)SB3.

12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI.

Usage Guidelines This command generates the following result variable:

• _track_state--State of the specified tracked object. The text string returned is either up or down. If the
state is up, it means that the object exists and is in an up state. If the state is down, it means that the object
either does not exist or is in a down state.

This command is used to help track objects using EEM. Each tracked object is identified by a unique number
that is specified on the tracking command-line interface (CLI). Client processes such as EEM use this number
to track a specific object. The tracking process periodically polls the tracked objects and notes any change of
value. The changes in the tracked object are communicated to interested client processes, either immediately
or after a specified delay. The object values are reported as either up or down. The enhanced object tracking
event detector publishes an EEM event when the tracked object changes.

Examples The following example shows how to specify event criteria based on a tracked object:

event manager applet track-ten

event track 10 state any
action 1.0 track set 10 state up
action 2.0 track read 10

Cisco IOS Embedded Event Manager Command Reference

84
 action string through D Commands
action track set

Related Commands Command Description

action track set Specifies the action of setting the state of a tracked object when an EEM applet is
triggered.

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

show track Displays tracking information.

track stub Creates a stub object to be tracked.

action track set

To specify the action of setting the state of a tracked object when an Embedded Event Manager (EEM) applet
is triggered, use the action track setcommand in applet configuration mode. To remove the action track set
command from the configuration, use the no form of this command.

action label track set object-number state {up | down}

no action label track set object-number state {up | down}

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

object-number Tracked object number in the range from 1 to 500, inclusive. The number is defined using
the track stub command.

state Specifies the state to which the tracked object will be set.

up Specifies that the state of the tracked object will be set to up.

down Specifies that the state of the tracked object will be set to down.

Command Default The state of a tracked object is not set.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(2)T This command was introduced.

12.2(31)SB3 This command was integrated into Cisco IOS Release 12.2(31)SB3.

12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI.

Usage Guidelines This command generates the following result variable:

Cisco IOS Embedded Event Manager Command Reference

85
 action string through D Commands
action while

• _track_state--State of the specified tracked object. The text string returned is either up or down. If the
state is up, it means that the object exists and is in an up state. If the state is down, it means that the object
either does not exist or is in a down state.

This command is used to help track objects using EEM. Each tracked object is identified by a unique number
that is specified on the tracking command-line interface (CLI). Client processes such as EEM use this number
to track a specific object. The tracking process periodically polls the tracked objects and notes any change of
value. The changes in the tracked object are communicated to interested client processes, either immediately
or after a specified delay. The object values are reported as either up or down. The enhanced object tracking
event detector publishes an EEM event when the tracked object changes.

Examples The following example shows how to specify event criteria based on a tracked object:

event manager applet track-ten

event track 10 state any
action 1.0 track set 10 state up
action 2.0 track read 10

Related Commands Command Description

action track read Specifies the action of reading the state of a tracked object when an EEM applet
is triggered.

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

show track Displays tracking information.

track stub Creates a stub object to be tracked.

action while
To identify the beginning of a loop of a conditional block when an Embedded Event Manager (EEM) applet
is triggered, use the action whilecommand in a pplet configuration mode . To disable this function, use the
no form of this command.

action label while string-op1 operator string-op2

no action label while

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

string-op1 Specifies the first operand.

Cisco IOS Embedded Event Manager Command Reference

86
 action string through D Commands
action while

operator Value used with the string-op1 and string-op2 operands that determines how the current counter
value is compared to the entry value or the exit value. Valid values are:
• gt --Greater than.
• ge --Greater than or equal to.
• eq --Equal to.
• ne --Not equal to.
• lt --Less than.
• le --Less than or equal to.

string-op2 The second operand.

Command Default No conditional block is specified.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the action while command to identify the beginning of a loop conditional block. If $_variable is found
within a string, it will be substituted before the expression is tested.

Examples The following example shows how to identify the beginning of a loop of a conditional block when
an EEM applet is triggered:

Router(config-applet)# action 1 set _i 2

Router(config-applet)# action 2 while $_i lt 10
Router(config-applet)# action 3 action syslog msg "i is $_i"
Router(config-applet)# action 4 end

Related Commands Command Description

action else Identifies the beginning of an else block in the if/else conditional block.

action elseif Identifies the beginning of the if/else conditional block.

action if Identifies the beginning of an if conditional block.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

87
 action string through D Commands
attribute (EEM)

attribute (EEM)
To specify a complex event for an Embedded Event Manager (EEM) applet, use the attributecommand in
trigger applet configuration mode. To remove the attributes, use the no form of this command.

attribute tag event-tag [occurs occurs-value]

no attribute tag event-tag [occurs occurs-value]

Syntax Description tag Specifies a tag using the event-tag argument that can be used with the attribute command
to associate an event.

event-tag String that identifies the tag.

occurs (Optional) Specifies the number of occurrences before an EEM event is triggered. If not
specified, an EEM event is triggered on the first occurrence.

occurs-value (Optional) Number in the range from 1 to 4294967295.

Command Default No complex events are specified for an EEM applet.

Command Modes
Trigger applet configuration (config-applet-trigger)

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines In the trigger applet configuration mode, up to eight attribute statements can be specified to build a complex
event. If no attribute statements are specified, the options in the trigger statement apply to the first event
defined in the applet.

Examples The following example shows how to use the attribute command to specify a complex events for
an EEM applet. In this example, the applet is run when the show bgp all command and any syslog
message that contains the string “COUNT” occurs within a period of 60 seconds.

Router(config)# event manager applet delay_50

Router(config-applet)# event
tag 1.0 cli pattern "show bgp all" sync yes occurs 32 period 60 maxrun 60
Router(config-applet)# event
tag 2.0 syslog pattern "COUNT"
Router(config-applet)# trigger occurs 1 delay 50
Router(config-applet-trigger)# correlate event 1.0 or event 2.0
Router(config-applet-trigger)# attribute tag 1.0 occurs 1
Router(config-applet-trigger)# attribute tag 2.0 occurs 1
Router(config-applet-trigger)# action 1.0 cli command "show memory"
Router(config-applet)# action 2.0 cli command "enable"
Router(config-applet)# action 3.0 cli command "config terminal"
Router(config-applet)# action 4.0 cli command " ip route 192.0.2.0 255.255.255.224 192.0.2.12"
Router(config-applet)# action 91.0 cli command "exit"
Router(config-applet)# action 99.0 cli command "show ip route | incl 192.0.2.5"

Cisco IOS Embedded Event Manager Command Reference

88
 action string through D Commands
description (EEM)

Related Commands Command Description

correlate Builds a single complex event.

trigger (EEM) Enters trigger applet configuration mode and specifies the multiple event configuration
statements for an EEM applet.

description (EEM)
To describe what an Embedded Event Manager (EEM) applet does, use the description (EEM) command in
applet configuration mode. To remove the description of an applet, use the no form of this command.

description line
no description

Syntax Description line A brief description of a policy, upto 240 characters.

Command Default By default, no description is specified for an applet.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

15.0(1)M This command was introduced.

Usage Guidelines Use this command to describe what an EEM applet does. It is valid to have applets without a description. The
Description of an applet can be added in any order, before or after any other applet configuration. Configuring
a new description for an applet that already has a description, overwrites the current description.

Examples The following example shows how to add or modify the description for an EEM:

Router(config)# event manager applet one

Router(config-applet)# description "This applet looks for the word count in syslog messages"
Router(config-applet)# event syslog pattern
"count"
Router(config-applet)# action 1 syslog msg hi

Related Commands Command Description

show event manager policy active Displays EEM policies that are executed.

show event manager policy available Displays EEM policies that are available to be registered.

Cisco IOS Embedded Event Manager Command Reference

89
 action string through D Commands
description (EEM)

Cisco IOS Embedded Event Manager Command Reference

90
E through event manager Commands
• E through event manager Commands, on page 92

Cisco IOS Embedded Event Manager Command Reference

91
 E through event manager Commands
E through event manager Commands

E through event manager Commands

event application
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of an
event raised through the EEM Event Publish application programming interface (API), use the event
applicationcommand in applet configuration mode. To remove the application event criteria, use the no form
of this command.

event [tag event-tag] application subsystem subsystem-id type event-type [maxrun

maxruntime-number]
no [tag event-tag] event application subsystem subsystem-id type event-type [maxrun
maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

2subsystem Specifies an identifier for the subsystem that will publish the application event.

subsystem-id Number in the range from 1 to 4294967295 that identifies the subsystem. When an
event is to be published by an EEM policy, the subsystem-id reserved for a policy is
798.

type Specifies an event type within the specified event.

event-type Integer in the range from 1 to 4294967295.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM event criteria are specified.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

Cisco IOS Embedded Event Manager Command Reference

92
 E through event manager Commands
event cli

Release Modification

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

Usage Guidelines An EEM event is triggered when an application calls the EEM Event Publish API with an event specification
that matches the subsystem ID and application event type.

Examples The following example shows how a policy named EventPublish_A runs every 20 seconds and
publishes an event to a well-known EEM event type numbered 1. A second policy named
EventPublish_B is registered to run when the well-known EEM event type of 1 occurs. When policy
EventPublish_B runs, it outputs a message to syslog containing data passed as an argument from
EventPublish_A.

Router(config)# event manager applet EventPublish_A

Router(config-applet)# event timer watchdog time 20.0
Router(config-applet)# action 1.0 syslog msg "Applet EventPublish_A"
Router(config-applet)# action 2.0 publish-event sub-system 798 type 1 arg1 twenty
Router(config-applet)# exit
Router(config)# event manager applet EventPublish_B
Router(config-applet)# event application subsystem 798 type 1
Router(config-applet)# action 1.0 syslog msg "Applet EventPublish_B arg1
$_application_data1"

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event cli
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by matching a Cisco
IOS command-line interface (CLI) command, use the event clicommand in applet configuration mode. To
remove the CLI command event criteria, use the no form of this command.

event [tag event-tag] cli pattern regular-expression [default] [enter] [questionmark] [tab] [{sync
{yes | no} | skip {yes | no}}] [mode variable] [occurs num-occurrences] [period period-value]
[maxrun maxruntime-number]
no event [tag event-tag] cli

Cisco IOS Embedded Event Manager Command Reference

93
 E through event manager Commands
event cli

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

pattern Specifies the regular expression used to perform the CLI command pattern match. The
CLI command must have been successfully parsed before the pattern match is attempted.
The pattern match is compared with the fully expanded CLI command string.

regular-expression Regular expression. If the expression contains embedded blanks, enclose it in double
quotation marks.

default (Optional) The time period during which the CLI event detector waits for the policy
to exit (specified in ssssssssss[.mmm] format, where ssssssssss must be an integer
representing seconds from 0 to 4294967295, and where mmm must be an integer
representing milliseconds from 0 to 999). If the default time period expires before the
policy exits, the default action will be executed. The default action is to run the
command. If this argument is not specified, the default time period is set to 30 seconds.

enter Specifies the event match when the user presses the Enter key.

questionmark Specifies the event match when the user presses the Questionmark key.

tab Specifies the event match when the user presses the Tab key.

sync Indicates whether the policy should be executed synchronously before the CLI command
executes.
• If the yes keyword is specified, the policy will run synchronously with the CLI
command.
• If the no keyword is specified, the policy will run asynchronously with the CLI
command.

skip Indicates whether the CLI command should be executed. This keyword is required if
the sync keyword is followed by the no keyword. If the sync keyword is followed by
the yes keyword, the skip keyword should not be specified.
• If the yes keyword is specified, the CLI command will not be executed.
• If the no keyword is specified, the CLI command will be executed. This is the
default.

Caution When the skip keyword is followed by the yes keyword, unintended results
may be produced if the pattern match is made for configuration commands
because the CLI command that matches the regular expression will not be
executed.

mode variable Specifies the CLI parser mode events for the keywords that follow.

occurs (Optional) Specifies the number of matching occurrences before an EEM event is
triggered. When a number is not specified, an EEM event is triggered after the first
match.

Cisco IOS Embedded Event Manager Command Reference

94
 E through event manager Commands
event cli

num-occurrences (Optional) Integer greater than 0 that specifies the number of occurrences.

period (Optional) Specifies a backward looking time window in which all CLI events must
occur (the occurs clause must be satisfied) in order for an event to be published
(specified in SSSSSSSSSS[.MMM] format, where SSSSSSSSSS must be an integer
representing seconds between 0 and 4294967295, inclusive, and where MMM must
be an integer representing milliseconds between 0 and 999). If this argument is not
specified, the most recent event is used.

period-value (Optional) Integer that represents seconds and optional milliseconds in the format
ssssssssss[.mmm]. Seconds is an integer in the range from 0 to 4294967295.
Milliseconds is an integer in the range from 0 to 999. When you specify milliseconds
only, use the format 0.mmm.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds from 0 to 31536000, and where mmm must
be an integer representing milliseconds between 0 and 999.

Command Default No EEM events are triggered on the basis of a match with a Cisco IOS CLI command.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

12.4(22)T The default, enter, mode, questionmark, and tab keywords were added to support CLI
parser-based events.

Usage Guidelines Use the event cli command to set up event criteria against which CLI commands are matched. CLI commands
are compared against a specified regular expression. After a specified number of matches occurs within a

Cisco IOS Embedded Event Manager Command Reference

95
 E through event manager Commands
event cli

specified time period, an EEM event is triggered. If multiple conditions exist, the EEM event is triggered
when all the conditions are met.
When the synckeyword is used, the event detector is notified when the policy completes running. The exit
status of the policy determines whether the CLI command will be executed. If the policy exit status is zero--the
policy ran successfully--the CLI command is not executed; otherwise the CLI command runs.
The EEM applet can accept four keywords to add CLI parser-based events. The behavior of these keywords
are as follows:
• The default keyword is used to perform the action during which the CLI event detector waits for the
policy to exit.
• The tab keyword is used to expand abbreviated commands or parameters. A new prompt line is displayed
with the expanded text.
• The questionmark keyword is used to display a list with help of valid commands or parameters. Help
is displayed first followed by a new prompt line.
• The enter keyword will parse and run the command.

Regular Expression Match

The CLI event detector screens CLI commands for a regular expression match. When a match is found, an
event is published. The match logic is performed on the fully expanded CLI command after the command is
successfully parsed and before it is executed. The CLI event detector supports three publish modes:
• Synchronous publishing of CLI events--The CLI command is not executed until the EEM policy exits,
and the EEM policy can control whether the command is executed. The read/write variable, _exit_status,
allows you to set the exit status at policy exit for policies triggered from synchronous events. If _exit_status
is 0, the command is skipped, if _exit_status is 1, the command is run.
• Asynchronous publishing of CLI events--The CLI event is published, and then the CLI command is
executed.
• Asynchronous publishing of CLI events with command skipping--The CLI event is published, but the
CLI command is not executed.

Examples The following configuration will prevent you to access the configuration mode. If the _exit_status
is not set to 1, the EEM policy will disable functionality in the router. To remove this configuration,
you may need to reload with unsaved configuration. It is possible to remove the event applet but all
unsaved configuration will be lost and a complete reconfiguration will be necessary.

event manager applet test_cli1

event cli pattern “config” sync yes
action 1.0 syslog msg “Config command is entered”
end

Caution Failure to set the exit_status to 1 will cause the default action which is to skip executing the CLI
command. This can lead to situations where the router has to be reloaded in order to continue
operations.

Cisco IOS Embedded Event Manager Command Reference

96
 E through event manager Commands
event cli

The following example shows how to specify an EEM applet to run when the Cisco IOS write
memory CLI command is run. The applet provides a notification via a syslog message that this event
has occurred. The _exit_status is set to 1.

Router(config)# event manager applet cli-match

Router(config-applet)# event cli pattern "write memory.*" sync yes
Router(config-applet)# action 1.0 syslog msg "$_cli_msg Command Executed"
Router(config-applet)# set 2.0 _exit_status 1

The following example shows how unintended results can be produced when using the skip keyword
followed by the yes keyword. When the skip keyword is followed by the yeskeyword, unintended
results may be produced if the pattern match is made for configuration commands because the CLI
command that matches the regular expression will not be executed. In this example, the first applet
(ap1) uses the skip keyword followed by the yes keyword to specify that any CLI command that
contains the show ip interfacepattern is not executed. This results in the second applet (ap2) being
configured without an event statement because it contains the show ip interface pattern.

Router(config)# event manager applet ap1

Router(config-applet)# event cli pattern "show ip interface" sync no skip yes occurs 1
period 5
Router(config-applet)# action 1 syslog msg "test 1"
Router(config-applet)# exit
Router(config)# event manager applet ap2
Router(config-applet)# event cli pattern "show ip interface" sync no skip no occurs 1
period 5
Router(config-applet)# action 1 syslog msg "test 2"
Router(config-applet)# end

The following example shows how CLI parser-based events can be generated:

Router(config)# event manager applet ap1

Router(config-applet)# event cli pattern "show ip interface"

The results are displayed on the screen. Note that the second line contains a message that no event
is configured for the EEM applet ap2. Use command CLI pattern matching with caution when the
skip and yes keywords are specified.

00:00:41: %HA_EM-6-LOG: ap1: test 1

00:00:41: %HA_EM-4-FMPD_NO_EVENT: No event configured for applet ap2
router#show run | beg event event manager applet ap1 event cli pattern "show ip
interface" sync no skip yes occurs 1 period 5 action 1 syslog msg "test 1"
event manager applet ap2
action 1 syslog msg "test 2"
!
end

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

97
 E through event manager Commands
event counter

event counter
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of a named
counter crossing a threshold, use the event countercommand in applet configuration mode. To remove the
counter event criteria, use the no form of this command.

event [tag event-tag] counter name counter-name entry-op operator entry-val entry-value [exit-op
operator] [exit-val exit-value] [maxrun maxruntime-number]
no event [tag event-tag] counter name counter-name entry-op operator entry-val entry-value
[exit-op operator] [exit-val exit-value] [maxrun maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

name Specifies that a counter will be monitored.

counter-name Name of the counter that will be monitored.

entry-op Compares the contents of the current counter value with the entry value using a
specified operator. If there is a match, an event is triggered and event monitoring is
disabled until the exit criteria are met.

operator Value used with the entry-op and exit-op keywords that determines how the current
counter value is compared to the entry value or the exit value. Valid values are:
• gt --Greater than.
• ge --Greater than or equal to.
• eq --Equal to.
• ne --Not equal to.
• lt --Less than.
• le --Less than or equal to.

entry-val Specifies the value with which the contents of the current counter are compared to
decide if a counter event should be raised.

entry-value Number in the range from -2147483648 to 2147483647, inclusive.

exit-op (Optional) Compares the contents of the current counter with the exit value using a
specified operator. If there is a match, an event is triggered and event monitoring is
reenabled.

exit-val (Optional) Specifies the value with which the contents of the current counter are
compared to decide whether the exit criteria are met.

exit-value (Optional) Number in the range from -2147483648 to 2147483647, inclusive.

Cisco IOS Embedded Event Manager Command Reference

98
 E through event manager Commands
event counter

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss [.mmm] format, where ssssssss
must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM events are triggered on the basis of a named counter crossing a threshold.

Command Modes
Event counter applet configuration (config-applet-event-counter)

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

Usage Guidelines An EEM event is triggered when the value of a specified counter crosses a defined threshold. Depending on
the operator, the threshold may be crossed when the value is greater than the threshold or when the value is
less than the threshold.
Use the event counter command with the action counter command when an event occurs periodically and
you want an action to be implemented after a specified number of occurrences of the event.
Exit criteria are optional. If exit criteria are not specified, event monitoring will be reenabled immediately. If
exit criteria are specified, event monitoring is not reenabled until the criteria are met.

Examples The following example shows that policy EventCounter_A is configured to run once a minute and
to increment a well-known counter called critical_errors. A second policy--EventCounter_B--is
registered to be triggered when the well-known counter called critical_errors exceeds a threshold of
3. When policy EventCounter_B runs, it resets the counter to 0.

Router(config)# event manager applet EventCounter_A

Router(config-applet)# event timer watchdog time 60.0
Router(config-applet)# action 1.0 syslog msg “EventCounter_A”

Cisco IOS Embedded Event Manager Command Reference

99
 E through event manager Commands
event gold

Router(config-applet)# action 2.0 counter name critical_errors value 1 op inc

Router(config-applet)# exit
Router(config)# event manager applet EventCounter_B
Router(config-applet)# event counter name critical_errors entry-op gt entry-val 3 exit-op
lt exit-val 3
Router(config-applet)# action 1.0 syslog msg “EventCounter_B”
Router(config-applet)# action 2.0 counter name critical_errors value 0 op set

Related Commands Command Description

action counter Sets or modifies a named counter when an Embedded Event Manager applet is
triggered.

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event gold
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of a
Generic Online Diagnostic (GOLD) failure event when monitoring one or more cards and optional subcards,
use the event gold command in applet configuration mode. To remove the report event criteria, use the no
form of this command.

event gold card {allcard-number} [subcard {allsubcard-number}] [new-failure {true | false}]

[severity-major] [severity-minor] [severity-normal] [action-notify {true | false}] [testing-type
{bootup | ondemand | schedule | monitoring}] [test-name test-name] [test-id test-id] [consecutive-failure
consecutive-failure-number] [platform-action action-flag-number] [maxrun maxruntime-number]
no event gold card {allcard-number} [subcard {allsubcard-number}] [new-failure {true | false}]
[severity-major] [severity-minor] [severity-normal] [action-notify {true | false}] [testing-type
{bootup | ondemand | schedule | monitoring}] [test-name test-name] [test-id test-id] [consecutive-failure
consecutive-failure-number] [platform-action action-flag-number] [maxrun maxruntime-number]

Syntax Description card Specifies that all or one card must be monitored. Either all or card-number must be
specified.
• all --Specifies that all cards are to be monitored. This is the default.
• card-number --Number of a specific card to be monitored.

Note The card keyword is required to complete the event goldcommand.

subcard (Optional) Specifies that one or more subcards are to be monitored. If the subcard
keyword is specified, then all or subcard-numbervalue must be specified.
• all --Specifies that all subcards are to be monitored.
• subcard-number-- Number of a subcard to be monitored.

If the subcard keyword is not specified, the default is all.

Cisco IOS Embedded Event Manager Command Reference

100
E through event manager Commands
event gold

new-failure (Optional) Specifies event criteria based on the new test failure information from GOLD.
If the new-failure keyword is specified, then the true or false keyword must be specified.
• true --Specifies that the event criteria for the new test failure is true from GOLD.
• false --Specifies that the event criteria for the new test failure is false from GOLD.

If the new-failure keyword is not specified, the new test failure information from GOLD
is not considered in the event criteria.

severity-major (Optional) Specifies that the event criteria for diagnostic result matches with diagnostic
major error from GOLD.

severity-minor (Optional) Specifies that the event criteria for diagnostic result matches with diagnostic
minor error from GOLD.

severity-normal (Optional) Specifies that the event criteria for diagnostic result matches with diagnostic
normal from GOLD. This is the default.

action-notify (Optional) Specifies the event criteria based on the action notify information from GOLD.
If the action-notify keyword is specified, then true or false keyword must be specified.
• true --Specifies that the event criteria for the action notify is true from GOLD.
• false --Specifies that the event criteria for the action notify is false from GOLD.

If the action-notify keyword is not specified, the action notify information from GOLD
is not considered in the event criteria.

testing-type (Optional) Specifies the event criteria based on the testing types of diagnostic from
GOLD. If the testing-type keyword is specified, then bootup, ondemand, schedule, or
monitoring must be specified.
• bootup --Specifies the diagnostic tests running on system bootup.
• ondemand --Specifies the diagnostic tests running from CLI after the card is online.
• schedule --Specifies the scheduled diagnostic tests.
• monitoring --Specifies the diagnostic tests that are running periodically in the
background to monitor the health of the system.

If the testing-type keyword is not specified, the testing type information from GOLD is
not considered in the event criteria and the policy applies to all the diagnostic testing
types.

test-name (Optional) Specifies the event criteria based on the test name. If the test-name keyword
is specified, then the test-namevalue must be specified.
• test-name --Name of the test.

If the test-name keyword is not specified, the test name information from GOLD is not
considered in the event criteria.

Cisco IOS Embedded Event Manager Command Reference

101
 E through event manager Commands
event gold

test-id (Optional) Specifies the event criteria based on test ID. Because the test ID can be different
for the same test on different line cards, usually the test-name keyword should be used
instead. If the test ID is specified and has conflicts with the specified test name, the test
name overwrites the test ID. If the test-id keyword is specified, the test-idvalue must be
specified.
• test-id-- ID number of the test. The limit is 65535.

If the test-id keyword is not specified, test ID information from GOLD is not considered
in the event criteria.

consecutive-failure (Optional) Specifies the event criteria based on consecutive test failure information from
GOLD. If the consecutive-failure keyword is specified, the
consecutive-failure-numbervalue must be specified.
• consecutive-failure-number-- Number of consecutive failures.

If the consecutive-failure keyword is not specified, consecutive test failure information

from GOLD is not considered in the event criteria.

platform-action (Optional) Specifies whether callback to the platform is needed when all the event criteria
are matched. When callback is needed, the platform needs to register a callback function
through the provided registry. If the platform-action keyword is specified, the
action-flag-number value must be specified.
• action-flag-number-- Number of the action flag that provides the platform with more
specific information when callback is performed. The action flag is platform specific.
It is up to the platform to determine what action needs to be taken based on the flag.
The maximum number is 65535.

If the platform-action keyword is not specified, there is no callback.

maxrun (Optional) Specifies the maximum runtime of the script. If the maxrunkeyword is
specified, the maxruntime-numbervalue must be specified.
• maxruntime-number-- Maximum runtime number in seconds. The maximum number
is 4294967295 seconds.

If the maxrunkeyword is not specified, the default runtime is 20 seconds.

Command Default No EEM event criteria are specified.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(18)SXF2 This command was introduced.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH The action-notify, testing-type, test-name, test-id, consecutive-failure, platform-action,

and the maxrunkeywords were added.

Cisco IOS Embedded Event Manager Command Reference

102
 E through event manager Commands
event identity

Release Modification

12.2(33)SB This command was integrated into Cisco IOS Release 12.2(33)SB.

Usage Guidelines You must enter the event gold command with the mandatory keyword card. For example, enter event gold
c ard specifying either the all keyword or the card-number attribute; otherwise the command is incomplete.
All other keywords are optional; however, once an optional keyword is specified, for example new-failure,
its corresponding true or false keyword mustbe specified (the value is not optional anymore). The same
principle is applicable for all other keywords that have specific values.

Examples The following example shows how to specify that an EEM applet runs when a new GOLD failure
event occurs for any card and any subcard. The applet sends a message to the CNS Event Bus to
state that a GOLD failure event has occurred.

Router(config)# event manager applet gold-match

Router(config-applet)# event gold card all subcard all new-failure true
Router(config-applet)# action 1.0 cns-event msg "A GOLD failure event has occurred”

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event identity
To publish an event after authentication, authorization or normal traffic has begun to flow on the interface,
use the event identitycommand in applet configuration mode. To disable the publishing of events, use the
no form of this command.

event [tag event-tag] identity interface {type number | regexp interface-name} [maxrun
maxruntime-number] [aaa-attribute attribute-name] [authc {all | fail | success}] [authz {all | fail |
success}] [authc-complete] [mac-address mac-address]
no event identity

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

interface Specifies the interface.

type number Interface type and number.

regexp interface-name Specifies a regular expression pattern to match against interface names.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword
is specified, the maxruntime-number value must be specified. If the maxrun
keyword is not specified, the default applet run time is 20 seconds.

Cisco IOS Embedded Event Manager Command Reference

103
 E through event manager Commands
event identity

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds from 0 to 31536000, and where mmm
must be an integer representing milliseconds between 0 and 999.

aaa-attribute (Optional) Specifies the regular expression pattern for AAA attributes.

attribute-name (Optional) AAA attribute name.

authc (Optional) Triggers events on successful, failed or both successful and failed
authentication. You must specify one of the following:
• all --Triggers an event in all cases of authentication.
• fail --Triggers an event if authentication fails.
• success --Triggers an event if authentication is successful.

authz (Optional) Trigger events on successful, failed or both successful and failed
authorization. You must specify one of the following:
• all --Triggers an event in all cases of authorization.
• fail --Triggers an event if authorization fails.
• success --Triggers an event if authorization is successful.

authz-complete (Optional) Triggers events once the device connected to the interface is fully
authenticated, authorized and normal traffic has begun to flow on that interface.

mac-address (Optional) Specifies the MAC address.

mac-address (Optional) The MAC address.

Command Default By default, no events are published.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(52)SE This command was introduced.

12.2(54)SG This command was integrated into Cisco IOS Release 12.2(54)SG.

Usage Guidelines You must specify an interface. You can specify any or all of the other keywords. The keywords can be used
in any combination.

Examples The following example shows how to publish an event when authorization is successful or failure
and when the device connected to the interface is fully authenticated, authorized and normal traffic
has begun to flow on that interface:

Router(config)# event manager applet identity

Cisco IOS Embedded Event Manager Command Reference

104
 E through event manager Commands
event interface

Router(config-applet)# event identity interface fastethernet0 authz all athuz-complete

Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event interface
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of a generic
interface counter crossing a threshold or reaching exit criteria, use the event interfacecommand in applet
configuration mode. To remove the interface event criteria, use the no form of this command.

event [tag event-tag] interface name interface-type interface-number parameter counter-name

entry-op operator entry-val entry-value entry-type {value | increment | rate} poll-interval
poll-int-value [exit-comb {or | and}] [exit-op operator exit-val exit-value] [exit-type {value |
increment | rate}] [exit-time exit-time-value] [average-factor average-factor-value] [maxrun
maxruntime-number]
no event [tag event-tag] interface name interface-type interface-number parameter counter-name
entry-op operator entry-val entry-value entry-type {value | increment | rate} poll-interval
poll-int-value [exit-comb {or | and}] [exit-op operator exit-val exit-value] [exit-type {value |
increment | rate}] [exit-time exit-time-value] [average-factor average-factor-value] [maxrun
maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the trigger
command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

name Specifies the type and number of the interface to monitor.

interface-type String that identifies the type of interface.

interface-number Integer value that identifies the interface.

parameter Specifies the name of the counter to monitor.

Cisco IOS Embedded Event Manager Command Reference

105
 E through event manager Commands
event interface

counter-name Name of the counter. Supported values for the counter-name argument are the following:
• input_errors --Includes runts, giants, no buffer, cyclic redundancy checksum
(CRC), frame, overrun, and ignored counts. Other input-related errors can also
cause the input errors count to be increased. Some datagrams may have more than
one error.
• input_errors_crc --Number of packets with a CRC generated by the originating
LAN station or remote device that do not match the checksum calculated from
the data received.
• input_errors_frame --Number of packets received incorrectly that have a CRC
error and a noninteger number of octets.
• input_errors_overrun --Number of times the receiver hardware was unable to
hand over received data to a hardware buffer because the input rate exceeded the
receiver’s ability to handle the data.
• input_packets_dropped --Number of packets dropped because of a full input
queue.
• interface_resets --Number of times an interface has been completely reset.

Cisco IOS Embedded Event Manager Command Reference

106
E through event manager Commands
event interface

• output_buffer_failures --Number of failed buffers and number of buffers swapped

out.
• output_buffer_swappedout --Number of packets swapped to Dynamic RAM
(DRAM).
• output_errors --Sum of all errors that prevented the final transmission of
datagrams out of the interface being examined. This may not balance with the
sum of the output errors because some datagrams may have more than one error
and other datagrams may have errors that do not fall into any of the specifically
tabulated categories.
• output_errors_underrun --Number of times the transmitter has been running
faster than the router can handle.
• output_packets_dropped --Number of packets dropped because of a full output
queue.
• receive_broadcasts --Number of broadcast or multicast packets received by the
interface.
• receive_giants --Number of packets that are discarded because they exceed the
maximum packet size of the medium.
• receive_rate_bps --Interface receive rate, in bytes per second.
• receive_rate_pps --Interface receive rate, in packets per second.
• receive_runts --Number of packets that are discarded because they are smaller
than the minimum packet size of the medium.
• receive_throttle --Number of times the receiver on the port was disabled, possibly
because of buffer or processor overload.
• reliability --Reliability of the interface, as a fraction of 255 (255 out of 255 is
100 percent reliability), calculated as an exponential average over 5 minutes.
• rxload --Receive rate of the interface, as a fraction of 255 (255 out of 255 is 100
percent).
• transmit_rate_bps --Interface transmit rate, in bytes per second.
• transmit_rate_pps --Interface transmit rate, in packets per second.
• txload --Transmit rate of the interface, as a fraction of 255 (255 out of 255 is 100
percent).

entry-op Compares the current interface counter value with the entry value using the specified
operator. If there is a match, an event is triggered and event monitoring is disabled until
the exit criteria are met.

Cisco IOS Embedded Event Manager Command Reference

107
 E through event manager Commands
event interface

operator Value used with the entry-opand exit-op keywords that determines how the current
counter value is compared with the entry value or the exit value. Valid values are:
• gt --Greater than
• ge --Greater than or equal to
• eq --Equal to
• ne --Not equal to
• lt --Less than
• le --Less than or equal to

entry-val Specifies the value with which the current interface counter value is compared to decide
entry-value if the interface event should be raised. Range is from -2147483648 to 2147483647.

entry-type Specifies a type of operation to be applied to the object ID specified by the entry-value
argument.

value Value is defined as the actual value of the entry-value or exit-valueargument.

increment Increment uses the entry-value or exit-valuefield as an incremental difference. The

entry-valueor exit-valueis compared with the difference between the current counter
value and the value when the event was last triggered (or the first polled sample if this
is a new event). A negative value checks the incremental difference for a counter that
is decreasing.

rate Rate is defined as the average rate of change over a period of time. The time period is
the average-factor-value multiplied by the poll-int-value. At each poll interval the
difference between the current sample and the previous sample is taken and recorded
as an absolute value. An average of the previous average-factor-value samples is taken
to be the rate of change.

poll-interval Specifies the time interval between consecutive polls. The default is 1 second.

poll-int-value Number that represents seconds and optional milliseconds in the format ssssss[.mmm].
The range for seconds is from 60 to 4294967295. The range for milliseconds is from
0 to 999. If using milliseconds, specify the milliseconds in the format s.mmm. The poll
interval value must not be less than 1 second. The default is 1 second.

exit-comb (Optional) Indicates the combination of exit conditions that must be met before event
monitoring is reenabled.

or Indicates that both exit-op or exit-val and exit-timevalues must exist

and Indicates that either exit-op or exit-val or exit-time values must exist

exit-op (Optional) Compares the contents of the current interface counter value with the exit
value using the specified operator. If there is a match, an event is triggered and event
monitoring is reenabled.

Cisco IOS Embedded Event Manager Command Reference

108
 E through event manager Commands
event interface

exit-val exit-value (Optional) Specifies the value with which the contents of the current interface counter
value are compared to decide whether the exit criteria are met. If an exit value is
specified, you must configure an exit operator. Range is from -2147483648 to
2147483647.

exit-type (Optional) Specifies a type of operation to be applied to the object ID specified by the
exit-value argument.

exit-time (Optional) Specifies the time period after which the event monitoring is reenabled. The
timing starts after the event is triggered.

exit-time-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in
the format 0.mmm.

average-factor (Optional) Specifies a number used to calculate the period used for rate-based
calculations. The average-factor-value is multiplied by the poll-int-value to derive the
period in milliseconds.

average-factor-value (Optional) Number in the range from 1 to 64. The minimum average factor value is 1.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword is
not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must
be an integer representing seconds between 0 and 31536000, and where mmm must
be an integer representing milliseconds between 0 and 999.

Command Default No EEM events are triggered on the basis of a generic interface counter crossing a threshold or reaching exit
criteria.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Cisco IOS Embedded Event Manager Command Reference

109
 E through event manager Commands
event interface

Release Modification

12.4(20)T This command was modified. The tag, entry-type, value, increment, rate, exit-type,
average-factor, and maxrunkeywords and associated arguments were added. The
entry-val-is-increment, true, false,and exit-val-is-increment keywords were removed.

Usage Guidelines An EEM event is triggered when one of the fields specified by an interface counter crosses a defined threshold.

Note While registering a policy, an interface can be configured using this command without being physically present
in the device but EEM does not begin any monitoring activity until the interface is physically present.

Exit criteria are optional. If you do not specify the exit criteria, event monitoring will be reenabled immediately.
If you specify the exit criteria, on the basis of values or time periods, event monitoring is not reenabled until
the exit criteria are met.
When you use the exit-comb keyword, the following criteria must be met:
• If you specify the or operator, an exit comparison operator and an exit object ID value, or an exit time
value must exist.
• If you specify the and operator, an exit comparison operator, an exit object ID value, and an exit time
value must exist.

Cisco IOS Releases 12.4(15)T, 12.2(33)SB, 12.2(33)SRA, and 12.2(33)SXH, and Prior Releases
The entry-val-is-incrementkeyword triggers one of the following actions:
• If you specify the true keyword, the entry-value is an increment and the interface event is raised whenever
the incremental value is reached.
• If you specify the false keyword, the entry-value is an actual value and the interface event is raised
whenever the actual value occurs. This is the default.

When the optional exit-val-is-increment keyword is used, the following occurs:

• If you specify the true keyword, the exit-value is an increment value and the event monitoring is reenabled
whenever the incremental value is reached.
• If you specify the false keyword, the exit-value is an actual value and the event monitoring is reenabled
whenever the actual value occurs. This is the default.

Cisco IOS Release 12.4(20)T and Later Releases

The entry-typekeyword triggers one of the following actions:
• If you specify the value keyword, the entry-value is an actual value and the interface event is raised
whenever the actual value occurs.
• If you specify the increment keyword, the entry-value is an increment and the interface event is raised
whenever the incremental value is reached.
• If you specify the rate keyword, the entry-value is a rate of change and the interface event is raised
whenever the rate of change value is reached.

Cisco IOS Embedded Event Manager Command Reference

110
 E through event manager Commands
event ioswdsysmon

When you use the optional exit-typekeyword, the following occurs:

• If you specify the value keyword, the exit-value is an actual value and the event monitoring is reenabled
whenever the actual value occurs. This is the default.
• If you specify the increment keyword, the exit-value is an increment and the event monitoring is reenabled
whenever the incremental value is reached.
• If you specify the rate keyword, the exit-value is a rate of change and the event monitoring is reenabled
whenever the rate of change value is reached.

Examples The following example shows how a policy named EventInterface is triggered every time the
receive_throttle counter for the FastEthernet interface 0/0 is incremented by 5. The polling interval
to check the counter is specified to run once every 90 seconds.

Router(config)# event manager applet EventInterface

Router(config-applet)# event interface name FastEthernet0/0 parameter receive_throttle
entry-op ge entry-val 5 entry-val-is-increment true poll-interval 90
Router(config-applet)# action 1.0 syslog msg "Applet EventInterface"

The following example shows how a policy named EventInterface_Load is triggered every time the
receive_rate_bps counter for the FastEthernet interface 0/0 reaches a rate of change of 10,000 with
an average factor of 10. The polling interval to check the counter is specified to run once every 120
seconds. This example is for a Cisco IOS Release 12.4(20)T or later image.

Router(config)# event manager applet EventInterface_Load

Router(config-applet)# event interface name FastEthernet0/0 parameter receive_rate_bps
entry-op ge entry-val 10000 entry-type rate poll-interval 120 average-factor 10
Router(config-applet)# action 1.0 syslog msg "Applet EventInterface_Load"

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event ioswdsysmon
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of Cisco
IOS system monitor counters crossing a threshold, use the event ioswdsysmoncommand in applet configuration
mode. To remove the event criteria, use the no form of this command.

event [tag event-tag] ioswdsysmon sub1 subevent1 [timewin timewin-value] [sub12-op {and | or}
sub2 subevent2] [maxrun maxruntime-number]
no [tag event-tag] event ioswdsysmon sub1 subevent1 [timewin timewin-value] [sub12-op {and |
or} sub2 subevent2] [maxrun maxruntime-number]

Subevent Syntax (for the subevent1 and subevent2 Arguments) for Cisco IOS Images
cpu-proc taskname task-name op operator val value [period period-value]
mem-proc taskname task-name op operator val value [is-percent {true | false}] [period
period-value]

Cisco IOS Embedded Event Manager Command Reference

111
 E through event manager Commands
event ioswdsysmon

Subevent Syntax (for the subevent1 and subevent2 Arguments) for Cisco IOS Software Modularity
Images
cpu-proc taskname task-name path pid op operator val value [period period-value]
mem-proc taskname task-name path pid op operator val value [is-percent {true | false}] [period
period-value]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

sub1 Specifies the first subevent.

subevent1 First subevent. Use the syntax shown under the Subevent Syntax heading.

timewin (Optional) Specifies the time window within which all the subevents must occur for
an event to be generated.

timewin-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in
the format 0.mmm.

sub12-op (Optional) Indicates the combination operator for comparison between subevent 1
and subevent 2.

and (Optional) Specifies that the results of both subevent 1 and subevent 2 must cross
the specified thresholds.

or (Optional) Specifies that the results of either subevent 1 or subevent 2 must cross the
specified thresholds.

sub2 (Optional) Specifies the second subevent.

subevent2 (Optional) Second subevent. Use the syntax shown under the Subevent Syntax heading.

Subevent Syntax

cpu-proc Specifies the use of a sample collection of CPU statistics.

mem-proc Specifies the use of a sample collection of memory statistics.

taskname Specifies a Cisco IOS task name.

Note In Cisco IOS Release 12.2(18)SXF4 and later releases, Software Modularity
images contain POSIX processes, and Cisco IOS processes were renamed
as tasks.

task-name Name of the Cisco IOS task to be monitored. If the value of the task-name argument
contains embedded blanks, enclose it in double quotation marks.

Cisco IOS Embedded Event Manager Command Reference

112
 E through event manager Commands
event ioswdsysmon

path (Supported only in Software Modularity images) Specifies a Cisco IOS Software
Modularity path and process name.
Note In Cisco IOS Release 12.2(18)SXF4 and later releases, Software Modularity
images contain POSIX processes, and Cisco IOS processes were renamed
as tasks.

pid (Supported only in Software Modularity images) Process ID of the Software

Modularity process to be monitored.

op Compares the collected CPU or memory usage sample with the value specified in
the value argument.

operator Two-character string. The operatorargument takes one of the following values:
• gt --Greater than
• ge --Greater than or equal to
• eq --Equal to
• ne --Not equal to
• lt --Less than
• le --Less than or equal to

val Specifies the value with which the collected CPU or memory usage sample is
compared to decide if the subevent should be raised.

value Number in the range from 1 to 4294967295.

period (Optional) Specifies the elapsed time period for the collection samples to be averaged.

period-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If only milliseconds are used, the format is 0.mmm.
If the time period is 0, the most recent sample is used.

is-percent (Optional) Indicates whether the value argument is a percentage.

true (Optional) Specifies that the value argument is a percentage.

false (Optional) Specifies that the value argument is not a percentage.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM events are triggered on the basis of Cisco IOS system monitor counters.

Cisco IOS Embedded Event Manager Command Reference

113
 E through event manager Commands
event ipsla

Command Modes
Applet configuration (config-applet).

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 The path keyword and pid argument were added and this command was integrated into
Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

Usage Guidelines An EEM event is triggered when one of the Cisco IOS system monitor counters crosses a defined threshold.
Depending on the operator, the threshold may be crossed when the value exceeds the threshold or when the
value is less than the threshold.
If a match is found when the opkeyword is used, a subevent is triggered.

Examples The following example shows how to configure a policy to trigger an applet when the total amount
of memory used by the process named “IP RIB Update” has increased by more than 50 percent over
the sample period of 60 seconds:

Router(config)# event manager applet IOSWD_Sample3

Router(config-applet)# event ioswdsysmon sub1 mem-proc taskname “IP RIB Update” op gt val
50 is-percent true period 60
Router(config-applet)# action 1 syslog msg “IOSWD_Sample3 Policy Triggered”

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event ipsla
To publish an event when an IP SLAs operation is triggered for an Embedded Event Manager (EEM) applet,
use the event ipsla command in applet configuration mode. To disable publishing events when an IP SLAs
reaction gets triggered, use the no form of this command.

Cisco IOS Embedded Event Manager Command Reference

114
 E through event manager Commands
event ipsla

event [tag event-tag] ipsla {group-name name [operation-id operation-id-value] | operation-id

operation-id-value [group-name name]} [dest-ip-address ip-address] [reaction-type type] [maxrun
maxruntime-number]
no event [tag event-tag] ipsla

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the trigger
command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

group-name Specifies the IP SLAs group ID.

name Name of the IP SLAs group.

operation-id Specifies the IP SLAs operation ID.

operation-id-value Number in the range from 1 to 2147483647.

dest-ip-address (Optional) Specifies the destination IP address for which the IP SLAs events are
monitored.

ip-address (Optional) Specifies the IP address of the destination port.

reaction-type (Optional) Specifies the reaction to be taken for the specified IP SLAs operation.

type (Optional) Type of IP SLAs reaction. One of the following keywords can be specified:
• connectionLoss --Specifies that a reaction should occur if there is a one-way
connection loss for the monitored operation.
• icpif --Specifies that a reaction should occur if the one-way Calculated Planning
Impairment Factor (ICPIF) value violates the upper threshold or lower threshold.
• jitterAvg --Specifies that a reaction should occur if the average round-trip jitter
value violates the upper threshold or lower threshold.
• jitterDSAvg --Specifies that a reaction should occur if the average one-way
destination-to-source jitter value violates the upper threshold or lower threshold.
• jitterSDAvg --Specifies that a reaction should occur if the average one-way
source-to-destination jitter value violates the upper threshold or lower threshold.
• maxOfNegativeDS --Specifies that a reaction should occur if the one-way
maximum negative jitter destination-to-source threshold is violated.
• maxOfNegativeSD --Specifies that a reaction should occur if the one-way
maximum negative jitter source-to-destination threshold is violated.

Cisco IOS Embedded Event Manager Command Reference

115
 E through event manager Commands
event ipsla

• maxOfPositiveDS --Specifies that a reaction should occur if the one-way maximum

positive jitter destination-to-source threshold is violated.
• maxOfPositiveSD --Specifies that a reaction should occur if the one-way maximum
positive jitter source-to-destination threshold is violated.
• mos --Specifies that a reaction should occur if the one-way Mean Opinion Score
(MOS) value violates the upper threshold or lower threshold.
• packetLateArrival --Specifies that a reaction should occur if the one-way number
of late packets violates the upper threshold or lower threshold.
• packetLossDS --Specifies that a reaction should occur if the one-way
destination-to-source packet loss value violates the upper threshold or lower
threshold.
• packetLossSD --Specifies that a reaction should occur if the one-way
source-to-destination packet loss value violates the upper threshold or lower
threshold.
• packetMIA --Specifies that a reaction should occur if the one-way number of
missing packets violates the upper threshold or lower threshold.
• packetOutOfSequence --Specifies that a reaction should occur if the one-way
number of packets out of sequence violates the upper threshold or lower threshold.
• rtt --Specifies that a reaction should occur if the round-trip time violates the upper
threshold or lower threshold.
• timeout --Specifies that a reaction should occur if there is a one-way timeout for
the monitored operation.
• verifyError --Specifies that a reaction should occur if there is a one-way error
verification violation.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword is
not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss [.mmm ] format, where ssssssss
must be an integer representing seconds from 0 to 31536000, and where mmm must be
an integer representing milliseconds from 0 to 999.

Command Default No events are published when IP SLAs operations are triggered.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Cisco IOS Embedded Event Manager Command Reference

116
 E through event manager Commands
event manager applet

Usage Guidelines An EEM event is published when an IP SLAs reaction is triggered. Either the group-name or the operation-id
must be specified. The remaining parameters are optional.

Examples The following example shows how to publish an event when an IP SLAs operation is triggered. In
this example, the group named grp1 pings the destination server 209.165.200.221 over the current
interface every three seconds. If there is no response, the operation is timed out.

Router# configure terminal

Router(config)# event manager applet EventIPSLA
Router(config-applet)# event ipsla group-name grp1 dest-ip-address 209.165.200.221
reaction-type timeout maxrun 3

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

event manager applet

To register an applet with the Embedded Event Manager (EEM) and to enter applet configuration mode, use
the event manager applet command in global configuration mode. To unregister the applet, use the no form
of this command.

event manager applet applet-name [authorization bypass] [class class-options] [trap]

no event manager applet applet-name [authorization bypass] [class class-options] [trap]

Syntax Description applet-name Name of the applet file.

authorization (Optional) Specifies AAA authorization type for applet.

bypass (Optional) Specifies EEM AAA authorization type bypass.

class (Optional) Specifies the EEM policy class.

class-options (Optional) The EEM policy class. You can specify either one of the following:
• class-letter-- Letter from A to Z that identifies each policy class. You can specify any
one class-letter.
• default --Specifies the policies registered with the default class.

trap (Optional) Generates a Simple Network Management Protocol (SNMP) trap when the
policy is triggered.

Command Default No EEM applets are registered.

Command Modes
Global configuration (config)

Cisco IOS Embedded Event Manager Command Reference

117
 E through event manager Commands
event manager applet

Command History Release Modification

12.0(26)S This command was introduced.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.3(2)XE This command was integrated into Cisco IOS Release 12.3(2)XE.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(22)T The class and trap keywords and the class-options argument were added.

15.0(1)M The command was modified. The authorization and bypass keywords were added.

Usage Guidelines An EEM applet is a concise method for defining event screening criteria and the actions to be taken when
that event occurs.
Only one event configuration command is allowed within an applet configuration. When applet configuration
submode is exited and no event command is present, a warning is displayed stating that no event is associated
with this applet. If no event is specified, this applet is not considered registered and the applet is not displayed.
When no action is associated with this applet, events are still triggered but no actions are performed. Multiple
action applet configuration commands are allowed within an applet configuration. Use the show event manager
policy registered command to display a list of registered applets.
Before modifying an EEM applet, use the no form of this command to unregister the applet because the
existing applet is not replaced until you exit applet configuration mode. While you are in applet configuration
mode modifying the applet, the existing applet may be executing. When you exit applet configuration mode,
the old applet is unregistered and the new version is registered.
Action configuration commands are uniquely identified using the label argument, which can be any string
value. Actions are sorted in ascending alphanumeric key sequence using the label argument as the sort key
and are run using this sequence.
The EEM schedules and runs policies on the basis of an event specification that is contained within the policy
itself. When applet configuration mode is exited, EEM examines the event and action commands that are
entered and registers the applet to be run when a specified event occurs.
The EEM policies will be assigned a class when class class-letter is specified when they are registered. EEM
policies registered without a class will be assigned to the default class. Threads that have default as the class
will service the default class when the thread is available for work. Threads that are assigned specific class
letters will service any policy with a matching class letter when the thread is available for work.
If there is no EEM execution thread available to run the policy in the specified class and a scheduler rule for
the class is configured, the policy will wait until a thread of that class is available for execution. Synchronous

Cisco IOS Embedded Event Manager Command Reference

118
 E through event manager Commands
event manager applet

policies that are triggered from the same input event should be scheduled in the same execution thread. Policies
will be queued in a separate queue for each class using the queue_priority as the queuing order.
When a policy is triggered and if AAA is configured it will contact the AAA server for authorization. Using
the authorization bypass keyword combination, you can skip to contact the AAA server and run the policy
immediately. EEM stores AAA bypassed policy names in a list. This list is checked when policies are triggered.
If a match is found, AAA authorization is bypassed.
To avoid authorization for commands configured through the EEM policy, EEM will use named method lists,
which AAA provides. These named method lists can be configured to have no command authorization.
The following is a sample AAA configuration.
This configuration assumes a TACACS+ server at 192.168.10.1 port 10000. If the TACACS+ server is not
enabled, configuration commands are permitted on the console; however, EEM policy and applet CLI
interactions will fail.

enable password lab

aaa new-model
tacacs-server host 128.107.164.152 port 10000
tacacs-server key cisco
aaa authentication login consoleline none
aaa authorization exec consoleline none
aaa authorization commands 1 consoleline none
aaa authorization commands 15 consoleline none
line con 0
exec-timeout 0 0
login authentication consoleline
aaa authentication login default group tacacs+ enable
aaa authorization exec default group tacacs+
aaa authorization commands 1 default group tacacs+
aaa authorization commands 15 default group tacacs+

The authorization, class and trap keywords can be used in any combination.

Examples The following example shows an EEM applet called IPSLAping1 being registered to run when there
is an exact match on the value of a specified SNMP object ID that represents a successful IP SLA
ICMP echo operation (this is equivalent to a ping command). Four actions are triggered when the
echo operation fails, and event monitoring is disabled until after the second failure. A message that
the ICMP echo operation to a server failed is sent to syslog, an SNMP trap is generated, EEM
publishes an application-specific event, and a counter called IPSLA1F is incremented by a value of
one.

Router(config)# event manager applet IPSLAping1

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.4 get-type exact
entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 5
Router(config-applet)# action 1.0 syslog priority critical msg "Server IP echo failed:
OID=$_snmp_oid_val"
Router(config-applet)# action 1.1 snmp-trap strdata "EEM detected server reachability
failure to 10.1.88.9"
Router(config-applet)# action 1.2 publish-event sub-system 88000101 type 1 arg1 10.1.88.9
arg2 IPSLAEcho arg3 fail
Router(config-applet)# action 1.3 counter name _IPSLA1F value 1 op inc

The following example shows how to register an applet with the name one and class A and enter
applet configuration mode where the timer event detector is set to trigger an event every 10 seconds.
When the event is triggered, the action syslog command writes the message “hello world” to syslog.

Cisco IOS Embedded Event Manager Command Reference

119
 E through event manager Commands
event manager detector routing

Router(config)# event manager applet one class A

Router(config-applet)# event timer watchdog time 10
Router(config-applet)# action syslog syslog msg "hello world"
Router(config-applet)# exit

The following example shows how to bypass the AAA authorization when registering an applet with
the name one and class A.

Router(config)# event manager applet one class A authorization bypass

Router(config-applet)#

Related Commands Command Description

show event manager policy registered Displays registered EEM policies.

event manager detector routing

To set the delay time for the routing event detector to start monitoring events, use the event manager detector
routing command in global configuration mode. To disable the delay time, use the no form of this command.

event manager detector routing bootup-delay delay-time

no event manager detector routing

Syntax Description bootup-delay Specifies the time delay to turn on monitoring after bootup.

delay-time Number that represents seconds and optional milliseconds in the format ssssssssss[.mmm].
The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to
999. If using milliseconds only, specify the milliseconds in the format 0.mmm.

Command Default Routing event detector commands are not configured.

Command Modes
Global configuration (config)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines To configure the delay time to turn on the routing update after bootup, use the event manager detector
routingcommand. If configured, the routing event detector will only start monitoring events after the bootup
delay time. After the bootup delay time has been reached, the routing updates will be turned on, and the
policies start will triggering.

Examples The following example shows how to configure the delay time for the routing update to be turned
on:

Cisco IOS Embedded Event Manager Command Reference

120
 E through event manager Commands
event manager detector rpc

Router(config)# event manager detector routing bootup-delay 800

Related Commands Command Description

event manager detector rpc Configures the router to accept EEM applet using RPC event detector
commands.

event manager detector rpc

To configure the router to accept Embedded Event Manger (EEM) applet using remote procedure call (RPC)
event detector commands, use the event manager detector rpccommand in global configuration mode. To
disable the EEM applet using the RPC event detector commands, use the no form of this command.

event manager detector rpc ssh [{acl[{[access-list]}] | max-sessions max-sessions | locktime seconds}]
no event manager detector rpc [{ssh acl [access-list] | max-sessions max-sessions | locktime seconds}]

Syntax Description ssh Specifies SSH to establish an RPC session.

acl (Optional) Specifies an access list for this session.

access-list (Optional) Specifies the access list for this session.

max-sessions (Optional) Specifies the maximum number of concurrent RPC sessions.

max-sessions (Optional) The valid range is from 4 to 16 sessions.

lock-time (Optional) Specifies the maximum time an EEM RPC configuration lock is in place without
an intermediate operation.

seconds (Optional) The valid range is 1 to 300 seconds. The default value is 10 seconds.

Command Default RPC event detector commands are not configured.

Command Modes
Global configuration (config)

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The event manager detector rpccommandprovides the ability to invoke EEM policies from outside the router
over an encrypted connection using Secure Shell (SSH) for the highest level of security. The RPC event
detector uses Simple Object Access Protocol (SOAP) data encoding for exchanging XML-based messages.
This command can be used to run EEM policies and then receive output in a SOAP XML-formatted reply.
SSH must be configured on the router prior to event manager detector rpc is configured.

Cisco IOS Embedded Event Manager Command Reference

121
 E through event manager Commands
event manager directory user

Examples The following example shows how to configure a user, if one has not been configured. It also shows
how to configure the router to enable SSHv2:

Router(config)# username johndoe privilege 15 password 0 lab

Router(config)# aaa new-model

Router(config)# crypto key generate rsa usage-keys label sshkeys modulus 768

Router(config)# ip ssh version 2

The following example shows how to connect to the router using SSH to make sure SSH is up and
running:

Linux-server> ssh -2 -c aes256-cbc -m hmac-sha1-96 user@router

The following example shows how to configure the router to accept EEM RPC command, enable
EEM RPC over SSHv2. You can also configure an access control list for this EEM RPC session.

Router# configure terminal

Router(config)# event manager detector rpc ssh acl 459

The following example shows how to configure the maximum time an EEM RPC configuration lock
is in place without an intermediate operation. The value is set to 60 seconds.

Router(config)# event manager detector rpc lock-time 60

The following example show how to configure the maximum number of concurrent RPC sessions
to 5:

Router(config)# event manager detector rpc max-sessions 5

The following example shows how to run eem_rpc via SSH.

Linux-server> ssh -2 -s user@172.16.0.0 eem_rpc

Related Commands Command Description

event rpc Configures the router to accept EEM RPC.

event manager directory user

To specify a directory to use for storing user library files or user-defined Embedded Event Manager (EEM)
policies, use the event manager directory user command in global configuration command. To disable use
of a directory for storing user library files or user-defined EEM policies, use the no form of this command.

event manager directory user {library path | policy path}

no event manager directory user {library path | policy path}

Syntax Description library Specifies using the directory to store user library files.

policy Specifies using the directory to store user-defined EEM policies.

Cisco IOS Embedded Event Manager Command Reference

122
 E through event manager Commands
event manager directory user

path Absolute pathname to the user directory on the flash device.

Command Default No directory is specified for storing user library files or user-defined EEM policies.

Command Modes
Global configuration

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines The user library directory is needed to store user library files associated with authoring EEM policies. If you
have no plans to author EEM policies, you need not create a user library directory.
In Cisco IOS Release 12.3(14)T and later releases the software supports policy files created using the Tool
Command Language ( Tcl) scripting language. Tcl is provided in the Cisco IOS software image when the
EEM is installed on the network device. Files with the .tcl extension can be EEM policies, Tcl library files,
or a special Tcl library index file named “tclindex.” The tclindex file contains a list of user function names
and the library files that contain the user functions. The EEM searches the user library directory when Tcl
starts up to process the tclindex file.
To create the user library directory before identifying it to the EEM, use the mkdir command in privileged
EXEC mode. After creating the user library directory, you can use the copy command to copy .tcl library files
into the user library directory.
The user policy directory is needed to store user-defined policy files. If you have no plans to author EEM
policies, you need not create a user policy directory. The EEM searches the user policy directory when you
enter the event manager policy policy-filename type user command.
To create the user policy directory before identifying it to the EEM, use the mkdir command in privileged
EXEC mode. After creating the user policy directory, you can use the copy command to copy policy files
into the user policy directory.

Examples The following example shows how to specify disk0:/user_library as the directory to use for storing
user library files:

Router(config)# event manager directory user library disk0:/user_library

Cisco IOS Embedded Event Manager Command Reference

123
 E through event manager Commands
event manager directory user repository

Related Commands Command Description

copy Copies any file from a source to a destination.

event manager policy Registers an EEM policy with the EEM.

mkdir Creates a new directory in a Class C flash file system.

event manager directory user repository

To specify a default location to copy Embedded Event Manager (EEM) policy updates, use the event manager
directory user repository command in global configuration mode. To disable this function, use the no form
of this command.

event manager directory user repository url-location

no event manager directory user repository

Syntax Description url-location Location from which EEM policies will be copied.

Command Default No directory is specified for locating EEM policies.

Command Modes
Global configuration (config)

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Examples The following example shows how to specify tftp://10.2.2.2/user2/mktg/eem_scripts as the default
location to receive EEM policies:

event manager directory user repository tftp://10.2.2.2/user2/mktg/eem_scripts

Related Commands Command Description

show event manager directory user repository Displays the default directory specified to locate user EEM
policy files.

event manager environment

To set an Embedded Event Manager (EEM) environment variable, use the event manager environment
command in global configuration mode. To disable an EEM environment variable, use the no form of this
command.

event manager environment variable-name string

Cisco IOS Embedded Event Manager Command Reference

124
 E through event manager Commands
event manager environment

no event manager environment variable-name

Syntax Description variable-name Name assigned to the EEM environment variable.

string Series of characters, including embedded spaces, to be placed in the environment variable
variable-name.

Command Default No EEM environment variables are set.

Command Modes
Global configuration

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines By convention, the names of all environment variables defined by Cisco begin with an underscore character
to set them apart: for example, _show_cmd.
To support embedded white spaces in the string argument, this command interprets everything after the
variable-name argument to the end of the line to be part of the string argument.
To display the name and value of all EEM environment variables after you have configured them, use the
show event manager environment command.

Examples The following example of the event manager environment command defines a set of EEM
environment variables:

Router(config)# event manager environment _cron_entry 0-59/2 0-23/1 * * 0-7

Router(config)# event manager environment _show_cmd show version

Related Commands Command Description

show event manager environment Displays the name and value of all EEM environment variables.

Cisco IOS Embedded Event Manager Command Reference

125
 E through event manager Commands
event manager history size

event manager history size

To change the size of Embedded Event Manager (EEM) history tables, use the event manager history size
command in global configuration mode. To restore the default history table size, use the no form of this
command.

event manager history size {events | traps} [size]

no event manager history size {events | traps}

Syntax Description events Changes the size of the EEM event history table.

traps Changes the size of the EEM Simple Network Management Protocol (SNMP) trap history table.

size (Optional) Integer in the range from 1 to 50 that specifies the number of history table entries. Default
is 50.

Command Default The size of the history table is 50 entries.

Command Modes
Global configuration

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Examples The following example of the event manager history size command changes the size of the SNMP
trap history table to 30 entries:

Router(config)# event manager history size traps 30

Related Commands Command Description

show event manager history events Displays the EEM events that have been triggered.

show event manager history traps Displays the EEM SNMP traps that have been sent.

Cisco IOS Embedded Event Manager Command Reference

126
 E through event manager Commands
event manager policy

event manager policy

To register an Embedded Event Manager (EEM) policy with the EEM, use the event manager policy command
in global configuration mode. To unregister the EEM policy, use the no form of this command.

event manager policy policy-filename [authorization bypass] [class class-options] [type {system
| user}] [trap]
no event manager policy policy-filename [authorization bypass] [class class-options] [type {system
| user}] [trap]

Syntax Description policy-filename Name of the policy file.

authorization (Optional) Specifies AAA authorization type for policy.

bypass (Optional) Specifies EEM AAA authorization type bypass.

class (Optional) Specifies the EEM policy class.

class-options (Optional) The EEM policy class. You can specify either of the following:
• class-letter-- Letter from A to Z that identifies each policy class. You can specify
any one class-letter.
• default --Specifies the policies registered with the default class.

type (Optional) Specifies the type of EEM policy to be registered.

system (Optional) Registers a Cisco-defined system policy.

user (Optional) Registers a user-defined policy.

trap (Optional) Generates a Simple Network Management Protocol (SNMP) trap when the
policy is triggered.

Command Default No EEM policies are registered.

Command Modes
Global configuration (config)

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was modified. The user keyword was added.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

Cisco IOS Embedded Event Manager Command Reference

127
 E through event manager Commands
event manager policy

Release Modification

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(22)T This command was modified. The class keyword and the class-options argument were added.

15.0(1)M This command was modified. The authorization and bypass keywords were added.

Usage Guidelines The EEM schedules and runs policies on the basis of an event specification that is contained within the policy
itself. When the event manager policy command is invoked, the EEM examines the policy and registers it
to be run when the specified event occurs.
If you enter the event manager policy command without specifying the optional type keyword, the EEM
first tries to locate the specified policy file in the system policy directory. If the EEM finds the file in the
system policy directory, it registers the policy as a system policy. If the EEM does not find the specified policy
file in the system policy directory, it looks in the user policy directory. If the EEM locates the specified file
in the user policy directory, it registers the policy file as a user policy. If the EEM finds policy files with the
same name in both the system policy directory and the user policy directory, the policy file in the system
policy directory takes precedence and is registered as a system policy.
The EEM policies will be assigned a class when class class-letter is specified when they are registered. EEM
policies registered without a class will be assigned to the default class. Threads that have default as the class
will service the default class when the thread is available for work. Threads that are assigned specific class
letters will service any policy with a matching class letter when the thread is available for work.
If there is no EEM execution thread available to run the policy in the specified class and a scheduler rule for
the class is configured, the policy will wait until a thread of that class is available for execution. Synchronous
policies that are triggered from the same input event should be scheduled in the same execution thread. Policies
will be queued in a separate queue for each class using the queue_priority as the queuing order.
When a policy is triggered and if AAA is configured, it will contact the AAA server for authorization. Using
the authorization bypass keyword combination, you can skip to contact the AAA server and run the policy
immediately. EEM stores AAA-bypassed policy names in a list. This list is checked when policies are triggered.
If a match is found, AAA authorization is bypassed.
To avoid authorization for commands configured through the EEM policy, EEM will use named method lists,
which AAA provides. These named method lists can be configured to have no command authorization.
The following is a sample AAA configuration. This configuration assumes a TACACS+ server at 192.0.2.1
port 10000. If the TACACS+ server is not enabled, configuration commands are permitted on the console;
however, EEM policy and applet CLI interactions will fail.

enable password lab

aaa new-model
tacacs-server host 192.0.2.1 port 10000
tacacs-server key cisco
aaa authentication login consoleline none
aaa authorization exec consoleline none
aaa authorization commands 1 consoleline none
aaa authorization commands 15 consoleline none
line con 0
exec-timeout 0 0
login authentication consoleline
aaa authentication login default group tacacs+ enable
aaa authorization exec default group tacacs+

Cisco IOS Embedded Event Manager Command Reference

128
 E through event manager Commands
event manager run

aaa authorization commands 1 default group tacacs+

aaa authorization commands 15 default group tacacs+

The authorization, class, and type keywords can be used in any combination.
An error message is displayed when you try to register a “.tbc” policy that does not contain any precompiled
Tool Command Language (Tcl) byte code. See the “Examples” section.

Examples The following example shows how to use the event manager policy command to register a
system-defined policy named tm_cli_cmd.tcl located in the system policy directory:

Router(config)# event manager policy tm_cli_cmd.tcl type system

The following example shows how to use the event manager policy command to register a
user-defined policy named cron.tcl located in the user policy directory:

Router(config)# event manager policy cron.tcl type user

The following example shows how to use the event manager policy command to register a Tcl script
named syslog.tcl with a class of default:

Router(config)# event manager policy syslog.tcl class default

The following example shows how to use the event manager policy command to register a Tcl script
named syslog.tcl with a class of default and bypass the AAA authorization:

Router(config)# event manager policy syslog.tcl class default authorization bypass

The following error message is displayed when you try to register a “.tbc” policy that does not contain
any precompiled TCL byte code:

Router(config)# event manager policy tcltotbc.tbc

EEM Register event failed: Error .tbc file does not contain compiled Tcl byte code. Error
unable to parse EEM policy for registration commands.
EEM configuration: failed to retrieve intermediate registration result for policy tcltotbc.tbc

Related Commands Command Description

show event manager policy registered Displays registered EEM policies.

event manager run

To manually run a registered Embedded Event Manager (EEM) policy, use the event manager run command
in privileged EXEC mode.

event manager run policy-filename [[parameter1] [parameter2]... [parameter15]]

Syntax Description policy-filename Name of the policy file.

parameter (Optional) Parameter to pass to the script. A maximum of 15 parameters can be specified.
The parameters must be alphanumeric strings. Do not include quotation marks, embedded
spaces, and special characters.

Cisco IOS Embedded Event Manager Command Reference

129
 E through event manager Commands
event manager run

Command Default No registered EEM policies are run.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command was supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The parameter argument was added. Up to 15 parameter values can be specified, and arguments
can be specified in the registry call.

Usage Guidelines This command also enables you to use the parameters in the event policy and to specify the arguments in the
registry call.
EEM usually schedules and runs policies on the basis of an event specification that is contained within the
policy itself. The event manager run command allows policies to be run manually. The event none command
must first be configured to run the policy manually. The None Event Detector includes arguments when it
publishes the none event. This command does not have a no form.

Examples The following example shows how to manually run an EEM policy named policy-manual.tcl:

Router# event manager run policy-manual.tcl

Each parameter consists of the total number of built-ins ($_none_argc), followed by the list of built-ins
($_none_arg1, $_none_arg2, and $_none_arg3). The following examples show applets and Tool Tcl
scripts.

Applet Example

event manager applet none_parameter_test

event none
action 1 syslog msg "Number of Arguments is $_none_argc"
action 2 syslog msg "Argument 1 is $_none_arg1"
action 3 syslog msg "Argument 2 is $_none_arg2"
action 4 syslog msg "Argument 3 is $_none_arg3"
end
Router# event manager run none_parameter_test 11 22 33
01:26:03: %HA_EM-6-LOG: none_parameter_test: Number of Arguments is 3
01:26:03: %HA_EM-6-LOG: none_parameter_test: Argument 1 is 11

Cisco IOS Embedded Event Manager Command Reference

130
 E through event manager Commands
event manager run

01:26:03: %HA_EM-6-LOG: none_parameter_test: Argument 2 is 22

01:26:03: %HA_EM-6-LOG: none_parameter_test: Argument 3 is 33

For policies, event_reqinforeturns the optional parameters in a string, which are then handled by
the policy.

Tcl Script Example

none_paramter_test.tcl
::cisco::eem::event_register_none
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
# query the event info
array set arr_einfo [event_reqinfo]
if {$_cerrno != 0} {
set result [format "component=%s; subsys err=%s; posix err=%s;\n%s" \
$_cerr_sub_num $_cerr_sub_err $_cerr_posix_err $_cerr_str]
error $result
}
action_syslog priority info msg "Number of Arguments is $arr_einfo(argc)"
if {$_cerrno != 0} {
set result [format \
"component=%s; subsys err=%s; posix err=%s;\n%s" \
$_cerr_sub_num $_cerr_sub_err $_cerr_posix_err $_cerr_str]
error $result
}
action_syslog priority info msg "Argument 1 is $arr_einfo(arg1)"
if {$_cerrno != 0} {
set result [format \
"component=%s; subsys err=%s; posix err=%s;\n%s" \
$_cerr_sub_num $_cerr_sub_err $_cerr_posix_err $_cerr_str]
error $result
}
action_syslog priority info msg "Argument 2 is $arr_einfo(arg2)"
if {$_cerrno != 0} {
set result [format \
"component=%s; subsys err=%s; posix err=%s;\n%s" \
$_cerr_sub_num $_cerr_sub_err $_cerr_posix_err $_cerr_str]
error $result
}
action_syslog priority info msg "Argument 3 is $arr_einfo(arg3)"
if {$_cerrno != 0} {
set result [format \
"component=%s; subsys err=%s; posix err=%s;\n%s" \
$_cerr_sub_num $_cerr_sub_err $_cerr_posix_err $_cerr_str]
error $result
}
jubjub#event manager run none_parameter_test.tcl 1 2 3
01:26:03: %HA_EM-6-LOG: tmpsys:/eem_policy/none_parameter_test.tcl: Number of Arguments is
3
01:26:03: %HA_EM-6-LOG: tmpsys:/eem_policy/none_parameter_test.tcl: Argument 1 is 1
01:26:03: %HA_EM-6-LOG: tmpsys:/eem_policy/none_parameter_test.tcl: Argument 2 is 2
01:26:03: %HA_EM-6-LOG: tmpsys:/eem_policy/none_parameter_test.tcl: Argument 3 is 3

Related Commands Command Description

event manager applet Registers an EEM applet with the EEM and enters applet
configuration mode.

Cisco IOS Embedded Event Manager Command Reference

131
 E through event manager Commands
event manager scheduler

Command Description

event manager policy Registers an EEM policy with the EEM.

event none Specifies that an EEM policy is to be registered with the EEM
and can be run manually.

show event manager policy registered Displays EEM policies that are already registered.

event manager scheduler

To schedule Embedded Event Manager (EEM) policies and set the policy scheduling options, use the event
manager schedulercommand in global configuration mode. To remove the scheduling of the EEM policies,
use the no form of this command.

event manager scheduler {applet | axp | call-home} thread class class-options number thread-number
no event manager scheduler {applet | axp | call-home} thread class class-options number
thread-number

Syntax Description applet Specifies the EEM applet policy.

axp Specifies the application extension platform (AXP) policy.

call-home Specifies Call Home policy.

thread Specifies the thread for the class.

class Specifies the EEM policy class.

class-options The EEM policy class. You can specify either one or all of the following:
• class-letter-- Letter from A to Z that identifies each policy class. You can specify
multiple instances of class-letter.
• default --Specifies the policies registered with the default class.
• range class-letter-range-- Specifies the EEM policy class in a range. Multiple
instances of range class-letter-range can be specified. The letters used in
class-letter-range must be in uppercase.

number Specifies the number of concurrent execution threads for the specified class.

thread-number Number in the range 1 to 65535.

Command Default Policy scheduling is active.

Command Modes
Global configuration (config)

Command History Release Modification

12.4(22)T This command was introduced.

Cisco IOS Embedded Event Manager Command Reference

132
 E through event manager Commands
event manager scheduler clear

Release Modification

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The EEM policies will be assigned a class when class class-letter is specified by the event manager applet
or event manager policy commands when they are registered. EEM policies registered without a class will
be assigned to the default class. Threads that have default as the class, will service the default class when
the thread is available for work. Threads that are assigned specific class letters will service any policy with a
matching class letter when the thread is available for work.
If there is no EEM execution thread available to run the policy in the specified class and a scheduler rule for
the class is configured, the policy will wait until a thread of that class is available for execution. Synchronous
policies that are triggered from the same input event should be scheduled in the same execution thread.
You should specify any one of the options class-letter, default, and range class-letter-range. You can specify
all these options in the same CLI statement.
To schedule EEM policies and set the script scheduling options, use the event manager scheduler script
command in global configuration mode. To remove the EEM script scheduling options and restore the default
value, use the no form of this command.

Examples The following example shows how to create two EEM execution threads to run applets of the default
class.

Router(config)# event manager scheduler applet thread class default number 2

The following example shows how to create one EEM execution thread to run Tcl scripts of class
A, B, D and E.

Router(config)# event manager scheduler script thread class A B range D-E number 1

Related Commands Command Description

event manager applet Registers an EEM applet with the EEM and enters applet
configuration mode.

event manager policy Registers an EEM policy with the EEM.

event manager scheduler hold Holds the EEM policy scheduling execution.

event manager scheduler script Sets the options for the EEM script scheduling.

debug event manager scheduler suspend Suspends the EEM policy scheduling execution.

event manager scheduler clear

To clear Embedded Event Manager (EEM) policies that are executing or pending execution, use the event
manager scheduler clear command in privileged EXEC mode.

event manager scheduler clear {all | policy job-id | queue-type {applet | call-home | axp | script}
[class class-options]} [processor {rp_primary | rp_standby}]

Cisco IOS Embedded Event Manager Command Reference

133
 E through event manager Commands
event manager scheduler clear

Syntax Description all Clears all policies that are currently executing or in the pending execution queue.

policy Clears the EEM policy specified by the Job ID.

job-id Number in the range from 1 to 4294967295 that identifies each policy in the queue.

queue-type Clears the queue type of the EEM policy.

applet Specifies the EEM queue type applet.

call-home Specifies the EEM queue type Call Home Policies.

axp Specifies the EEM queue type application extension platform.

script Specifies the EEM execution thread to run the Tcl scripts.

class Clears the EEM policies of a specified class.

class-options Specifies the EEM policy class. You can specify either one or all of the following:
• class-letter --Letter from A to Z that identifies each policy class. You can specify
multiple instances of class-letter.
• default --The default class. EEM policies registered without a class are assigned to the
default class.
• range class-range --Specifies the EEM policy class in a range. You can specify any
range from A to Z. You can specify multiple instances of range class-range.

processor (Optional) Specifies the processor to execute the command.

rp_primary (Optional) Indicates the default RP. The policy is run on the primary RP when an event
correlation causes the policy to be scheduled.

rp_standby (Optional) Indicates the standby RP. The policy is run on the standby RP when an event
correlation causes the policy to be scheduled.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.4(20)T This command was introduced.

12.4(22)T The queue-type and processorkeywords and class-letter and class-range arguments were
added.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the show event manager policy pending command to display the policies pending in the server execution
queue.
Use the show event manager policy active command to display the policies that are running.

Cisco IOS Embedded Event Manager Command Reference

134
 E through event manager Commands
event manager scheduler hold

Use the event manager scheduler clear command to clear a policy or a policy queue in the server.
For the class keyword, you should specify at least one of the options, class-letter, default, or range class-range.
You can specify all these options in the same CLI statement.

Examples The following example shows how to clear EEM policies that are pending execution. The show
commands display sample output before and after the policy is cleared.

Router# show event manager policy pending

no. job id status time of event event type name
1 1 pend Thu Sep 7 02:54:04 2006 syslog applet: one
2 2 pend Thu Sep 7 02:54:04 2006 syslog applet: two
3 3 pend Thu Sep 7 02:54:04 2006 syslog applet: three

Router# event manager scheduler clear policy 2

Router# show event manager policy pending

no. job id status time of event event type name

1 1 pend Thu Sep 7 02:54:04 2006 syslog applet: one
3 3 pend Thu Sep 7 02:54:04 2006 syslog applet: three

Related Commands Command Description

event manager policy Registers an EEM policy with the EEM.

show event manager policy pending Displays EEM policies that are pending execution.

event manager scheduler hold

To hold a scheduled Embedded Event Manager (EEM) policy event or event queue in the EEM scheduler,
use the event manager scheduler hold command in privileged EXEC mode. To resume the policy event or
event queue use the event manager scheduler release command.

event manager scheduler hold {all | policy job-id | queue-type {applet | call-home | axp | script}
[class class-options]} [processor {rp_primary | rp_standby}]

Syntax Description all Holds all the EEM policy event or event queue in the EEM scheduler.

policy Holds the EEM policy event or event queue in the EEM scheduler specified by the Job ID.

job-id Number in the range from 1 to 4294967295 that identifies each policy in the queue.

queue-type Holds the EEM policy event or event queue based on the EEM queue type.

applet Specifies the EEM queue type applet.

call-home Specifies the EEM queue type Call Home Policies.

axp Specifies the EEM queue type application extension platform.

script Specifies the EEM execution thread to run the Tcl scripts.

class Specifies the class of the EEM policies.

Cisco IOS Embedded Event Manager Command Reference

135
 E through event manager Commands
event manager scheduler hold

class-options Specifies the EEM policy class. You can specify either one or all of the following:
• class-letter --Letter from A to Z that identifies each policy class. You can specify
multiple instances of class-letter.
• default --The default class. EEM policies registered without a class are assigned to the
default class.
• range class-range --Specifies the EEM policy class in a range. You can specify any
range from A to Z. You can specify multiple instances of range class-range.

processor (Optional) Specifies the processor to execute the command.

rp_primary (Optional) Indicates the default RP. The policy is run on the primary RP when an event
correlation causes the policy to be scheduled.

rp_standby (Optional) Indicates the standby RP. The policy is run on the standby RP when an event
correlation causes the policy to be scheduled.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the show event manager policy pending command to display the policies pending in the server execution
queue.
Use the event manager scheduler hold command to hold a policy or a policy queue in the server.
For the class keyword, you should specify at least one of the options, class-letter, default, or range class-range.
You can specify all these options in the same CLI statement.

Examples The following example shows how to hold a scheduled policy event in the EEM scheduler. The show
commands display sample output before and after the policy event is held.

Router# show event manager policy pending

no. job id status time of event event type name
1 1 pend Thu Sep 7 02:54:04 2006 syslog applet: one
2 2 pend Thu Sep 7 02:54:04 2006 syslog applet: two
3 3 pend Thu Sep 7 02:54:04 2006 syslog applet: three
Router# event manager scheduler hold policy 2
Router# show event manager policy pending

no. job id status time of event event type name

1 1 pend Thu Sep 7 02:54:04 2006 syslog applet: one
2 2 held Thu Sep 7 02:54:04 2006 syslog applet: two
3 3 pend Thu Sep 7 02:54:04 2006 syslog applet: three

Cisco IOS Embedded Event Manager Command Reference

136
 E through event manager Commands
event manager scheduler modify

Related Commands Command Description

event manager policy Registers an EEM policy with the EEM.

event manager scheduler release Resumes the policy event or event queue.

show event manager policy pending Displays EEM policies that are pending execution.

event manager scheduler modify

To modify the scheduling parameters of the Embedded Event Manager (EEM) policies, use the event manager
scheduler modify command in privileged EXEC mode.

event manager scheduler modify {all | policy job-id | queue-type {applet | call-home | axp | script}}
{class class-options [queue-priority {high | last | low | normal}] | queue-priority {high | last | low |
normal} [class class-options]} [processor {rp_primary | rp_standby}]

Syntax Description all Changes all policies that are currently executing or in the pending execution queue.

policy Changes the EEM policy specified by the Job ID.

job-id Number in the range from 1 to 4294967295 that identifies each policy in the queue.

queue-type Changes the queue type of the EEM policy.

applet Specifies the EEM queue type applet.

call-home Specifies the EEM queue type Call Home Policies.

axp Specifies the EEM queue type application extension platform.

script Specifies the EEM execution thread to run the Tcl scripts.

class Changes the class of the EEM policies.

class-options Specifies the EEM policy class. You can specify either one or all of the following:
• class-letter --Letter from A to Z that identifies each policy class. You can specify
multiple instances of class-letter.
• default --The default class. EEM policies registered without a class are assigned to
the default class.

queue-priority (Optional) Changes the priority of the queuing order of the EEM policies.

high (Optional) Specifies the queue priority as high.

last (Optional) Specifies the queue priority as last.

low (Optional) Specifies the queue priority as low.

normal (Optional) Specifies the queue priority as normal.

processor (Optional) Specifies the processor to execute the command.

Cisco IOS Embedded Event Manager Command Reference

137
 E through event manager Commands
event manager scheduler release

rp_primary (Optional) Indicates the default RP. The policy is run on the primary RP when an event
correlation causes the policy to be scheduled.

rp_standby (Optional) Indicates the standby RP. The policy is run on the standby RP when an event
correlation causes the policy to be scheduled.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the show event manager policy pending command to display the policies pending in the server execution
queue.
Use the event manager scheduler modify command to modify the scheduling parameters of a policy.
For the class keyword, you should specify at least one of the options, class-letter or default. You can specify
both the options in the same CLI statement.

Examples The following example shows how to modify the scheduling parameters of the EEM policies. The
show commands display sample output before and after the scheduling parameters are modified.

Router# show event manager policy pending

no. class status time of event event type name
1 default pend Thu Sep 7 02:54:04 2006 syslog applet: one
2 default pend Thu Sep 7 02:54:04 2006 syslog applet: two
3 B pend Thu Sep 7 02:54:04 2006 syslog applet: three

Router# event manager scheduler modify all class A

Router# show event manager policy pending

no. class status time of event event type name

1 A pend Thu Sep 7 02:54:04 2006 syslog applet: one
2 A pend Thu Sep 7 02:54:04 2006 syslog applet: two
3 A pend Thu Sep 7 02:54:04 2006 syslog applet: three

Related Commands Command Description

event manager policy Registers an EEM policy with the EEM.

show event manager policy pending Displays EEM policies that are pending execution.

event manager scheduler release

To resume execution of the specified Embedded Event Manager (EEM) policies, use the event manager
scheduler releasecommand in privileged EXEC mode.

Cisco IOS Embedded Event Manager Command Reference

138
 E through event manager Commands
event manager scheduler release

event manager scheduler release {all | policy policy-id | queue-type {applet | call-home | axp | script}
[class class-options]} [processor {rp_primary | rp_standby}]

Syntax Description all Resumes the execution of all EEM policies.

policy Resumes the EEM policy specified by the policy ID.

policy-id Number in the range from 1 to 4294967295 that identifies each policy in the queue.

queue-type Resumes the execution of policies based on the EEM queue type.

applet Specifies the EEM applet policy.

call-home Specifies the Call Home policy.

axp Specifies the application extension platform (AXP) policy.

script Specifies the EEM script policy.

class Specifies the EEM policy class.

class-options The EEM policy class. You can specify either one or all of the following:
• class-letter-- Letter from A to Z that identifies each policy class. You can specify
multiple instances of class-letter.
• default --Specifies the policies registered with the default class.
• range class-letter-range-- Specifies the EEM policy class in a range. Multiple instances
of range class-letter-range can be specified. The letters used in class-letter-range must
be in uppercase.

processor Specifies the processor to execute the command. The default value is the primary RP.

rp_primary Indicates the primary RP.

rp_standby Indicates the standby RP.

Command Default Disabled.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.4(22)T This command was introduced.

Usage Guidelines To release the EEM policies held using the event manager scheduler hold command, use the event manager
scheduler release command.
You should specify any one of the options class-letter, default, and range class-letter-range. You can specify
all these options in the same CLI statement.

Cisco IOS Embedded Event Manager Command Reference

139
 E through event manager Commands
event manager scheduler script

Examples The following example shows how to resume the execution of all the EEM policies:

Router# event manager scheduler release all

The following example shows how to resumes the execution for policies of class A to E:
Router# event manager scheduler release queue-type script class range A-E

Related Commands Command Description

event manager scheduler hold Holds the EEM policy scheduling execution.

event manager scheduler script

To schedule Embedded Event Manager (EEM) policies and set the script scheduling options, use the event
manager scheduler script command in global configuration mode. To remove the EEM script scheduling
options and restore the default value, use the no form of this command.

event manager scheduler script thread class class-options number thread-number

no event manager scheduler script thread class class-options number thread-number

Syntax Description thread Specifies the thread for the class.

class Specifies the EEM policy class.

class-options The EEM policy class. You can specify either one or all of the following:
• class-letter-- Letter from A to Z that identifies each policy class. You can specify
multiple instances of class-letter.
• default --Specifies the policies registered with the default class.
• range class-letter-range-- Specifies the EEM policy class in a range. Multiple
instances of range class-letter-range can be specified. The letters used in
class-letter-range must be in uppercase.

number Specifies the number of concurrent execution threads for the specified class.

thread-number Number in the range 1 to 65535.

Command Default Only one EEM policy can be run at a time.

Command Modes
Global configuration (config)

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

Cisco IOS Embedded Event Manager Command Reference

140
 E through event manager Commands
event manager scheduler suspend

Release Modification

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(22)T The range and numberkeywords and class-options argument were added.

Usage Guidelines Use the event manager scheduler script command if you want to run more than one EEM policy concurrently.
You should specify any one of the options class-letter, default, and range class-letter-range. You can specify
all these options in the same CLI statement.
To schedule EEM policies and set the policy scheduling options, use the event manager schedulercommand
in global configuration mode. To remove the scheduling of the EEM policies, use the no form of this command.

Examples The following example shows how to specify two script execution threads to run concurrently:

Router(config)# event manager scheduler script thread class default number 2

event manager scheduler suspend

To immediately suspend Embedded Event Manager (EEM) policy scheduling execution, use the event manager
scheduler suspend command in global configuration mode. To resume EEM policy scheduling, use the no
form of this command.

event manager scheduler suspend

no event manager scheduler suspend

Syntax Description This command has no arguments or keywords.

Command Default Policy scheduling is active.

Command Modes
Global configuration

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

Cisco IOS Embedded Event Manager Command Reference

141
 E through event manager Commands
event manager session cli username

Release Modification

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines Use the event manager scheduler suspendcommand to suspend all policy scheduling requests and do no
scheduling until you enter the no form of the command. The no form of the command resumes policy scheduling
and executes any pending policies.
You might want to suspend policy execution immediately instead of unregistering policies one by one for the
following reasons:
• For security--if you think the security of your system has been compromised.
• For performance--if you want to suspend policy execution temporarily to make more CPU cycles available
for other functions.

Examples The following example of the event manager scheduler suspendcommand disables policy scheduling:

Router(config)# event manager scheduler suspend

May 19 14:31:22.439: fm_server[12330]: %HA_EM-6-FMS_POLICY_EXEC: fh_io_msg: Policy execution
has been suspended

The following example of the event manager scheduler suspendcommand enables policy scheduling:

Router(config)# no event manager scheduler suspend

May 19 14:31:40.449: fm_server[12330]: %HA_EM-6-FMS_POLICY_EXEC: fh_io_msg: Policy execution
has been resumed

Related Commands Command Description

event manager policy Registers an EEM policy with the EEM.

event manager session cli username

To associate a username with Embedded Event Manager (EEM) policies that use the command-line interface
(CLI) library, use the event manager session cli usernameprivilege<0-15> command in global configuration
mode. To remove the username association with EEM policies that use the CLI library, use the no form of
this command.

event manager session cli username usernameprivilege<0-15>

no event manager session cli username usernameprivilege<0-15>

Syntax Description username Username assigned to EEM CLI sessions that are initiated by EEM policies.

Cisco IOS Embedded Event Manager Command Reference

142
 E through event manager Commands
event manager update user policy

Command Default No username is associated with EEM CLI sessions.

Command Modes
Global configuration

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines Use the event manager session cli username command to assign a username for EEM policy CLI sessions
when TACACS+ is used for command authorization.
If you are using authentication, authorization, and accounting (AAA) security and implement authorization
on a command basis, you should use the event manager session cli username command to set a username
to be associated with a Tool Command Language (Tcl) session. The username is used when a Tcl policy
executes a CLI command. TACACS+ verifies each CLI command using the username associated with the
Tcl session that is running the policy. Commands from Tcl policies are not usually verified because the router
must be in privileged EXEC mode to register the policy.

Examples The following example of the event manager session cli username command associates the username
eemuser with EEM CLI sessions initiated by EEM policies:

Router(config)# event manager session cli username eemuser

Related Commands Command Description

show event manager session cli username Displays the username associated with CLI sessions initiated
by EEM policies that use the EEM CLI library.

event manager update user policy

To specify an immediate Embedded Event Manager (EEM) policy update, use the event manager update user
policy command in privileged EXEC mode.

event manager update user policy [{name policy-filename | group group-name-exp}] [repository
url-location]

Cisco IOS Embedded Event Manager Command Reference

143
 E through event manager Commands
event manager update user policy

Syntax Description name policy-filename (Optional) Specifies the EEM policy name.

group group-name-exp (Optional) Specifies the EEM policy group name.

repository url-location (Optional) Specifies the EEM policy repository directory. The url-location
argument is the location from which EEM policies will be copied. The default
repository is that set in event manager directory user repository command.

Command Default No EEM policies are registered.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The event manager update user policy command is used for the following purposes:
• To specify a single policy using the name policy-filename option. An attempt will be made to copy the
specified policy from the user policy repository URL to the current user policy directory. If successful,
a check will be made to see if the policy is registered and, if so, it will be unregistered. Then the newly
copied policy will be registered.
• To specify a regular expression pattern string to match a group of policies using the group group-name-exp
option. An attempt will be made to copy all registered policies whose policy names match the specified
regular expression from the user policy repository URL to the current user policy directory. If successful,
they will be unregistered and the newly downloaded policies will be registered.

Note If an error occurs registering a newly downloaded policy, the policy that was previously registered will be
left unregistered.

Note If the repository URL is the same as the user policy directory URL, the copy step will be skipped and the
policy will be unregistered then reregistered.

All activities will be logged to the CLI EXEC session and syslog.

Examples The following example shows policy sl_intf_down.tcl specified from the
tftp://10.2.2.2/users2/mktg/eem_ repository:

event manager update user policy name sl_intf_down.tcl repository

tftp://10.2.2.2/users2/mktg/eem_

The following example shows a group of policies specified from the tftp://10.2.2.2/users2/mktg/eem_
repository:

Cisco IOS Embedded Event Manager Command Reference

144
 E through event manager Commands
event manager update user policy

event manager update user policy group “*.tcl” repository tftp://10.2.2.2/users2/mktg/eem_

Related Commands Command Description

event manager directory user repository Specifies a default location from which to receive EEM policy
updates.

Cisco IOS Embedded Event Manager Command Reference

145
 E through event manager Commands
event manager update user policy

Cisco IOS Embedded Event Manager Command Reference

146
event mat through R Commands
• event mat through R Commands, on page 148

Cisco IOS Embedded Event Manager Command Reference

147
 event mat through R Commands
event mat through R Commands

event mat through R Commands

event mat
To publish an event when a mac-address is learned in the mac-address-table, use the event matcommand in
applet configuration mode. To disable the publishing of events, use the no form of this command.

event [tag event-tag] mat {interface {type number | regexp interface-name} [mac-address
mac-address] | mac-address mac-address [interface {type number | regexp interface-name}]} [maxrun
maxruntime-number] [hold-down seconds] [type {add | delete}]
no event mat

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

interface Specifies the interface.

type number Interface type and number.

regexp interface-name Specifies a regular expression pattern to match against interface names.

mac-address Specifies the MAC address.

mac-address The MAC address.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword
is specified, the maxruntime-number value must be specified. If the maxrun
keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds from 0 to 31536000, and where mmm
must be an integer representing milliseconds between 0 and 999.

hold-down (Optional) Specifies the time to delay the event processing.

seconds (Optional) Number that represents seconds and optional milliseconds in the format
ssssssssss[.mmm]. The range for seconds is from 1 to 4294967295. The range
for milliseconds is from 0 to 999. If using milliseconds only, specify the
milliseconds in the format 0.mmm.

type (Optional) Monitors the MAC address table events. You must specify one of the
following options:
• add --Monitors only MAC address table add events.
• delete --Monitor only MAC address table delete events.

Command Default By default, no events are published.

Cisco IOS Embedded Event Manager Command Reference

148
 event mat through R Commands
event neighbor-discovery

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(52)SE This command was introduced.

12.2(54)SG This command was integrated into Cisco IOS Release 12.2(54)SG.

Usage Guidelines You must specify either interface or mac-address. If one of them is specified, the other one is optional. All
the keywords can be used in any combination.

Examples The following example shows how to publish an event when a mac-address is learned in the
mac-address-table:

Router(config)# event manager applet mat

Router(config-applet)# event mat interface fastethernet0 hold-down 34 type delete
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event neighbor-discovery
To publish an event when a Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) cache
entry changes or a interface link status changes in an Embedded Event Manager (EEM) applet, use the event
neighbor-discoverycommand in applet configuration mode. To disable the action of publishing the event,
use the no form of this command.

event [tag event-tag] neighbor-discovery interface {type number | regexp interface-name} [maxrun
maxruntime-number] event-to-monitor
no event neighbor-discovery

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the trigger
command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

interface Specifies the interface.

type number Interface type and number.

regexp Specifies a regular expression pattern to match against interface names.

interface-name

Cisco IOS Embedded Event Manager Command Reference

149
 event mat through R Commands
event neighbor-discovery

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword is
not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must
be an integer representing seconds from 0 to 31536000, and where mmm must be an
integer representing milliseconds between 0 and 999.

event-to-monitor Specifies the event to be monitored on the interface. You must specify one of the
following values. You can specify more than one value.
• cdp --Triggers an event when a matching cdp event occurs. You must specify one
of the following options.
• add--Triggers events only when a new cdp cache entry is created in the cdp
table.
• all--Triggers an event when a cdp cache entry is added or deleted from the
cdp cache table and when a remote cdp device sends a keepalive to update
the cdp cache entry.
• delete--Triggers events only when a cdp cache entry is deleted from the cdp
table.
• update--Triggers an event when a cdp cache entry is added to the cdp table
or when the remote cdp device sends a cdp keepalive to update the cdp cache
entry.
• lldp --Triggers an event when a matching lldp event occurs. You must specify one
of the following options.
• add--Triggers events only when a new cdp cache entry is created in the cdp
table.
• all--Triggers an event when a cdp cache entry is added or deleted from the
cdp cache table and when a remote cdp device sends a keepalive to update
the cdp cache entry.
• delete--Triggers events only when a cdp cache entry is deleted from the cdp
table.
• update--Triggers an event when a cdp cache entry is added to the cdp table
or when the remote cdp device sends a cdp keepalive to update the cdp cache
entry.
• line-event --Triggers an event when the interface line protocol status changes.
• link-event --Triggers an event when the interface link status changes. You must
specify one of the following options.
• admindown--Monitors link admin-down events.
• all--Monitors all link events.
• deleted--Monitors link deleted events.
• down--Monitors link down events.
• goingdown--Monitors link going-down events.
• init--Monitors link init events.
• reset--Monitors link reset events.
• testing--Monitors link testing events.
• up--Monitors link up events.

Cisco IOS Embedded Event Manager Command Reference

150
 event mat through R Commands
event nf

Command Default By default, no events are published.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(52)SE This command was introduced.

12.2(54)SG This command was integrated into Cisco IOS Release 12.2(54)SG.

Usage Guidelines You must specify interface and at least one of cdp, lldp, link-event and line-event for the event specification
to be accepted. You can use interface and maxrun keywords and the event-trigger-criteria argument in any
order.

Examples The following example shows how to publish an event when CDP cache entry changes:

Router(config)# event manager applet discovery

Router(config-applet)# event neighbhor-discovery interface fastethernet0 cdp all
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event nf
To publish an event when a NetFlow operation is triggered in an Embedded Event Manager (EEM) applet,
use the event nf command in applet configuration mode. To disable the action of publishing an event when
NetFlow operations are triggered, use the no form of this command.

event [tag event-tag] nf monitor-name name event-type {create | delete | update} [exit-event-type]
{create | delete | update} subevent field field-type entry-value value-string [exit-value value-string]
entry-op operator-value [exit-op operator-value] [rate-interval seconds] [exit-rate-interval seconds]
[maxrun maxruntime-number]
no event [tag event-tag] nf

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with
the trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

monitor-name name Specifies the name of the NetFlow monitor.

event-type Specifies the type of event to monitor, cache or field.

create Creates a NetFlow event.

Cisco IOS Embedded Event Manager Command Reference

151
 event mat through R Commands
event nf

delete Deletes a NetFlow event.

update Updates a NetFlow event.

exit-event-type The event-type (create, delete, update) at which the event will be rearmed to be
monitored again.

subevent Specifies the event and its attributes to monitor. Valid values are event1, event2,
event3, event4.
Note The subevent keywords can be used alone, together, or in any
combination with each other, but each keyword can be used only
once.

field field-type Specifies the cache or field attribute to be monitored. One of the following
attributes can be specified:
• counter {bytes | packets}--Specifies the counter fields.
• datalink {dot1q | mac}--Specifies the datalink (layer2) fields.
• flow {direction | sampler}--Specifies the flow identifying fields.
• interface {input | output}--Specifies the interface fields.
• ipv4 field-type-- Specifies the IPv4 fields.
• ipv6 field-type-- IPv6 fields
• routing routing-attrribute -- Specifies the routing attributes.
• timestamp sysuptime {first | last}--Specifies the timestamp fields.
• transport field-type-- Specifies the Transport layer fields.

For more information, use the question mark (?) online help function.

entry-value value-string Specifies the entry value to be compared.

exit-value string (Optional) Specifies the value at which the event is set to be monitored again.

rate-interval sec Specifies the rate interval value in seconds. The valid range is from 1 to
4294967295.

exit-rate-interval sec (Optional) Specifies the interval value for cache rate and cache entry. The valid
range is from 0 to 4294967295.

entry-op Specifies the operator used to compare the collected usage sample with the
specified value. The valid values are:

Cisco IOS Embedded Event Manager Command Reference

152
 event mat through R Commands
event nf

operator-value The comparison operator. Valid values are:

• eq - Equal to
• ge - Greater than or equal to
• gt - Greater than
• le - Less than or equal to
• lt - Less than
• wc - Wildcard

exit-op (Optional) The operator used to compare the current event attribute value with
the exit value.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword
is specified, the maxruntime-number value must be specified. If the maxrun
keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where

ssssssss must be an integer representing seconds from 0 to 31536000, and where
mmm must be an integer representing milliseconds between 0 and 999.

Command Default By default, no events are published when NetFlow operations are triggered.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines You can use the event nfcommand to monitor the NetFlow events. Multiple events can be specified together
for additional filtering on more than one event.

Examples The following example how to configure an applet to monitor NetFlow events:

Router(config)# event manager applet EventNF

Router(config-applet)# event nf event-type create monitor-name mon1 event1 entry-op eq
entry-val val1 field counter bytes long rate-interval 12
Router(config-applet)#

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

153
 event mat through R Commands
event none

event none
To specify that an Embedded Event Manager (EEM) policy is to be registered with the EEM and can be run
manually, use the event none command in applet configuration mode. To remove the event none command
from the configuration file, use the no form of this command.

event [tag event-tag] none [sync {yes | no}] [default] [maxrun maxruntime-number]
no event none

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the trigger
command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

synch Indicates whether the policy should be executed synchronously before the CLI command
executes.
• If the yes keyword is specified, the policy will run synchronously with the CLI
command.
• If the no keyword is specified, the policy will run asynchronously with the CLI
command.

default (Optional) The time period during which the CLI event detector waits for the policy to
exit (specified in ssssssssss[.mmm] format, where ssssssssss must be an integer
representing seconds from 0 to 4294967295, and where mmm must be an integer
representing milliseconds from 0 to 999). If the default time period expires before the
policy exits, the default action will be executed. The default action is to run the command.
If this argument is not specified, the default time period is set to 30 seconds.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword is
not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss.mmm] format, where ssssssss must
be an integer representing seconds between 0 and 31536000, inclusive, and where mmm
must be an integer representing milliseconds between 0 and 999).

Command Default No EEM events are triggered on the basis of Cisco IOS system monitor counters.

Command Modes
Applet configuration (config-applet).

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

Cisco IOS Embedded Event Manager Command Reference

154
 event mat through R Commands
event oir

Release Modification

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

Usage Guidelines EEM usually schedules and runs policies on the basis of an event specification that is contained within the
policy itself. The event none command allows EEM to identify an EEM policy that can either be run manually
or be run when an EEM applet is triggered. To run the policy, use either the action policy command in applet
configuration mode or the event manager run command in global configuration mode.

Examples The following example shows how to register a policy named manual-policy to be run manually and
then how to execute the policy:

Router(config)# event manager applet manual-policy

Router(config-applet)# event none
Router(config-applet)# exit
Router(config)# event manager run manual-policy

Related Commands Command Description

action policy Registers an EEM policy with EEM.

event manager applet Registers an EEM applet with EEM and enters applet
configuration mode.

event manager run Manually runs a registered EEM policy.

show event manager policy registered Displays registered EEM policies.

event oir
To specify that an Embedded Event Manager (EEM) applet be run on the basis of an event raised when a
hardware card online insertion and removal (OIR) occurs, use the event oircommand in applet configuration
mode. To remove the event oir command from the configuration, use the no form of this command.

event [tag event-tag] oir [maxrun maxruntime-number]

no event [tag event-tag] oir [maxrun maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

Cisco IOS Embedded Event Manager Command Reference

155
 event mat through R Commands
event process

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM applets are run on the basis of an OIR event.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

Examples The following example shows how to configure an EEM applet to be run on the basis of an OIR
event:

Router(config)# event manager applet oir-event

Router(config-applet)# event oir
Router(config-applet)# exit

Related Commands Command Description

event manager applet Registers an EEM applet with EEM and enters applet configuration mode.

event process
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of an
event raised when a Cisco IOS Software Modularity process starts, restarts, or stops, use the event
processcommand in applet configuration mode. To remove the process event criteria, use the no form of this
command.

Cisco IOS Embedded Event Manager Command Reference

156
 event mat through R Commands
event process

event process {abort | start | term | user-restart | user-shutdown} path process-name [instance
instance-value] [node node-value]
no event process {abort | start | term | user-restart | user-shutdown} path process-name [instance
instance-value] [node node-value]

Syntax Description abort Specifies that an event is triggered when the specified process cancels with one
of the following abnormal conditions:
• A nonzero exit status.
• A kernel-generated signal is received.
• A SIGTERM or SIGKILL signal is received but not as a result of a user
request.

start Specifies that an event is triggered when the specified process is started.

term Specifies that an event is triggered when the specified process stops normally.

user-restart Specifies that an event is triggered when there is a process restart request from
the CLI command.

user-shutdown Specifies that an event is triggered when there is a process stop request.

path process-name Specifies the path of the process including the process name. If the value of the
process-name argument contains embedded blanks, enclose it in double quotation
marks.

instance instance-value (Optional) Specifies the process instance ID. The ID must be a number in the
range of 1 to 4294967295.

node node-value (Optional) Specifies the node name which is a concatenation of the hardware
slot number and the hardware CPU number.

Command Default No EEM events are triggered on the basis of a Cisco IOS Software Modularity process starting, restarting, or
stopping.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(18)SXF4 This command was introduced.

Examples The following example shows how to specify that an event is triggered when a Software Modularity
process starts:

Router(config)# event manager applet process_term

Router(config-applet)# event process start path “cdp2.iosproc”

Cisco IOS Embedded Event Manager Command Reference

157
 event mat through R Commands
event resource

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event resource
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of an
Embedded Resource Manager (ERM) event report for a specified policy, use the event resource command
in applet configuration mode. To remove the report event criteria, use the no form of this command.

event [tag event-tag] resource policy policy-filename [maxrun maxruntime-number]

no event [tag event-tag] resource policy policy-filename [maxrun maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

policy Indicates that a specific policy is identified.

policy-filename Policy name.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM event criteria are specified.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(2)T This command was introduced.

12.2(31)SB3 This command was integrated into Cisco IOS Release 12.2(31)SB3.

12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI.

Cisco IOS Embedded Event Manager Command Reference

158
 event mat through R Commands
event rf

Usage Guidelines The resource event detector publishes an event when the ERM reports an event for the specified policy. The
ERM infrastructure tracks resource depletion and resource dependencies across processes and within a system
to handle various error conditions. The error conditions are handled by providing an equitable sharing of
resources between various applications. The ERM framework provides a communication mechanism for
resource entities and allows communication between these resource entities from numerous locations. The
ERM framework also helps in debugging the CPU and memory- related issues. The ERM monitors system
resource usage to better understand scalability needs by allowing you to configure threshold values for resources
such as CPU, buffer, and memory.

Examples The following example shows how to specify event criteria based on an ERM event report for a
policy defined to report high CPU usage:

Router(config)# event manager applet policy-one

Router(config-applet)# event resource policy cpu-high
Router(config-applet)# action 1.0 syslog msg “CPU high at $_resource_current_value percent”

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event rf
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of
Redundancy Framework (RF) state change notifications, use the event rfcommand in applet configuration
mode. To remove the RF event criteria, use the no form of this command.

event [tag event-tag] rf event rf-state-name [maxrun maxruntime-number]

no event [tag event-tag] rf event rf-state-name [maxrun maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the trigger command
to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

Cisco IOS Embedded Event Manager Command Reference

159
 event mat through R Commands
event rf

event Compares the regular expression contained in the rf-state-name argument with an RF state change
notification. If there is a match, an event is triggered. The rf-state-name argument takes one of
the following values:
• RF_EVENT_CLIENT_PROGRESSION
• RF_EVENT_CONTINUE_PROGRESSION
• RF_EVENT_GO_ACTIVE
• RF_EVENT_GO_ACTIVE_EXTRALOAD
• RF_EVENT_GO_ACTIVE_HANDBACK
• RF_EVENT_GO_STANDBY
• RF_EVENT_KEEP_ALIVE
• RF_EVENT_KEEP_ALIVE_TMO
• RF_EVENT_LOCAL_PROG_DONE
• RF_EVENT_NEGOTIATE
• RF_EVENT_NOTIFICATION_TMO
• RF_EVENT_PEER_PROG_DONE
• RF_EVENT_STANDBY_PROGRESSION
• RF_EVENT_START_PROGRESSION
• RF_EVENT_SWACT_INHIBIT_TMO
• RF_PROG_ACTIVE
• RF_PROG_ACTIVE_DRAIN
• RF_PROG_ACTIVE_FAST
• RF_PROG_ACTIVE_POSTCONFIG
• RF_PROG_ACTIVE_PRECONFIG
• RF_PROG_EXTRALOAD
• RF_PROG_HANDBACK
• RF_PROG_INITIALIZATION
• RF_PROG_PLATFORM_SYNC

Cisco IOS Embedded Event Manager Command Reference

160
 event mat through R Commands
event rf

• RF_PROG_STANDBY_BULK
• RF_PROG_STANDBY_COLD
• RF_PROG_STANDBY_CONFIG
• RF_PROG_STANDBY_FILESYS
• RF_PROG_STANDBY_HOT
• RF_REGISTRATION_STATUS
• RF_STATUS_MAINTENANCE_ENABLE
• RF_STATUS_MANUAL_SWACT
• RF_STATUS_OPER_REDUNDANCY_MODE_CHANGE
• RF_STATUS_PEER_COMM
• RF_STATUS_PEER_PRESENCE
• RF_STATUS_REDUNDANCY_MODE_CHANGE
• RF_STATUS_SWACT_INHIBIT

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword is
not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm]format, where ssssssss must

be an integer representing seconds between 0 and 31536000, inclusive, and where mmm
must be an integer representing milliseconds between 0 and 999.

Command Default No EEM events are triggered.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(2)T This command was introduced.

12.2(31)SB3 This command was integrated into Cisco IOS Release 12.2(31)SB3.

12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.4(20)T The tag and maxrun keywords were added to support multiple event statements within an
applet.

12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI.

Usage Guidelines An EEM event is triggered when the expression in the rf-state-name argument matches an RF state change
notification. The RF event detector publishes an event when one or more RF events occur during
synchronization in a dual Route Processor (RP) system.

Cisco IOS Embedded Event Manager Command Reference

161
 event mat through R Commands
event routing

Examples The following example shows how to specify event criteria based on an RF state change notification:

Router(config)# event manager applet start-rf

Router(config-applet)# event rf event rf_prog_initialization
Router(config-applet)# action 1.0 syslog msg "rf state rf_prog_initialization reached"

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event routing
To publish an event when route entries change in Routing Information Base (RIB) infrastructure, use the
event routing command in applet configuration mode. To stop publishing events when route entries change
in RIB, use the no form of this command.

event [{tag event-tag}] routing network ip-address/length [{ge ge-length}] [{le le-length}] [{protocol
protocol-value}] [{type {add | all | modify | remove}}] [{maxrun maxruntime-number}]
no event [{tag event-tag}] routing

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

network Specifies the network ip address and length, whose route is to be monitored.

ip-address / length The ip address and length of the network to be monitored. For example, 192.0.2.4/8.

ge ge-length (Optional) Specifies the minimum prefix length to be matched.

le le-length (Optional) Specifies the maximum prefix length to be matched.

ne ne-length (Optional) Specifies the prefix length not to be matched.

protocol (Optional) Specifies the protocol value for the network being monitored.

protocol-value The network protocol value. One of the following protocols can be used: all, bgp,
connected, eigrp, isis, iso-igrp, lisp, local, mobile, odr, ospf, ospfv3, rip, and static.
The default is all.

type (Optional) Specifies the desired policy trigger. The default is all.

add Specifies that an entry is added to the routing table.

all Specifies that a routing table entry is added, removed, or modified.

modify Specifies that an entry in the routing table is modified.

remove Specifies that an entry is removed from the routing table

Cisco IOS Embedded Event Manager Command Reference

162
 event mat through R Commands
event routing

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds from 0 to 31536000, inclusive, and where
mmm must be an integer representing milliseconds between 0 and 999.

Command Default By default, no events are published when route entries change in RIB infrastructure.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

Cisco IOS 12.4(22)T This command was introduced.

Cisco IOS 12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Cisco IOS XE 3.13S This command was modified. The network protocol value local was added.

Usage Guidelines An EEM event is published when route-entry changes are detected in a RIB infrastructure. The network IP
address for the route to be monitored must be specified. Network prefixes to be matched, protocol values, and
type are optional parameters.

Note Modification of an existing static route may result in a remove event followed by an add event for the old
API (v1.0) or a modify event for the new API (v2.0) depending on the Cisco IOS release.

Examples The following example shows how a specific route entries change when many parameters is monitored:

Device> enable
Device# configure terminal
Device(config)# event manager applet EventRouting
Device(config-applet)# event routing 192.0.2.4/8 protocol static type add ge 5 maxrun 56
Device(config-applet)#

The following example shows the output for the Cisco IOS version that uses the old routing API
(v1.0):

Device# show event manager detector routing

No. Name Version Node Type
1 routing 01.00 node0/0 RP

The following example shows the output for the Cisco IOS version that uses the new routing API
(v2.0):

Device# show event manager detector routing

No. Name Version Node Type
1 routing 02.00 node0/0 RP

Cisco IOS Embedded Event Manager Command Reference

163
 event mat through R Commands
event rpc

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

event rpc
To configure the router to accept Embedded Event Manger (EEM) applet using the remote procedure call
(RPC) command, use the event rpccommand in applet configuration mode. To disable EEM applet using the
RPC command, use the no form of this command.

event [tag event-tag] rpc [maxrun maxruntime-number]

no event [tag event-tag] rpc [maxrun maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default Event RPC is disabled.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use this command to allow an EEM applet to be executed using the RPC command.
When an applet is configured to run using the RPC command, all output is still sent to the
Command-Line-Interface (CLI) console and not sent in the RPC reply message; so an RPC ED applet is not
very useful.

Examples The following example shows how to configure the event rpc command with maximum runtime set
to 3000 seconds.

Router(onfig-applet)# event rpc maxrun 3000

The following example shows how to send a Simple Object Access Protocol (SOAP) message request
and receive reply:

Cisco IOS Embedded Event Manager Command Reference

164
event mat through R Commands
event rpc

Request Syntax

<?xml version="1.0"?>
<SOAP:Envelope xmlns:SOAP="http://www.cisco.com/eem.xsd">
<SOAP:Body>
<run_emscript>
<script_name> name of script </script_name>
<argc> argc value </argc>
<arglist>
<l> argv1 value </l>
<l> argv2 value </l>
...
<l> argvn value </l>
</arglist>
</run_Eemscript>
</SOAP:Body>
</SOAP:Envelope>

To send the request, enter “]]>]]>”

Reply Syntax

<?xml version="1.0"?>
<SOAP:Envelope xmlns:SOAP="http://www.cisco.com/eem.xsd">
<SOAP:Body>
<run_Eemscript_response>
<return_code> rc </return_code>
<output> output string </output>
</run_eemscript_response>
</SOAP:Body>
</SOAP:Envelope>

The following example shows how to configure the applet called RPC_example:

event manager applet RPC_example

event rpc
action output puts "hello world"

The following example shows how to run the applet using SSH:

infra-view11 {/users/johndoe} ssh -2 -s user@172.16.0.0 eem_rpc

Password:
<?xml version="1.0" encoding="UTF-8"?>
<SOAP:Envelope xmlns:SOAP="http://www.cisco.com/eem.xsd">
<SOAP:Body>
<run_eemscript>
<script_name>RPC_example</script_name>
</run_eemscript>
</SOAP:Body>
</SOAP:Envelope>
]]>]]>
<?xml version="1.0" encoding="UTF-8"?><SOAP:Envelope
xmlns:SOAP="http://www.cisco.com/eem.xsd"><SOAP:Body><run_eemscript_response><return_code>0</return_code><output></output></run_eemscript_response></SOAP:Body></SOAP:Envelope>]]>]]>

Cisco IOS Embedded Event Manager Command Reference

165
 event mat through R Commands
event snmp

Related Commands Command Description

event manager detector rpc Configures the router to accept EEM applet using the RPC event detector
commands.

event snmp
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by sampling Simple
Network Management Protocol (SNMP) object identifier values, use the event snmpcommand in applet
configuration mode. To remove the SNMP event criteria, use the no form of this command.

event [tag event-tag] snmp oid oid-value get-type {exact | next} entry-op operator entry-val
entry-value entry-type {value | increment | rate} [exit-comb {or | and}] [exit-op operator] [exit-val
exit-value] [exit-type {value | increment | rate}] [exit-time exit-time-value] [exit-event {true | false}]
[average-factor average-factor-value] poll-interval poll-int-value [maxrun maxruntime-number]
no event [tag event-tag] snmp oid oid-value get-type {exact | next} entry-op operator entry-val
entry-value entry-type {value | increment | rate} [exit-comb {or | and}] [exit-op operator] [exit-val
exit-value] [exit-type {value | increment | rate}] [exit-time exit-time-value] [exit-event {true | false}]
[average-factor average-factor-value] poll-interval poll-int-value [maxrun maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

oid Specifies the SNMP object identifier (object ID) value in the oid-value argument as
the event criteria.

oid-value Object ID value of the data element, in SNMP dotted notation. An OID is defined
as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and
each type has an object value. Monitoring of some OID types is supported. When
the oid keyword is used, an error message is returned if the OID is not one of the
following:
• INTEGER_TYPE
• COUNTER_TYPE
• GAUGE_TYPE
• TIME_TICKS_TYPE
• COUNTER_64_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE

get-type Specifies the type of SNMP get operation to be applied to the object ID specified
by the oid-value argument.

exact Retrieves the object ID specified by the oid-value argument.

Cisco IOS Embedded Event Manager Command Reference

166
event mat through R Commands
event snmp

next Retrieves the object ID that is the alphanumeric successor to the object ID specified
by the oid-value argument.

entry-op Compares the contents of the current object ID with the entry value using the specified
operator. If there is a match, an event is triggered and event monitoring is disabled
until the exit criteria are met.

operator Two-character string. The operatorargument takes one of the following values:
• gt --Greater than.
• ge --Greater than or equal to.
• eq --Equal to.
• ne --Not equal to.
• lt --Less than.
• le --Less than or equal to.

entry-val Specifies the value with which the contents of the current object ID are compared
to decide if an SNMP event should be raised.

entry-value Entry object ID value of the data element.

entry-type Specifies a type of operation to be applied to the object ID specified by the entry-value
argument.

value Value is defined as the actual value of the entry-value or exit-valueargument.

increment Increment uses the entry-value or exit-valuefield as an incremental difference and

the entry-valueor exit-valueis compared with the difference between the current
counter value and the value when the event was last triggered (or the first polled
sample if this is a new event). A negative value checks the incremental difference
for a counter that is decreasing.

rate Rate is defined as the average rate of change over a period of time. The time period
is the average-factor-value multiplied by the poll-int-value. At each poll interval
the difference between the current sample and the previous sample is taken and
recorded as an absolute value. An average of the previous average-factor-value
samples is taken to be the rate of change.

exit-comb (Optional) Indicates the combination of exit conditions that must be met before event
monitoring is reenabled.

or (Optional) Specifies that an exit comparison operator and an exit object ID value or
an exit time value must exist.

and (Optional) Specifies that an exit comparison operator, an exit object ID value, and
an exit time value must exist.

exit-op (Optional) Compares the contents of the current object ID with the exit value using
the specified operator. If there is a match, an event is triggered and event monitoring
is reenabled.

Cisco IOS Embedded Event Manager Command Reference

167
 event mat through R Commands
event snmp

exit-val (Optional) Specifies the value with which the contents of the current object ID are
compared to decide whether the exit criteria are met.

exit-value (Optional) Exit object ID value of the data element.

exit-type (Optional) Specifies a type of operation to be applied to the object ID specified by

the exit-value argument. If not specified, the value is assumed.

exit-time (Optional) Specifies the time period after which the event monitoring is reenabled.
The timing starts after the event is triggered.

exit-time-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If only milliseconds are used, the format is 0.mmm.

exit-event (Optional) Indicates whether a separate exit event is to be triggered when event
monitoring is enabled after an initial event is triggered.

true (Optional) Specifies that a separate exit event is triggered.

false (Optional) Specifies that a separate exit event is not triggered. This is the default.

average-factor (Optional) Specifies a number used to calculate the period used for rate-based
calculations. The average-factor-value is multiplied by the poll-int-value to derive
the period in milliseconds.

average-factor-value (Optional) Number in the range from 1 to 64. The minimum average factor value is
1.

poll-interval Specifies the time interval between consecutive polls.

poll-int-value Number that represents seconds and optional milliseconds in the format ssssss[.mmm].
The range for seconds is from 1 to 4294967295. The range for milliseconds is from
0 to 999. The minimum polling interval is 1 second.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in SSSSSSSSSS[.MMM] format, where

SSSSSSSSSS must be an integer representing seconds between 0 and 4294967295,
inclusive, and where MMM must be an integer representing milliseconds between
0 and 999.

Command Default No EEM events are triggered on the basis of SNMP object identifier values.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.0(26)S This command was introduced.

Cisco IOS Embedded Event Manager Command Reference

168
 event mat through R Commands
event snmp

Release Modification

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.3(2)XE This command was integrated into Cisco IOS Release 12.3(2)XE.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

12.3(14)T Optional keywords to support SNMP rate-based events were added.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrunkeywords and associated arguments were added.

Usage Guidelines An EEM event is triggered when one of the fields specified by an SNMP object ID crosses a defined threshold.
If multiple conditions exist, the SNMP event will be triggered when all the conditions are met.
Exit criteria are optional. If exit criteria are not specified, event monitoring will be reenabled immediately. If
exit criteria are specified--on the basis of values or time periods--event monitoring is not reenabled until the
criteria are met.
When the entry-op keyword is used and there is a match, an event is triggered and event monitoring is disabled
until the exit criteria are met.
When the exit-op keyword is used and there is a match, an event is triggered and event monitoring is reenabled.
The entry-typekeyword triggers one of the following actions:
• If the value keyword is specified, the entry-value is an actual value and an SNMP event is raised whenever
the absolute value occurs.
• If the increment keyword is specified, the entry-value is an increment and an SNMP event is raised
whenever the incremental value is reached.
• If the rate keyword is specified, the entry-value is a rate of change and an SNMP event is raised whenever
the rate of change value is reached.

When the optional exit-typekeyword is used, the following occurs:

• If the value keyword is specified, the exit-value is an actual value and the event monitoring is reenabled
whenever the absolute value occurs. This is the default.
• If the increment keyword is specified, the exit-value is an increment and the event monitoring is reenabled
whenever the incremental value is reached.
• If the rate keyword is specified, the exit-value is a rate of change and the event monitoring is reenabled
whenever the rate of change value is reached.

Cisco IOS Embedded Event Manager Command Reference

169
 event mat through R Commands
event snmp-notification

The increment and rate types are supported only for the following OID types: INTEGER_TYPE,
COUNTER_TYPE, and COUNTER_64_TYPE.

Examples The following example shows how an EEM applet called memory-fail will run when there is an
exact match on the value of a specified SNMP object ID that represents the amount of current process
memory. A message saying that process memory is exhausted and noting the current available memory
will be sent to syslog.

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op
lt entry-val 5120000 poll-interval 10
Router(config-applet)# action 1.0 syslog msg "Memory exhausted; current available memory
is $_snmp_oid_val bytes"

The following example shows an EEM applet called IPSLAping1 being registered to run when there
is an exact match on the value of a specified SNMP object ID that represents a successful IP SLA
ICMP echo operation (this is equivalent to a ping command). Four actions are triggered when the
echo operation fails, and event monitoring is disabled until after the second failure.
A message saying that the ICMP echo operation to a server failed is sent to syslog, an SNMP trap
is generated, EEM publishes an application-specific event, and a counter called IPSLA1F is
incremented by a value of one.

Router(config)# event manager applet IPSLAping1

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.4 get-type exact
entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 5
Router(config-applet)# action 1.0 syslog priority critical msg "Server IP echo failed:
OID=$_snmp_oid_val"
Router(config-applet)# action 1.1 snmp-trap strdata "EEM detected server reachability
failure to 10.1.88.9"
Router(config-applet)# action 1.2 publish-event sub-system 88000101 type 1 arg1 10.1.88.9
arg2 IPSLAEcho arg3 fail

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event snmp-notification
To register the event criteria for an Embedded Event Manager (EEM) applet that is run by sampling Simple
Network Management Protocol (SNMP) notification, use the event snmp-notificationcommand in applet
configuration mode. To remove the SNMP notification event criteria, use the no form of this command.

event [tag event-tag] snmp-notification oid oid-string oid-val comparison-value op operator

[maxrun maxruntime-number] [src-ip-address ip-address] [dest-ip-address ip-address] [default
seconds] [direction {incoming | outgoing}] [msg-op {drop | send}]
no event [tag event-tag] snmp-notification

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

Cisco IOS Embedded Event Manager Command Reference

170
event mat through R Commands
event snmp-notification

event-tag (Optional) String that identifies the tag.

oid Specifies the SNMP object identifier (object ID) values in the oid-val argument as
the event criteria.

oid-string Object ID value of the data element, in SNMP dotted notation. An OID is defined
as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and
each type has an object value. Monitoring of some OID types is supported. When
the oid keyword is used, an error message is returned if the OID is not one of the
following:
• COUNTER_TYPE
• COUNTER_64_TYPE
• GAUGE_TYPE
• INTEGER_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE
• TIME_TICKS_TYPE

oid-val Specifies the OID comparison value.

comparison-value

op Compares the contents of the current object ID with the SNMP Protocol Data Unit
(PDU) entry value using the specified operator. If there is a match, an event is
triggered and event monitoring is disabled until the exit criteria are met.

operator Two-character string. The operatorargument takes one of the following values:
• gt --Greater than.
• ge --Greater than or equal to.
• eq --Equal to.
• ne --Not equal to.
• lt --Less than.
• le --Less than or equal to.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999. The
default value is 20 seconds.

src-ip-address (Optional) Specifies the source IP address where the SNMP notification trap
originates. The default is all; it is set to receive SNMP notification traps from all IP
addresses.

Cisco IOS Embedded Event Manager Command Reference

171
 event mat through R Commands
event snmp-notification

ip-address (Optional) The source IP address.

dest-ip-address (Optional) Specifies the destination IP address where the SNMP notifications trap
is sent. The default is all; it is set to receive SNMP traps from all destination IP
addresses.

dest-ip-address (Optional) The destination IP address.

default seconds (Optional) Specifies the time period during which the snmp notification event
detector waits for the policy to exit. The time period is specified in ssssssssss[.mmm]
format, where ssssssssss must be an integer representing seconds between 0 and
4294967295 and mmm must be an integer representing milliseconds between 0 and
999.

direction (Optional) Determines the direction of the SNMP trap or inform PDU to filter. The
default is incoming.
incoming --Specifies the incoming direction of the SNMP trap or inform PDU to
filter.
outgoing --Specifies the outgoing direction of the SNMP trap or inform PDU to
filter.

msg-op (Optional) Indicates the action to be taken on the SNMP PDU, drop it or send it
once the event is triggered.
drop --Specifies to drop the messages.
send --Specifies to send the messages.

Command Default No EEM events are triggered on the basis of SNMP notification object identifier values.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(20)T This command was introduced.

15.0(1)M This command was modified. The following keywords and arguments were added: default,
seconds, direction, incoming, outgoing, msg-op, drop, and send.

Usage Guidelines The SNMP notification event detector provides the ability to intercept SNMP trap and inform messages
coming into the router. An SNMP notification event is generated when an incoming SNMP trap or inform
message matches specified values or crosses specified thresholds.
The SNMP and the SNMP server manager must be configured and enabled prior to the use of the
snmp-notification event detector.
An EEM event is triggered when one of the fields specified by an SNMP notification object ID crosses a
defined threshold. If multiple conditions exist, the SNMP notification event is triggered when all the conditions
are met.

Cisco IOS Embedded Event Manager Command Reference

172
 event mat through R Commands
event snmp-notification

An OID is defined as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and each type
has an object value. Monitoring of some OID types is supported. When the oid keyword is used, an error
message is returned if the OID is not one of the following:
• INTEGER_TYPE
• COUNTER_TYPE
• GAUGE_TYPE
• TIME_TICKS_TYPE
• COUNTER_64_TYPE
• OCTET_PRIM_TYPE
• OPAQUE_PRIM_TYPE

When the op keyword is used and there is a match, an event is triggered and event monitoring is disabled
until the exit criteria are met.
The operatorargument takes one of the following values:
• gt --Greater than.
• ge --Greater than or equal to.
• eq --Equal to.
• ne --Not equal to.
• lt --Less than.
• le --Less than or equal to.

Examples The following example shows how to configure the snmp-server community public RW and
snmp-server manager commands before event snmp-notification is configured.

Router(config)# snmp-server community public RW

Router(config)# snmp-server manager

The following example shows how an EEM applet called SNMP_Notification is being registered to
run an EEM script when the router receives an SNMP notification on destination IP address
192.168.1.1 for object OID 1 whose value equals 10.

Router(config)# event manager applet SNMP_Notification

Router(config-applet)# event snmp-notification dest-ip-address 192.168.1.1 oid 1 op eq
oid-val 10
Router(config-applet)# action 1 policy eem_script

The following example shows how to intercept an outgoing SNMP trap with the OID
1.3.6.1.4.1.318.2.3.3 and OID value of "UPS: Returned from battery backup power", drop the message
and send out a different one.

Router(config)# event manager applet SNMP_Notification

Router(config-applet)# event snmp-notification dest_ip_address 192.168.1.1 oid
1.3.6.1.4.1.318.2.3.3 op eq oid-value "UPS: Returned from battery backup power" direction
outgoing msg-op drop

Cisco IOS Embedded Event Manager Command Reference

173
 event mat through R Commands
event snmp-object

Related Commands Command Description

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

event snmp-object
To register the Simple Network Management Protocol (SNMP) object event for an Embedded Event Manager
(EEM) applet that is run by sampling the SNMP object, use the event snmp-object command in applet
configuration mode. To remove the SNMP object event criteria, use the no form of this command.

event snmp-object oid oid-value type value sync {yes | no} skip {yes | no} istable {yes | no}
[default seconds] [maxrun maxruntime-number]
no event snmp-object

Syntax Description oid Specifies the SNMP object identifier (object ID).

oid-value Object ID value of the data element in SNMP dotted notation. An OID is defined as a
type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and each type
has an object value.

type value Specifies the type of object. The following values are valid:
• counter --A 32-bit number with a minimum value of 0. When the maximum value
is reached, the counter resets to 0.
• counter64 --A 64-bit number with a minimum value of 0. When the maximum
value is reached, the counter resets to 0.
• gauge --A 32-bit number with a minimum value of 0. For example, the interface
speed on a router is measured using a gauge object type.
• int --A 32-bit number used to specify a numbered type within the context of a
managed object. For example, to set the operational status of a router interface, 1
represents up and 2 represents down.
• ipv4 --IP version 4 address.
• octet --An octet string in hex notation used to represent physical addresses.
• oid --Object identifier value.
• string --An octet string in text notation used to represent text strings.
• uint --A 32-bit number used to represent decimal value.

sync Specifies the SNMP and EEM policy execution.

• no --Policy and SNMP will run asynchronously.
• yes --Run policy and the result determines whether to run SNMP request.

Cisco IOS Embedded Event Manager Command Reference

174
 event mat through R Commands
event snmp-object

skip Mandatory if sync is set to no and should not be used if sync is yes. Specifies whether
to skip CLI command execution.
• no --CLI command should be executed.
• yes --CLI command should not be executed.

istable (Optional) Specifies whether the OID is a SNMP table.

• yes --OID is an SNMP table.
• no --IOD is not an SNMP table.

default (Optional) The time period during which the SNMP Object event detector waits for the
policy to exit.

seconds (Optional) Number that represents seconds and optional milliseconds in the format
ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in
the format 0.mmm.

maxrun (Optional) Specifies the maximum runtime of the applet.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must
be an integer representing seconds from 0 to 31536000, and where mmm must be an
integer representing milliseconds between 0 and 999. The default value is 20 seconds.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

15.0(1)M This command was introduced.

15.0(1)M1 This command was modified. The counter64 and oid values were added to the type keyword.

Usage Guidelines Use the event snmp-object command to register the SNMP object event for an EEM applet that is run by
sampling SNMP object.

Examples The following example shows how to use the event snmp-object command:

Router(config)# event manager applet test

Router(config-applet)# event snmp-object

Related Commands Command Description

action syslog Specifies the action of writing a message to syslog when an EEM applet is triggered.

event manager applet Registers an event applet with the EEM and enters applet configuration mode.

Cisco IOS Embedded Event Manager Command Reference

175
 event mat through R Commands
event syslog

event syslog
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by matching syslog
messages, use the event syslogcommand in applet configuration mode. To remove the syslog message event
criteria, use the no form of this command.

event [tag event-tag] syslog pattern regular-expression [occurs num-occurrences] [period

period-value] [priority priority-level] [severity-level] [maxrun maxruntime-number]
no event [tag event-tag] syslog pattern regular-expression [occurs num-occurrences] [period
period-value] [priority priority-level] [severity-level] [maxrun maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

pattern Specifies that a regular expression is used to perform the syslog message pattern match.

regular-expression String value that is the pattern to be matched.

occurs (Optional) Specifies the number of matching occurrences before an EEM event is
triggered. If a number is not specified, an EEM event is triggered after the first match.

num-occurrences (Optional) Integer in the range of 1 to 32, inclusive.

period (Optional) Specifies the time interval during which the one or more occurrences must
take place. If the period keyword is not specified, no time-period check is applied.

period-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in
the format 0.mmm.

priority (Optional) Specifies the priority level of the syslog messages to be screened. If this
keyword is selected, the priority-level argument must be defined. If this keyword is
not specified, the software will use the default of priority all, and all priorities will
be considered when log messages are screened.

priority-level (Optional) Number or name of the desired priority level against which syslog messages
are matched. Messages at or numerically lower than the specified level are matched.
Valid levels for the priority-level argument are as follows (enter the keyword or number,
if available):
• all --All priorities are considered when log messages are screened.
• {0 | emergencies}--System is unusable.
• {1 | alerts}--Immediate action is needed.
• {2 | critical}--Critical conditions.
• {3 | errors}--Error conditions.

Cisco IOS Embedded Event Manager Command Reference

176
 event mat through R Commands
event syslog

• {4 | warnings}--Warning conditions.
• {5 | notifications}--Normal but significant conditions.
• {6 | informational}--Informational messages.
• {7 | debugging}--Debugging messages.

severity-level (Optional) Specifies the severity level of the syslog messages to be screened. If no
severity level is specified, the software will not use any severity filtering and all events
will be considered when log messages are screened.
The severity-level argument may be one or more of the following keywords:
• severity-critical --Critical conditions.
• severity-debugging --Debugging messages.
• severity-fatal --Fatal conditions.
• severity-major --Major conditions.
• severity-minor --Minor conditions.
• severity-normal --Normal conditions.
• severity-notification --Significant conditions.
• severity-warning --Warning conditions.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and where
mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM events are triggered on the basis of matches with syslog messages.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.0(26)S This command was introduced.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

12.3(14)T Optional severity-level keywords were added.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

Cisco IOS Embedded Event Manager Command Reference

177
 event mat through R Commands
event syslog

Release Modification

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added were added to support multiple event statements
within an applet.

Usage Guidelines Use the event syslog command to set up event criteria against which syslog messages are matched. Syslog
messages are compared against a specified regular expression. After a specified number of matches occurs
within a specified time period, an EEM event is triggered. If multiple conditions exist, the EEM event is
triggered when all the conditions are met.
Valid levels for the priority-level argument are as follows (enter the keyword or number, if available):
• all --All priorities are considered when log messages are screened.
• {0 | emergencies}--System is unusable.
• {1 | alerts}--Immediate action is needed.
• {2 | critical}--Critical conditions.
• {3 | errors}--Error conditions.
• {4 | warnings}--Warning conditions.
• {5 | notifications}--Normal but significant conditions.
• {6 | informational}--Informational messages.
• {7 | debugging}--Debugging messages.

The severity-level argument may be one or more of the following keywords:

• severity-critical --Critical conditions.
• severity-debugging --Debugging messages.
• severity-fatal --Fatal conditions.
• severity-major --Major conditions.
• severity-minor --Minor conditions.
• severity-normal --Normal conditions.
• severity-notification --Significant conditions.
• severity-warning --Warning conditions.

Cisco IOS Embedded Event Manager Command Reference

178
 event mat through R Commands
event timer

Examples The following example shows how to specify an EEM applet to run when syslog identifies that
Ethernet interface 1/0 is down. The applet sends a message about the interface to syslog.

Router(config)# event manager applet interface-down

Router(config-applet)# event syslog pattern {.*UPDOWN.*Ethernet1/0.*} occurs 4

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event timer
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of
time-specific events, use the event timercommand in applet configuration mode. To remove the time-specific
event criteria, use the no form of this command.

event [tag event-tag] timer {absolute time time-value | countdown time time-value | cron cron-entry
cron-entry | watchdog time time-value} [name timer-name]
no event [tag event-tag] timer {absolute time time-value | countdown time time-value | cron
cron-entry cron-entry | watchdog time time-value} [name timer-name]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

absolute Specifies that an event is triggered when the specified absolute time of day occurs.

time Specifies the time interval during which the event must take place.

time-value Integer that specifies, in seconds and optional milliseconds, the time interval during
which the event must take place. The range for seconds is from 0 to 4294967295 and
the range for milliseconds is from 0 to 999. The format is ssssss[.mmm]. When only
milliseconds are specified, use the format 0.mmm.

countdown Specifies that an event is triggered when the specified time counts down to zero. The
timer does not reset.

cron Specifies that an event is triggered when the CRON string specification matches the
current time.

cron-entry Specifies the first five fields of a UNIX crontab entry as used with the UNIX CRON
daemon.

Cisco IOS Embedded Event Manager Command Reference

179
 event mat through R Commands
event timer

cron-entry Text string that consists of five fields separated by spaces. The fields represent the
times and dates when CRON timer events will be triggered. Fields and corresponding
values are as follows:
• • minute --A number in the range from 0 to 59 that specifies when a CRON
timer event is triggered.
• hour --A number in the range from 0 to 23 that specifies when a CRON
timer event is triggered.
• day-of-month --A number in the range from 1 to 31 that specifies the day
of the month when a CRON timer event is triggered.
• month --A number in the range from 1 to 12 or the first three letters (not
case-sensitive) of the name of the month in which a CRON timer event is
triggered.
• day-of-week --A number in the range from 0 to 6 (Sunday is 0) or the first
three letters (not case-sensitive) of the name of the day when a CRON timer
event is triggered.

Instead of the first five fields, special strings can be entered. See the “Usage
Guidelines” section for details.

watchdog Specifies that an event is triggered when the specified time counts down to zero. The
timer automatically resets to the initial value and continues to count down.

name (Optional) Specifies that the timer is named.

timer-name (Optional) Name of the timer.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM events are triggered on the basis of time-specific events.

Command Modes
Applet configuration

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

Cisco IOS Embedded Event Manager Command Reference

180
 event mat through R Commands
event timer

Release Modification

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The tag and maxrun keywords were added were added to support multiple event statements
within an applet.

Usage Guidelines For the cron-entryargument, the following special strings also are allowed in syntax:
• Range of numbers--The specified range is inclusive, and a hyphen separates the numbers. For example,
8-11 after the hour field specifies execution of a CRON timer event at hours 8, 9, 10, and 11.
• Asterisk (*)--Indicates that a field is not specified and can be any value.
• List--A list is a set of numbers or ranges separated by a comma but no space. For example, 1,2,5,9 or
0-4,8-12.
• Step value in conjunction with a range--Following a range with /number specifies skips of the number
value through the range. For example, 0-23/2 in the hour field specifies that an event is triggered every
second hour. Steps are permitted after an asterisk, for example */2 means every two hours.

Instead of the five fields of a UNIX crontab entry for the cron-entry argument, one of the following seven
special strings can be entered:
• @yearly --An event is triggered once a year. This is the equivalent of specifying 0 0 1 1 * for the first
five fields.
• @annually --Same as @yearly.
• @monthly --An event is triggered once a month. This is the equivalent of specifying 0 0 1 * * for the
first five fields.
• @weekly --An event is triggered once a week. This is the equivalent of specifying 0 0 * * 0 for the first
five fields.
• @daily --An event is triggered once a day. This is the equivalent of specifying 0 0 * * * for the first five
fields.
• @midnight --Same as @daily.
• @hourly --An event is triggered once an hour. This is the equivalent of specifying 0 * * * * for the first
five fields.

A CRON timer may not produce the intended result if the time-of-day clock is not set to the correct time.
Network Time Protocol (NTP) services can be used to facilitate keeping an accurate time-of-day clock setting.
For more details on NTP configuration, see the “Performing Basic System Management” chapter of the Cisco
IOS Network Management Configuration Guide , Release 12.4.

Examples The following example shows how to specify that an event is triggered one time after 5 hours:

Router(config)# event manager applet timer-absolute

Router(config-applet)# event timer absolute time 18000

Cisco IOS Embedded Event Manager Command Reference

181
 event mat through R Commands
event track

The following example shows how to specify that an event is triggered once after 6 minutes and 6
milliseconds:

Router(config)# event manager applet timer-set

Router(config-applet)# event timer countdown time 360.006 name six-minutes

The following example shows how to specify that an event is triggered at 1:01 a.m. on January 1
each year:

Router(config)# event manager applet timer-cron1

Router(config-applet)# event timer cron cron-entry 1 1 1 1 * name Jan1

The following example shows how to specify that an event is triggered at noon on Monday through
Friday of every week:

Router(config)# event manager applet timer-cron2

Router(config-applet)# event timer cron cron-entry 0 12 * * 1-5 name MonFri

The following example shows how to specify that an event is triggered at midnight on Sunday every
week:

Router(config)# event manager applet timer-cron3

Router(config-applet)# event timer cron cron-entry @weekly name Sunday

The following example shows how to specify that an event is triggered every 5 hours:

Router(config)# event manager applet timer-watch

Router(config-applet)# event timer watchdog time 18000

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

event track
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of a Cisco
IOS Object Tracking subsystem report for the specified object number, use the event track command in
applet configuration mode. To remove the report event criteria, use the no form of this command.

event [label] [tag event-tag] track object-number [state {up | down | any}] [maxrun
maxruntime-number]
no event [label] [tag event-tag] track object-number [state {up | down | any}] [maxrun
maxruntime-number]

Syntax Description tag (Optional) Specifies a tag using the event-tag argument that can be used with the
trigger command to support multiple event statements within an applet.

event-tag (Optional) String that identifies the tag.

label (Optional) Unique identifier that can be any string. If the string contains embedded
blanks, enclose it in double quotation marks.

Cisco IOS Embedded Event Manager Command Reference

182
 event mat through R Commands
event track

object-number Tracked object number in the range from 1 to 500, inclusive. The number is defined
using the track stub command.

state (Optional) Specifies that the tracked object transition will cause an event to be raised.

up (Optional) Specifies that an event will be raised when the tracked object transitions
from a down state to an up state.

down (Optional) Specifies that an event will be raised when the tracked object transitions
from an up state to a down state.

any (Optional) Specifies that an event will be raised when the tracked object transitions
to or from any state. This is the default.

maxrun (Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is
specified, the maxruntime-number value must be specified. If the maxrun keyword
is not specified, the default applet run time is 20 seconds.

maxruntime-number (Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss

must be an integer representing seconds between 0 and 31536000, inclusive, and
where mmm must be an integer representing milliseconds between 0 and 999).

Command Default No EEM event criteria are specified.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(2)T This command was introduced.

12.2(31)SB3 This command was integrated into Cisco IOS Release 12.2(31)SB3.

12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB.

12.4(20)T The tag and maxrunkeywords were added to support multiple event statements within an
applet.

12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI.

Usage Guidelines There are two entry variables associated with this command:
• _track_number--Number of the tracked object that caused the event to be triggered.
• _track_state--State of the tracked object when the event was triggered; valid states are “up” or “down.”

This command is used to help track objects using EEM. Each tracked object is identified by a unique number
that is specified on the tracking command-line interface (CLI). Client processes such as EEM use this number
to track a specific object. The tracking process periodically polls the tracked objects and notes any change of
value. The changes in the tracked object are communicated to interested client processes, either immediately
or after a specified delay. The object values are reported as either up or down.

Cisco IOS Embedded Event Manager Command Reference

183
 event mat through R Commands
event wdsysmon

Examples The following example shows how to specify event criteria based on a tracked object:

event manager applet track-ten

event track 10 state any
action 1.0 track set 10 state up
action 2.0 track read 10

Related Commands Command Description

action track read Specifies the action of reading the state of a tracked object when an EEM applet
is triggered.

action track set Specifies the action of setting the state of a tracked object when an EEM applet is
triggered.

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

show track Displays tracking information.

track stub Creates a stub object to be tracked.

event wdsysmon
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of Cisco
IOS Software Modularity watchdog system monitor (WDSysMon) counters crossing a threshold, use the
event wdsysmoncommand in applet configuration mode. To remove the event criteria, use the no form of
this command.

event wdsysmon sub1 subevent1 [timewin timewin-value] [sub12-op {and | or | andnot} sub2
subevent2] [node node-name]
no event wdsysmon sub1 subevent1 [timewin timewin-value] [sub12-op {and | or | andnot} sub2
subevent2] [node node-name]

Subevent Syntax (for the subevent1 and subevent2 Arguments)

cpu-proc procname process-name op operator val value [period period-value]
cpu-tot op operator val value [period period-value]
deadlock procname process-name
dispatch-mgr procname process-name op operator val value [period period-value]
mem-proc procname process-name op operator val value [is-percent {true | false}] [period
period-value]
mem-tot-avail op operator val value [is-percent {true | false}] [period period-value]
mem-tot-used op operator val value [is-percent {true | false}] [period period-value]

Syntax Description sub1 Specifies the first subevent.

subevent1 First subevent. Use one of the seven forms of syntax shown above under the Subevent
Syntax heading.

Cisco IOS Embedded Event Manager Command Reference

184
event mat through R Commands
event wdsysmon

timewin (Optional) Specifies the time window within which all the subevents must occur for an
event to be generated.

timewin-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in
the format 0.mmm.

sub12-op (Optional) Indicates the combination operator for comparison between subevent 1 and
subevent 2.

and (Optional) Specifies that the results of both subevent 1 and subevent 2 must cross the
specified thresholds.

or (Optional) Specifies that the results of either subevent 1 or subevent 2 must cross the
specified thresholds.

andnot (Optional) Specifies that the results from subevent 1 must cross the specified threshold
and the results from subevent 2 must not cross the specified threshold.

sub2 (Optional) Specifies the second subevent.

subevent2 (Optional) Second subevent. Use one of the seven forms of syntax shown above under
the Subevent Syntax heading.

node (Optional) Specifies the node.

node-name (Optional) Node name.

Subevent Syntax

cpu-proc Specifies the use of a sample collection of CPU process statistics.

cpu-tot Specifies the use of a sample collection of CPU total statistics.

deadlock Specifies the use of a sample collection of deadlock statistics.

dispatch-mgr Specifies the use of a sample collection of dispatch manager statistics.

mem-proc Specifies the use of a sample collection of process memory statistics.

mem-tot-avail Specifies the use of a sample collection of total available memory statistics.

mem-tot-used Specifies the use of a sample collection of total used memory statistics.

procname Specifies a Cisco IOS Software Modularity process name.

process-name Name of the Software Modularity process to be monitored. If the process name contains
embedded blanks, enclose it in double quotation marks.

op Compares the collected CPU, deadlock, dispatch manager, or memory statistics sample
with the value specified in the value argument. If there is a match, the subevent is
triggered.

Cisco IOS Embedded Event Manager Command Reference

185
 event mat through R Commands
event wdsysmon

operator Two-character string. The operator argument takes one of the following values:
• gt --Greater than.
• ge --Greater than or equal to.
• eq --Equal to.
• ne --Not equal to.
• lt --Less than.
• le --Less than or equal to.

val Specifies the value with which the collected CPU, deadlock, dispatch manager, or
memory statistics sample is compared to decide if the subevent should be raised.

value Number in the range from 1 to 4294967295.

period (Optional) Specifies the elapsed time period for the collection samples to be averaged.

period-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If only milliseconds are used, the format is 0.mmm. If
the time period is 0, the most recent sample is used.

is-percent (Optional) Indicates whether the value argument is a percentage.

true (Optional) Specifies that the value argument is a percentage.

false (Optional) Specifies that the value argument is not a percentage.

Command Default No EEM events are triggered on the basis of Cisco IOS Software Modularity WDSysMon counters.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.2(18)SXF4 This command was introduced.

Usage Guidelines An EEM event is triggered when one of the Cisco IOS Software Modularity WDSysMon counters crosses a
defined threshold. Depending on the operator, the threshold may be crossed when the value is greater than
the threshold or when the value is less than the threshold.

Examples The following example shows how to configure a Cisco IOS Software Modularity policy to trigger
an applet when the total amount of memory used by the process named “tcp.proc” has increased by
more than 50 percent over the sample period of 60 seconds:

Router(config)# event manager applet WD_Sample

Router(config-applet)# event wdsysmon sub1 mem-proc procname “tcp.proc” op gt val 50
is-percent true period 60
Router(config-applet)# action 1 syslog msg “WD_Sample Policy Triggered”

Cisco IOS Embedded Event Manager Command Reference

186
 event mat through R Commands
event wdsysmon

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

Cisco IOS Embedded Event Manager Command Reference

187
 event mat through R Commands
event wdsysmon

Cisco IOS Embedded Event Manager Command Reference

188
S through Z Commands
• S through Z Commands, on page 190

Cisco IOS Embedded Event Manager Command Reference

189
 S through Z Commands
S through Z Commands

S through Z Commands
set (EEM)

Note Effective with Cisco IOS Release 12.4(22)T, the set (EEM) command is replaced by the action set(EEM)
command. See the action set (EEM) command for more information.

To set the value of a local Embedded Event Manager (EEM) applet variable, use the setcommand in applet
configuration mode. To remove the value of an EEM applet variable, use the no form of this command.

set label variable-name variable-value

no set label variable-name variable-value

Syntax Description label Unique identifier that can be any string value. Actions are sorted and run in ascending
alphanumeric key sequence using the label as the sort key. If the string contains embedded
blanks, enclose it in double quotation marks.

variable-name The EEM applet variable name. Currently only the _exit_status variable is supported.

variable-value Integer value that represents the variable. For the _exit_status variable, this is the value
that represents the exit status for the applet. Zero represents a successful exit status, and a
nonzero value represents a failed exit status.

Command Default No EEM applet variable values are set.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(22)T This command was replaced by the action set command.

Cisco IOS Embedded Event Manager Command Reference

190
 S through Z Commands
show event manager detector

Usage Guidelines In EEM applet configuration mode, three types of configuration statements are supported. The event commands
are used to specify the event criteria to trigger the applet to run, the action commands are used to specify an
action to perform when the EEM applet is triggered, and the set command is used to set the value of an EEM
applet variable. Currently only the _exit_status variable is supported for the set command.

Examples The following example shows how to set the _exit_status variable to represent a successful status
after an event has occurred three times and an action has been performed:

Router(config)# event manager applet cli-match

Router(config-applet)# event cli pattern {.*interface loopback*} sync yes occurs 3
Router(config-applet)# action 1.0 cli command "no shutdown"
Router(config-applet)# set 1.0 _exit_status 0

Related Commands Command Description

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

show event manager detector

To display information about Embedded Event Manager (EEM) event detectors, use the show event manager
detector command in privileged EXEC mode.

show event manager detector [{all detector-name}] [detailed]

Syntax Description all (Optional) Displays information about all available event detectors.

Cisco IOS Embedded Event Manager Command Reference

191
 S through Z Commands
show event manager detector

detector-name (Optional) Name of event detector. The following values are valid:
• application --Application event detector.
• cli --Command-line interface (CLI) event detector.
• config --Config event detector.
• counter --Counter event detector.
• env --Environmental event detector.
• generic --Generic Online Diagnostic (GOLD) event detector.
• identity --Identity event detector.
• interface --Interface event detector.
• ioswdsysmon --Watchdog system monitor event detector.
• ipsla --IPSLA event detector.
• neighbor-discovery --Neighbor Discovery event detector.
• nf -NetFlow event detector-.
• nhrp -- Next Hop Resolution Protocol (NHRP) event detector.
• none --No event detector.
• oir --Online insertion and removal (OIR) event detector.
• resource --Resource event detector.
• rf --Redundancy Framework (RF) event detector.
• routing --Routing event detector.
• rpc --Remote Procedure Call (RPC) event detector.
• snmp --Simple Network Management Protocol (SNMP) event detector.
• snmp-notification --SNMP notification event detector.
• syslog --Syslog event detector.
• test --Test event detector.
• times --Timer event detector.
• track --Track event detector.

detailed (Optional) Displays detailed information about a specified event detector.

Command Modes
Privileged EXEC (#)

Cisco IOS Embedded Event Manager Command Reference

192
 S through Z Commands
show event manager detector

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

12.2(54)SG This command was integrated into Cisco IOS Release 12.2(54)SG.

Usage Guidelines Use the show event manager detector command to display information about EEM event detectors. The all
keyword displays information about all event detectors. The detailed keyword displays detailed information,
including:
• The event registration syntax for the Tool Command Language (Tcl) policies.
• The available array variables for the Tcl policies after event_reqinfo() is called.
• The event registration syntax for applet policies.
• The built-in variables available when an applet policy is triggered by this event detector.

Examples The following is sample output from the show event manager detector command specifying the
counter value:

Router# show event manager detector counter

No. Name Version Node Type
1 counter 01.00 node5/1 RP
Router# show event manager detector counter detailed
No. Name Version Node Type
1 counter 01.00 node5/1 RP
Tcl Configuration Syntax:
::cisco::eem::event_register_counter
[tag <tag-val>]
name <counter-name>
entry_val <entry-val>
entry_op {gt | ge | eq | ne | lt | le}
exit_val <exit-val>
exit_op {gt | ge | eq | ne | lt | le}
[queue_priority {normal | low | high | last}]
[maxrun <sec.msec>] [nice {0 | 1}]
Tcl event_reqinfo Array Names:
event_id
event_type
event_type_string
event_pub_time
event_pub_sec
event_pub_msec
event_severity
name
value

Applet Configuration Syntax:

[ no ] event [tag <tag-val>] counter
name <counter-name>
entry-val <entry-val>
entry-op {gt | ge | eq | ne | lt | le}
exit-val <exit-val>
exit-op {gt | ge | eq | ne | lt | le}
[maxrun <sec.msec>]

Cisco IOS Embedded Event Manager Command Reference

193
 S through Z Commands
show event manager detector

Applet Built-in Environment Variables:

$_event_id
$_event_type
$_event_type_string
$_event_pub_time
$_event_pub_sec
$_event_pub_msec
$_event_severity
$_counter_name
$_counter_value

The following is sample output from the show event manager detector command specifying the
identity value and details:
Device#show event manager detector identity
No. Name Version Node Type
1 identity 01.00 node0/0 RP
Device#show event manager detector identity detailed
No. Name Version Node Type
1 identity 01.00 node0/0 RP

Tcl Configuration Syntax:

::cisco::eem::event_register_identity
[tag <tag-val>]
interface <interface-name>
[authc {success | fail | all}]
[authz {success | fail | all}]
[authz-complete]
[aaa-attribute <attribute-name>]
[mac-address <mac-address>]
[queue_priority {normal | low | high | last}]
[maxrun <sec.msec>]
[ratelimit <sec.msec>]
[nice {0 | 1}]

Tcl event_reqinfo Array Names:

event_id
job_id
event_type
event_type_string
event_pub_time
event_pub_sec
event_pub_msec
event_trigger_num
event_severity
stage
status
interface
mac
<attribute>

Applet Configuration Syntax:

[ no ] event [tag <tag-val>] identity
interface {<interface> | regexp <interface-pattern>}
[authc {success | fail | all}]
[authz {success | fail | all}]
[authz-complete]
[aaa-attribute <attribute-name>]
[mac-address <mac-address>]
[maxrun <sec.msec>]
[ratelimit <sec.msec>]

Applet Built-in Environment Variables:

$_event_id

Cisco IOS Embedded Event Manager Command Reference

194
 S through Z Commands
show event manager directory user

$_job_id
$_event_type
$_event_type_string
$_event_pub_time
$_event_pub_sec
$_event_pub_msec
$_event_severity
$_identity_stage
$_identity_status
$_identity_interface
$_identity_mac
$_identity_<attribute>

The table below describes the significant fields shown in the display.

Table 21: show event manager detector Field Descriptions

Field Description

No. The number assigned to the event detector.

Name Name of the event detector.

Version Version number.

Node Node name.

Type Where the event detector resides.

show event manager directory user

To display the directory to use for storing user library files or user-defined Embedded Event Manager (EEM)
policies, use the show event manager directory user command in privileged EXEC mode.

show event manager directory user [{library | policy}]

Syntax Description library (Optional) User library files.

policy (Optional) User-defined EEM policies.

Command Default The directories for both user library and user policy files are displayed.

Command Modes
Privileged EXEC

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

Cisco IOS Embedded Event Manager Command Reference

195
 S through Z Commands
show event manager environment

Release Modification

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines Use the event manager directory user command to specify the directory to use for storing user library or
user policy files.

Examples The following example shows the /usr/fm_policies folder on disk 0 as the directory to use for storing
EEM user library files:

Router# show event manager directory user library

disk0:/usr/fm_policies

Related Commands Command Description

event manager directory user Specifies a directory to use for storing user library files or user-defined
EEM policies.

show event manager environment

To display the name and value of Embedded Event Manager (EEM) environment variables, use the show
event manager environment command in privileged EXEC mode.

show event manager environment [{allvariable-name}]

Syntax Description all (Optional) Displays information for all environment variables. This is the default.

variable-name (Optional) Displays information about the specified environment variable.

Command Default If no argument or keyword is specified, information for all environment variables is displayed.

Command Modes
Privileged EXEC

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

Cisco IOS Embedded Event Manager Command Reference

196
 S through Z Commands
show event manager history events

Release Modification

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Examples The following is sample output from the show event manager environmentcommand:

Router# show event manager environment

No. Name Value
1 _cron_entry 0-59/1 0-23/1 * * 0-7
2 _show_cmd show version
3 _syslog_pattern .*UPDOWN.*Ethernet1/0.*
4 _config_cmd1 interface Ethernet1/0
5 _config_cmd2 no shutdown

The table below describes the significant fields shown in the display.

Table 22: show event manager environment Field Descriptions

Field Description

No. The index number assigned to the EEM environment variable.

Name The name given to the EEM environment variable when it was created.

Value The text content defined for the EEM environment variable when it was created.

Related Commands Command Description

event manager environment Sets an EEM environment variable.

show event manager history events

To display the Embedded Event Manager (EEM) events that have been triggered, use the show event manager
history events command in privileged EXEC mode.

show event manager history events [detailed] [maximum number]

Syntax Description detailed (Optional) Displays detailed information about each EEM event.

maximum (Optional) Specifies the maximum number of events to display.

number (Optional) Number in the range from 1 to 50. The default is 50.

Command Modes
Privileged EXEC (#)

Cisco IOS Embedded Event Manager Command Reference

197
 S through Z Commands
show event manager history events

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The output was modified to include the Job ID and Status fields.

Usage Guidelines Use the show event manager history events command to track information about the EEM events that have
been triggered.

Examples The following is sample output from the show event manager history eventscommand showing
that two types of events, Simple Network Management Protocol (SNMP) and application, have been
triggered.

Router# show event manager history events

No. Time of Event Event Type Name
1 Fri Aug13 21:42:57 2004 snmp applet: SAAping1
2 Fri Aug13 22:20:29 2004 snmp applet: SAAping1
3 Wed Aug18 21:54:48 2004 snmp applet: SAAping1
4 Wed Aug18 22:06:38 2004 snmp applet: SAAping1
5 Wed Aug18 22:30:58 2004 snmp applet: SAAping1
6 Wed Aug18 22:34:58 2004 snmp applet: SAAping1
7 Wed Aug18 22:51:18 2004 snmp applet: SAAping1
8 Wed Aug18 22:51:18 2004 application applet: CustApp1

The following is sample output from the show event manager history eventscommand that includes
the Job ID and Status fields:

Router# show event manager history events

No. Job ID Status Time of Event Event Type Name
1 1 success Thu Sep 7 02:54:04 2006 syslog applet: two
2 2 success Thu Sep 7 02:54:04 2006 syslog applet: three
3 3 success Thu Sep 7 02:54:04 2006 syslog applet: four
4 4 abort Thu Sep 7 02:54:04 2006 syslog applet: five
5 5 abort Thu Sep 7 02:54:04 2006 syslog applet: six
6 6 abort Thu Sep 7 02:54:04 2006 syslog applet: seven
7 7 abort Thu Sep 7 02:54:04 2006 syslog applet: eight
8 8 cleared Thu Sep 7 02:54:04 2006 syslog applet: nine
9 9 cleared Thu Sep 7 02:54:04 2006 syslog applet: ten
10 10 cleared Thu Sep 7 02:54:04 2006 syslog applet: eleven

The following is sample output from the show event manager history eventscommand using the
detailed keyword:

Cisco IOS Embedded Event Manager Command Reference

198
 S through Z Commands
show event manager history events

Router# show event manager history events detailed

No. Job ID Status Time of Event Event Type Name
1 1 success Thu Sep 7 02:54:04 2006 syslog applet: two
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
2 2 success Thu Sep 7 02:54:04 2006 syslog applet: three
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
3 3 success Thu Sep 7 02:54:04 2006 syslog applet: four
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
4 4 abort Thu Sep 7 02:54:04 2006 syslog applet: five
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
5 5 abort Thu Sep 7 02:54:04 2006 syslog applet: six
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
6 6 abort Thu Sep 7 02:54:04 2006 syslog applet: seven
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
7 7 cleared Thu Sep 7 02:54:04 2006 syslog applet: eight
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
8 8 cleared Thu Sep 7 02:54:04 2006 syslog applet: nine
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
9 9 cleared Thu Sep 7 02:54:04 2006 syslog applet: ten
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}
10 10 success Thu Sep 7 02:54:04 2006 syslog applet: eleven
msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}

The table below describes the significant fields shown in the displays.

Table 23: show event manager history events Field Descriptions

Field Description

No. Event number.

Job ID Unique internal EEM scheduler job identification number.

Status Policy completion status for the policy scheduled for this event. There are three possible
status values:
• Success--Indicates that the policy for this event completed normally.
• Abort--Indicates that the policy for this event terminated abnormally.
• Cleared--Indicates that the policy for this event was removed from execution using the
event manager scheduler clear command.

Time of Event Day, date, and time when the event was triggered.

Event Type Type of event.

Name Name of the policy that was triggered.

Related Commands Command Description

event manager history size Modifies the size of the EEM history tables.

event manager scheduler clear Clears EEM policies that are executing or pending execution.

Cisco IOS Embedded Event Manager Command Reference

199
 S through Z Commands
show event manager history traps

show event manager history traps

To display the Embedded Event Manager (EEM) Simple Network Management Protocol (SNMP) traps that
have been sent, use the show event manager history traps command in privileged EXEC mode.

show event manager history traps [{server | policy}]

Syntax Description server (Optional) Displays SNMP traps that were triggered from the EEM server.

policy (Optional) Displays SNMP traps that were triggered from within an EEM policy.

Command Modes
Privileged EXEC

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines Use the show event manager history traps command to identify whether the SNMP traps were implemented
from the EEM server or from an EEM policy.

Examples The following is sample output from the show event manager history trapscommand:

Router# show event manager history traps policy

No. Time Trap Type Name
1 Wed Aug18 22:30:58 2004 policy EEM Policy Director
2 Wed Aug18 22:34:58 2004 policy EEM Policy Director
3 Wed Aug18 22:51:18 2004 policy EEM Policy Director

The table below describes the significant fields shown in the display.

Table 24: show event manager history traps Field Descriptions

Field Description

No. Trap number.

Time Date and time when the SNMP trap was implemented.

Cisco IOS Embedded Event Manager Command Reference

200
 S through Z Commands
show event manager metric processes

Field Description

Trap Type Type of SNMP trap.

Name Name of the SNMP trap that was implemented.

Related Commands Command Description

event manager history size Modifies the size of the EEM history tables.

show event manager metric processes

To display Embedded Event Manager (EEM) reliability metric data for Cisco IOS Software Modularity
processes, use the show event manager metric processescommand in privileged EXEC mode.

show event manager metric processes {allprocess-name}

Syntax Description all Displays the process metric data for all Cisco IOS Software Modularity processes.

process-name Specific process name.

Command Modes
Privileged EXEC

Command History Release Modification

12.2(18)SXF4 This command was introduced.

Usage Guidelines Use this command to display the reliability metric data for Cisco IOS Software Modularity processes. The
system keeps a record of when processes start and end, and this data is used as the basis for reliability analysis.
The information provided by this command allows you to get availability information for a process or group
of processes. A process is considered available when it is running.

Examples The following is partial sample output from the show event manager metric processescommand.
In this partial example, the first and last entries showing the metric data for the processes on all the
cards inserted in the system are displayed.

Router# show event manager metric processes all

=====================================
node name: node0
process name: devc-pty, instance: 1
sub_system: 0, version: 00.00.0000
--------------------------------
last event type: process start
recent start time: Fri Oct10 20:34:40 2003
recent normal end time: n/a
recent abnormal end time: n/a
number of times started: 1
number of times ended normally: 0

Cisco IOS Embedded Event Manager Command Reference

201
 S through Z Commands
show event manager metric processes

number of times ended abnormally: 0

most recent 10 process start times:
--------------------------
Fri Oct10 20:34:40 2003
--------------------------
most recent 10 process end times and types:
cumulative process available time: 6 hours 30 minutes 7 seconds 378 milliseconds
cumulative process unavailable time: 0 hours 0 minutes 0 seconds 0 milliseconds
process availability: 0.100000000
number of abnormal ends within the past 60 minutes (since reload): 0
number of abnormal ends within the past 24 hours (since reload): 0
number of abnormal ends within the past 30 days (since reload): 0
.
.
.
=====================================
node name: node0
process name: cdp2.iosproc, instance: 1
sub_system: 0, version: 00.00.0000
--------------------------------
last event type: process start
recent start time: Fri Oct10 20:35:02 2003
recent normal end time: n/a
recent abnormal end time: n/a
number of times started: 1
number of times ended normally: 0
number of times ended abnormally: 0
most recent 10 process start times:
--------------------------
Fri Oct10 20:35:02 2003
--------------------------
most recent 10 process end times and types:

cumulative process available time: 6 hours 29 minutes 45 seconds 506 milliseconds

cumulative process unavailable time: 0 hours 0 minutes 0 seconds 0 milliseconds
process availability: 0.100000000
number of abnormal ends within the past 60 minutes (since reload): 0
number of abnormal ends within the past 24 hours (since reload): 0
number of abnormal ends within the past 30 days (since reload): 0

The table below describes the significant fields shown in the display.

Table 25: show event manager metric processes Field Descriptions

Field Description

node name Node name.

process name Software Modularity process name.

instance Instance number of the Software Modularity process.

sub_system Subsystem number.

version Version number.

Cisco IOS Embedded Event Manager Command Reference

202
 S through Z Commands
show event manager policy active

show event manager policy active

To display Embedded Event Manager (EEM) policies that are executing, use the show event manager policy
active command in privileged EXEC mode.

show event manager policy active [{queue-type {applet | call-home | axp | script} | class class-options
| detailed}]

Syntax Description queue-type (Optional) Specifies the queue type of the EEM policy.

applet (Optional) Specifies EEM applet policy.

call-home (Optional) Specifies EEM Call-Home policy.

axp (Optional) Specifies EEM axp policy.

script (Optional) Specifies EEM script policy.

class (Optional) Specifies EEM class policy.

class-options Specifies the EEM class policy. You can specify either one or all of the following:
• class-letter-- The class letter assigned for the EEM policy. Letters range from A to Z.
Multiple instances of class letter can be specified.
• default --Specifies policies registered with default class.
• range class-letter-range-- Specifies the EEM policy class in a range. Multiple instances
of range class-letter-range can be specified. The letters used in class-letter-range must
be in uppercase.

detailed (Optional) Specifies the detailed content of the EEM policies.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the show event manager policy active command to display the running policies.

Examples The following is sample output from the show event manager policy activecommand that includes
the priority, scheduler node, and event type fields:

Router# show event manager policy active

no. job id p s status time of event event type name
1 1 N A wait Wed Oct8 21:45:10 2008 syslog continue.tcl
2 12609 N A running Mon Oct29 20:49:42 2007 timer watchdog loop.tcl

Cisco IOS Embedded Event Manager Command Reference

203
 S through Z Commands
show event manager policy active

The table below describes the significant fields shown in the displays.

Table 26: show event manager policy active Field Descriptions

Field Description

no. Index number automatically assigned to the policy.

job id Unique internal EEM scheduler job identification number.

p Priority of the policy. There are four priorities:

• L--Indicates that the policy is of low priority.
• H--Indicates that the policy is of high priority.
• N--Indicates that the policy is of normal priority.
• Z--Indicates that the policy is of least priority.

s Scheduler node of the policy. There are two nodes:

• A--Indicates that the scheduler node of this policy is active.
• S--Indicates that the scheduler node of this policy is standby.

status Scheduling status for the policy. There are six possible status values:
• pend--Indicates that the policy is awaiting execution.
• runn--Indicates that the policy is executing.
• exec--Indicates that the policy has completed executing and is awaiting scheduler cleanup
tasks.
• hold--Indicates that the policy is being held.
• wait--Indicates that the policy is waiting for a new event.
• continue--Indicates that the policy receives a new event and is ready to run.

time of event Date and time when the policy was queued for execution in the EEM server.

event type Type of event.

name Name of the EEM policy file.

Related Commands Command Description

show event manager Shows the event manager details of an EEM policy.

Cisco IOS Embedded Event Manager Command Reference

204
 S through Z Commands
show event manager policy available

show event manager policy available

To display Embedded Event Manager (EEM) policies that are available to be registered, use the show event
manager policy available command in privileged EXEC mode.

show event manager policy available [{description [policy-name] | [detailed policy-filename]

[{system | user}]}]

Syntax Description description (Optional) Specifies a brief description of the available policy.

policy-name (Optional) Name of the policy.

detailed (Optional) Displays the actual sample policy for the specified policy-filename.

policy-filename (Optional) Name of sample policy to be displayed.

system (Optional) Displays all available system policies.

user (Optional) Displays all available user policies.

Command Default If no keyword is specified, information for all available system and user policies is displayed.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T The user keyword was added, and this command was integrated into Cisco IOS Release
12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 The detailed keyword and the policy-filename argument were added, and this command was
integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images
only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The output was modified to display bytecode scripts with a file extension of .tbc.

15.0(1)M The command was modified. The description keyword and policy-name argument were
added.

Usage Guidelines This command is useful if you forget the exact name of a policy required for the event manager policy
command.

Cisco IOS Embedded Event Manager Command Reference

205
 S through Z Commands
show event manager policy available

The detailed keyword displays the actual specified sample policy. Use description policy-name to describe
a policy. If policy-name is not specified, the output of show command displays the description of all the
available policies.
In Cisco IOS Release 12.4(20)T, EEM 2.4 introduced bytecode support to allow storage of Tcl scripts in
bytecode format, and the output of this command was modified to display files with a .tbc extension as well
as the usual .tcl extension for Tcl scripts.

Examples The following is sample output from the show event manager policy availablecommand:

Router# show event manager policy available

No. Type Time Created Name
1 system Tue Sep 12 09:41:32 2002 sl_intf_down.tcl
2 system Tue Sep 12 09:41:32 2002 tm_cli_cmd.tcl

The table below describes the fields shown in the display.

Table 27: show event manager policy available Field Descriptions

Field Description

No. Index number automatically assigned to the policy.

Type Indicates whether the policy is a system policy.

Time Created Time stamp indicating the date and time when the policy file was created.

Name Name of the EEM policy file.

The following is sample output from the show event manager policy availablecommand with the
detailed keyword and a policy name specified:

Router# show event manager policy available detailed tm_cli_cmd.tcl

::cisco::eem::event_register_timer cron name crontimer2 cron_entry $_cron_entry maxrun 240
#------------------------------------------------------------------
# EEM policy that will periodically execute a cli command and email the
# results to a user.
#
# July 2005, Cisco EEM team
#
# Copyright (c) 2005 by cisco Systems, Inc.
# All rights reserved.
#------------------------------------------------------------------
### The following EEM environment variables are used:
###
### _cron_entry (mandatory) - A CRON specification that determines
### when the policy will run. See the
### IOS Embedded Event Manager
### documentation for more information
### on how to specify a cron entry.
### Example: _cron_entry 0-59/1 0-23/1 * * 0-7
###
### _email_server (mandatory) - A Simple Mail Transfer Protocol (SMTP)
### mail server used to send e-mail.
### Example: _email_server mailserver.customer.com
###

Cisco IOS Embedded Event Manager Command Reference

206
 S through Z Commands
show event manager policy pending

The following is sample output from the show event manager policy availablecommand showing
a Tcl script with a .tcl filename extension and a bytecode script with a filename extension of .tbc.
This example is for a Cisco IOS Release 12.4(20)T or later image.

Router# show event manager policy available

No. Type Time Created Name
1 system Tue Jun 10 09:41:32 2008 sl_intf_down.tcl
2 system Tue Jun 10 09:41:32 2008 tm_cli_cmd.tbc

Related Commands Command Description

event manager policy Registers an EEM policy with the EEM.

show event manager policy pending

To display Embedded Event Manager (EEM) policies that are pending for execution, use the show event
manager policy pending command in privileged EXEC mode.

show event manager policy pending [{queue-type {applet | call-home | axp | script} | class
class-options | detailed}]

Syntax Description queue-type (Optional) Specifies the queue type of the EEM policy.

applet (Optional) Specifies EEM applet policy.

call-home (Optional) Specifies EEM Call-Home policy.

axp (Optional) Specifies EEM axp policy.

script (Optional) Specifies EEM script policy.

class (Optional) Specifies EEM class policy.

class-options (Optional) Specifies the EEM policy class. You can specify either one or all of the following:
• class-letter-- The class letter assigned for the EEM policy. Letters range from A to Z.
Multiple instances of class letter can be specified.
• default --Specifies policies registered with default class.
• range class-letter-range-- Specifies the EEM policy class in a range. Multiple instances
of range class-letter-range can be specified. The letters used in class-letter-range must
be in uppercase.

detailed (Optional) Specifies the detailed content of the EEM policies.

Command Modes
Privileged EXEC (#)

Cisco IOS Embedded Event Manager Command Reference

207
 S through Z Commands
show event manager policy pending

Command History Release Modification

12.2(25)S This command was introduced.

12.3(14)T This command was integrated into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

12.4(20)T The output was modified to include the Job ID and Status fields.

12.4(22)T This command is supported with new options to qualify the policy queues reported in the
output display and provides detailed policy information.

Usage Guidelines Pending policies are policies that are pending execution in the EEM server execution queue. When an event
is triggered, the policy that is registered to handle the event is queued for execution in the EEM server. Use
the show event manager policy pending command to display the policies in this queue and to view the policy
details.

Examples The following is sample output from the show event manager policy pendingcommand:

Router# show event manager policy pending

no. job id p s status time of event event type name
1 12851 N A pend Mon Oct29 20:51:18 2007 timer watchdog loop.tcl
2 12868 N A pend Mon Oct29 20:51:24 2007 timer watchdog loop.tcl
3 12873 N A pend Mon Oct29 20:51:27 2007 timer watchdog loop.tcl
4 12907 N A pend Mon Oct29 20:51:41 2007 timer watchdog loop.tcl
5 13100 N A pend Mon Oct29 20:52:55 2007 timer watchdog loop.tcl

The table below describes the significant fields shown in the displays.

Table 28: show event manager policy pending Field Descriptions

Field Description

no. Index number automatically assigned to the policy.

job id Unique internal EEM scheduler job identification number.

Cisco IOS Embedded Event Manager Command Reference

208
 S through Z Commands
show event manager policy registered

Field Description

p Priority of the policy. There are four priorities:

• L--Indicates that the policy is of low priority.
• H--Indicates that the policy is of high priority.
• N--Indicates that the policy is of normal priority.
• Z--Indicates that the policy is of least priority.

s Scheduler node of the policy. There are two nodes:

• A--Indicates that the scheduler node of this policy is active.
• S--Indicates that the scheduler node of this policy is standby.

status Scheduling status for the policy. There are six possible status values:
• pend--Indicates that the policy is awaiting execution.
• runn--Indicates that the policy is executing.
• exec--Indicates that the policy has completed executing and is awaiting scheduler cleanup
tasks.
• hold--Indicates that the policy is being held.
• wait--Indicates that the policy is waiting for a new event.
• continue--Indicates that the policy receives a new event and is ready to run.

time of event Date and time when the policy was queued for execution in the EEM server.

event type Type of event.

name Name of the EEM policy file.

Related Commands Command Description

show event manager Shows the event manager details of an EEM policy.

show event manager policy registered

To display Embedded Event Manager (EEM) policies that are already registered, use the show event manager
policy registered command in privileged EXEC mode.

show event manager policy registered [{description [policy-name] | detailed policy-filename

[{system | user}] | [event-type event-name] [{system | user}] [{time-ordered | name-ordered}]}]

Syntax Description description (Optional) Displays a brief description about the registered policy.

Cisco IOS Embedded Event Manager Command Reference

209
 S through Z Commands
show event manager policy registered

policy-name (Optional) Policy name for which the description should be displayed. If policy name is
not provided, then description of all registered policies are displayed.

detailed (Optional) Displays the contents of the specified policy.

system (Optional) Displays the registered system policies.

user (Optional) Displays the registered user policies.

policy-filename (Optional) Name of policy whose contents are to be displayed.

event-type (Optional) Displays the registered policies for the event type specified in the
event-nameargument. If the event type is not specified, all registered policies are displayed.

event-name (Optional) Type of event. The following values are valid:

• application --Application event type.
• cli --Command-line interface (CLI) event type.
• config --Configuration change event type.
• counter --Counter event type.
• env --Environmental event type.
• interface --Interface event type.
• ioswdsysmon --Watchdog system monitor event type.
• none --Manually run policy event type.
• oir --OIR event type.
• rf --Redundancy facility event type.
• snmp --Simple Network Management Protocol (SNMP) event type.
• snmp-object --Snmp object event type.
• syslog --Syslog event type.
• test --Test event type.
• timer-absolute --Absolute timer event type.
• timer-countdown --Countdown timer event type.
• timer-cron --Clock daemon (CRON) timer event type.
• timer-watchdog --Watchdog timer event type.

time-ordered (Optional) Displays the policies in the order of the time at which they were registered.
This is the default.

name-ordered (Optional) Displays the policies, in alphabetical order, by policy name.

Cisco IOS Embedded Event Manager Command Reference

210
 S through Z Commands
show event manager policy registered

Command Default If this command is invoked with no optional keywords, it displays all registered EEM system and user policies
for all event types. The policies are displayed according to the time at which they were registered.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.0(26)S This command was introduced.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

12.2(25)S This command was integrated into Cisco IOS Release 12.2(25)S.

12.3(14)T Additional event types and the user keyword were added, and this command was integrated
into Cisco IOS Release 12.3(14)T.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 The detailed keyword and the policy-filename argument were added, and this command was
integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images
only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

15.0(1)M This command was modified. The description keyword and the policy-name argument were
added.

Usage Guidelines The output shows registered policy information in two parts. The first line in each policy description lists the
index number assigned to the policy, the policy type (system), the type of event registered, the time when the
policy was registered, and the name of the policy file. The remaining lines of each policy description display
information about the registered event and how the event is to be handled; the information comes directly
from the Tool Command Language (Tcl) command arguments that make up the policy file. Output of the
show event manager policy registered command is most helpful to persons who are writing and monitoring
EEM policies.
The detailed keyword displays the actual specified sample policy including details about the environment
variables used by the policy and instructions for running the policy.

Examples The following is sample output from the show event manager policy registeredcommand:

Router# show event manager policy registered

No. Class Type Event Type Trap Time Registered Name
1 applet system snmp Off Fri Aug 13 17:42:52 2004 IPSLAping1
oid {1.3.6.1.4.1.9.9.42.1.2.9.1.6.4} get-type exact entry-op eq entry-val {1}
exit-op eq exit-val {2} poll-interval 5.000
action 1.0 syslog priority critical msg Server IPecho Failed: OID=$_snmp_oid_val
action 1.1 snmp-trap strdata EEM detected server reachability failure to 10.1.88.9
action 1.2 publish-event sub-system 88000101 type 1 arg1 10.1.88.9 arg2 IPSLAEcho arg3

Cisco IOS Embedded Event Manager Command Reference

211
 S through Z Commands
show event manager policy registered

fail
action 1.3 counter name _IPSLA1F value 1 op inc

The table below describes the significant fields shown in the display.

Table 29: show event manager policy registered Field Descriptions

Field Description

No. Index number automatically assigned to the policy.

Class Class of policy, either applet or script.

Type Identifies whether the policy is a system policy.

Event Type Type of event.

Trap Identifies whether an SNMP trap is enabled.

Time Registered Time stamp indicating the day, date, and time when the policy file was registered.

Name Name of the EEM policy file.

The following is sample output from the show event manager policy registeredcommand showing
the use of the detailed keyword for the policy named tm_cli_cmd.tcl:

Router# show event manager policy registered detailed tm_cli_cmd.tcl

::cisco::eem::event_register_timer cron name crontimer2 cron_entry $_cron_entry maxrun 240
#------------------------------------------------------------------
# EEM policy that will periodically execute a cli command and email the
# results to a user.
#
# July 2005, Cisco EEM team
#
# Copyright (c) 2005 by cisco Systems, Inc.
# All rights reserved.
#------------------------------------------------------------------
### The following EEM environment variables are used:
###
### _cron_entry (mandatory) - A CRON specification that determines
### when the policy will run. See the
### IOS Embedded Event Manager
### documentation for more information
### on how to specify a cron entry.
### Example: _cron_entry 0-59/1 0-23/1 * * 0-7
###
### _email_server (mandatory) - A Simple Mail Transfer Protocol (SMTP)
### mail server used to send e-mail.
### Example: _email_server mailserver.example.com
###

Related Commands Command Description

event manager policy Registers an EEM policy with the EEM.

Cisco IOS Embedded Event Manager Command Reference

212
 S through Z Commands
show event manager scheduler

show event manager scheduler

To display the schedule activities of the scheduled Embedded Event Manager (EEM) policies, use the show
event manager scheduler command in privileged EXEC mode.

show event manager scheduler thread [queue-type {applet | call-home | axp | script} [detailed]]

Syntax Description thread Specifies the thread for the scheduler.

queue-type (Optional) Specifies the queue type of the EEM policy.

applet (Optional) Specifies EEM applet policy.

call-home (Optional) Specifies EEM Call-Home policy.

axp (Optional) Specifies EEM axp policy.

script (Optional) Specifies EEM script policy.

detailed (Optional) Specifies the detailed content of the EEM policies.

Command Modes
Privileged EXEC (#)

Command History Release Modification

12.4(22)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the show event manager scheduler commandto show the EEM’s scheduler activities. This command
shows all the EEM execution threads from the scheduler perspective and the details of the running policies.
You can specify one or all of the following options: applet, call-home, axp, script, and detailed.

Examples The following is sample output from the show event manager schedulercommand:

Router# show event manager scheduler thread

1 Script threads service class default
total: 1 running: 1 idle: 0
2 Script threads service class range A-D
total: 3 running: 0 idle: 3
3 Applet threads service class default
total: 32 running: 0 idle: 32
4 Applet threads service class W X
total: 5 running: 0 idle: 5
Router# show event manager scheduler script thread detailed
1 Script threads service class default
total: 1 running: 1 idle: 0
1 job id: 1, pid: 215, name: continue.tcl
2 Script threads service class range A-D
total: 3 running: 0 idle: 3
3 Applet threads service class default
total: 32 running: 0 idle: 32

Cisco IOS Embedded Event Manager Command Reference

213
 S through Z Commands
show event manager session cli username

4 Applet threads service class W X

total: 5 running: 0 idle: 5

Related Commands Command Description

show event manager Shows the event manager details of an EEM policy.

show event manager session cli username

To display the username associated with Embedded Event Manager (EEM) policies that use the command-line
interface (CLI) library, use the show event manager session cli username command in privileged EXEC
mode.

show event manager session cli username

Syntax Description This command has no arguments or keywords.

Command Modes
Privileged EXEC

Command History Release Modification

12.3(14)T This command was introduced.

12.2(28)SB This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(18)SXF4 This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software
Modularity images only.

12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(18)SXF5 This command was integrated into Cisco IOS Release 12.2(18)SXF5.

12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific
12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines Use this command to display the username associated with a Tool Command Language (Tcl) EEM policy. If
you are using authentication, authorization, and accounting (AAA) security and implement authorization on
a command basis, you should use the event manager session cli username command to set a username to
be associated with a Tcl session. The username is used when a Tcl policy executes a CLI command. TACACS+
verifies each CLI command using the username associated with the Tcl session that is running the policy.
Commands from Tcl policies are not usually verified because the router must be in privileged EXEC mode
to register the policy.

Examples The following example shows that the username of eemuser is associated with a Tcl session:

Router# show event manager session cli username

Cisco IOS Embedded Event Manager Command Reference

214
 S through Z Commands
show event manager statistics

Related Commands Command Description

event manager session cli username Associates a username with EEM policies that use the CLI library.

show event manager statistics

To track and display statistics including dropped events of Embedded Event Manager (EEM) policies, use
the show event manager statistics command in privileged EXEC mode.

show event manager statistics {detector | policy | server}

Syntax Description detector EEM event detector statistics.

policy EEM policy statistics.

server EEM Server statistics.

Command Default The statistics including dropped events are displayed.

Command Modes
Privileged EXEC

Command History Release Modification

15.2(2)T This command was introduced.

15.1(1)SY This command was integrated into Cisco IOS Release 15.1(1)SY.

Usage Guidelines Use the show event manager statistics command to display statistic including dropped events.

Examples The following example shows the statistics of all the event detectors:

Router# show event manager statistics detector

Triggered Dropped
No. Name Node Type Events Events
-----------------------------------------------------------------
1 application node0/0 RP 0 0
2 rf node0/0 RP 0 0
3 identity node0/0 RP 0 0
4 neighbor-discovery node0/0 RP 0 0
5 routing node0/0 RP 0 0
6 nhrp node0/0 RP 0 0
7 track node0/0 RP 0 0
8 resource node0/0 RP 0 0
9 syslog node0/0 RP 0 0
10 cli node0/0 RP 0 0
11 counter node0/0 RP 0 0
12 interface node0/0 RP 0 0
13 ioswdsysmon node0/0 RP 0 0
14 none node0/0 RP 0 0
15 oir node0/0 RP 0 0
16 snmp node0/0 RP 0 0

Cisco IOS Embedded Event Manager Command Reference

215
 S through Z Commands
show event manager version

17 snmp-object node0/0 RP 0 0
18 ipsla node0/0 RP 0 0
19 snmp-notification node0/0 RP 0 0
20 timer node0/0 RP 0 0
21 test node0/0 RP 0 0
22 config node0/0 RP 0 0
23 env node0/0 RP 0 0
24 nf node0/0 RP 0 0
25 rpc node0/0 RP 0 0

The following example shows the statistics of all the servers:

Router# show event manager statistics server

Triggered Dropped Queue Queue Average

Client Events Events Size Max Run Time
----------------------------------------------------------------------
Call Home 0 0 0 64 0.000
EEM Applets 0 0 0 64 0.000
EEM IOS .sh Scripts 0 0 0 128 0.000
EEM Tcl Scripts 0 0 0 64 0.000

EEM Policy Counters

Name Value
------------------------------------------------------------------
count2 0
counter1 0

EEM Policy Timers

Name Type Time Remaining
------------------------------------------------------------------
EEMinternalname0 watchdog 19.460
crontimer cron N/A

EEM User Context

------------------------------------------------------------------
Key: keyname
Value: <first 1k of context value.>

Related Commands Command Description

event manager applet Registers an event applet with EEM and enters applet configuration mode.

show event manager version

To display the version of Embedded Event Manager (EEM) software running on the device, use the show
event manager versioncommand in privileged EXEC mode.

show event manager version

Syntax Description This command has no arguments or keywords.

Command Modes
Privileged EXEC (#)

Cisco IOS Embedded Event Manager Command Reference

216
 S through Z Commands
show event manager version

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines Use the show event manager version command to display details about the EEM software running on the
device. The following values are listed:
• The version of the EEM software.
• The version of the EEM software components.
• The version of each available EEM event detector.

Examples The following is sample output from the show event manager version command:

Router#show event manager version

Embedded Event Manager Version 2.40
Component Versions:
eem: (v240_throttle)2.21.49
eem-gold: (v240_throttle)1.2.34
eem-call-home: (v240_throttle)2.0.0
Event Detectors:
Name Version Node Type
appl 01.00 node0/0 RP
syslog 01.00 node0/0 RP
track 01.00 node0/0 RP
cli 01.00 node0/0 RP
counter 01.00 node0/0 RP
interface 01.00 node0/0 RP
ioswdsysmon 01.00 node0/0 RP
none 01.00 node0/0 RP
oir 01.00 node0/0 RP
snmp 01.00 node0/0 RP
snmp-notification 01.00 node0/0 RP
timer 01.00 node0/0 RP
test 01.00 node0/0 RP
config 01.00 node0/0 RP
env 01.00 node0/0 RP

The table below describes the significant fields shown in the display.

Table 30: show event manager version Field Descriptions

Field Description

Embedded Event Manager Version 2.40 Version of EEM software.

Component Versions: Software components.

Event Detectors Each available event detector.

Name Name of the event detector.

Version Version number.

Cisco IOS Embedded Event Manager Command Reference

217
 S through Z Commands
track stub-object

Field Description

Node Node name.

Type Where the event detector resides.

appl Application event detector.

syslog Syslog event detector.

track Track event detector.

cli Command-line interface (CLI) event detector.

counter Counter event detector.

interface Interface event detector.

ioswdsysmon Watchdog system monitor event detector.

none No event detector.

oir Online insertion and removal (OIR) event detector.

snmp Simple Network Management Protocol (SNMP) event detector.

snmp-notification SNMP notification event detector.

timer Timer event detector.

test Test event detector.

config Config event detector.

env Environmental event detector.

Related Commands Command Description

show event manager detector Displays information about EEM event detectors.

track stub-object
To create a stub object that can be tracked by Embedded Event Manager (EEM) and to enter tracking
configuration mode, use the track stub-object command in global configuration mode. To remove the stub
object, use the no form of this command.

track object-number stub-object

no track object-number stub-object

Syntax Description object-number Object number that represents the object to be tracked. The range is from 1 to 1000.

Cisco IOS Embedded Event Manager Command Reference

218
 S through Z Commands
track stub-object

Command Default No stub objects are created.

Command Modes
Global configuration (config)

Command History Release Modification

12.4(2)T This command was introduced.

12.2(31)SB3 This command was integrated into Cisco IOS Release 12.2(31)SB3.

12.2(33)SRB This command was integrated into Cisco IOS Release 12.2(33)SRB.

Cisco IOS XE Release 2.1 This command was integrated into Cisco IOS XE Release 2.1.

12.2(33)SXI This command was integrated into Cisco IOS Release 12.2(33)SXI.

15.1(3)T This command was modified. The valid range of the object-number argument
increased to 1000.

15.1(1)S This command was modified. The valid range for the object-number argument
increased to 1000.

Usage Guidelines Use the track stub-object command to create a stub object, which is an object that can be tracked and
manipulated by an external process, EEM. After the stub object is created, the default-state command can
be used to set the default state of the stub object.
EEM is a distributed, scalable, and customized approach to event detection and recovery offered directly in
a Cisco IOS device. EEM offers the ability to monitor events and take informational or corrective action when
the monitored events occur or when a threshold is reached. An EEM policy is an entity that defines an event
and the actions to be taken when that event occurs.
As of Cisco IOS Release 15.1(3)T, a maximum of 1000 objects can be tracked. Although 1000 tracked objects
can be configured, each tracked object uses CPU resources. The amount of available CPU resources on a
router is dependent upon variables such as traffic load and how other protocols are configured and run. The
ability to use 1000 tracked objects is dependent upon the available CPU. Testing should be conducted on site
to ensure that the service works under the specific site traffic conditions.

Examples The following example shows how to create and configure stub object 1 with a default state of up:

Router(config)#
track 1 stub-object
Router(config-track)#
default-state up

Related Commands Command Description

default-state Sets the default state for a stub object.

show track Displays tracking information.

Cisco IOS Embedded Event Manager Command Reference

219
 S through Z Commands
trigger (EEM)

trigger (EEM)
To enter trigger applet configuration mode and specify the multiple event configuration statements for an
Embedded Event Manager (EEM) applet, use the triggercommand in applet configuration mode. To disable
the multiple event configuration statements, use the no form of this command.

trigger [occurs occurs-value] [period period-value] [period-start period-start-value] [delay

delay-value]
no trigger [occurs occurs-value] [period period-value] [period-start period-start-value] [delay
delay-value]

Syntax Description occurs (Optional) Specifies the number of times the total correlation occurs before an EEM
event is raised. When a number is not specified, an EEM event is raised on the first
occurrence.

occurs-value (Optional) Number in the range from 1 to 4294967295.

period (Optional) Specifies the time interval during which the one or more occurrences must
take place. If not specified, the time-period check is not applied.

period-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in
the format 0.mmm.

period-start (Optional) Specifies the start of an event correlation window. If not specified, event
monitoring is enabled after the first CRON period occurs.

period-start-value (Optional) String that specifies the beginning of an event correlation window.

delay (Optional) Specifies the number of seconds after which an event will be raised if all
the conditions are true. If not specified, the event will be raised immediately.

delay-value (Optional) Number that represents seconds and optional milliseconds in the format
ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for
milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in
the format 0.mmm.

Command Default Disabled.

Command Modes
Applet configuration (config-applet)

Command History Release Modification

12.4(20)T This command was introduced.

12.2(33)SRE This command was integrated into Cisco IOS Release 12.2(33)SRE.

Usage Guidelines The trigger command relates multiple event statements using the optional tag keyword with the event-tag
argument specified in each event statement.

Cisco IOS Embedded Event Manager Command Reference

220
 S through Z Commands
trigger (EEM)

Examples The following example shows how to use the trigger command to enter trigger applet configuration
mode and specify multiple event configuration statements for an EEM applet. In this example, the
applet is run when the show bgp all command and any syslog message that contains the string
“COUNT” occurs within a period of 60 seconds.

Router(config)# event manager applet delay_50

Router(config-applet)# event
tag 1.0 cli pattern "show bgp all" sync yes occurs 32 period 60 maxrun 60
Router(config-applet)# event
tag 2.0 syslog pattern "COUNT"
Router(config-applet)# trigger occurs 1 delay 50
Router(config-applet-trigger)# correlate event 1.0 or event 2.0
Router(config-applet-trigger)# attribute tag 1.0 occurs 1
Router(config-applet-trigger)# attribute tag 2.0 occurs 1
Router(config-applet-trigger)# action 1.0 cli command "show memory"
Router(config-applet)# action 2.0 cli command "enable"
Router(config-applet)# action 3.0 cli command "config terminal"
Router(config-applet)# action 4.0 cli command " ip route 192.0.2.0 255.255.255.224 192.0.2.12"
Router(config-applet)# action 91.0 cli command "exit"
Router(config-applet)# action 99.0 cli command "show ip route | incl 192.0.2.5"

Related Commands Command Description

attribute (EEM) Specifies a complex event for an EEM applet.

correlate Builds a single complex event.

event manager applet Registers an event applet with the Embedded Event Manager and enters applet
configuration mode.

Cisco IOS Embedded Event Manager Command Reference

221
 S through Z Commands
trigger (EEM)

Cisco IOS Embedded Event Manager Command Reference

222