6.6 Construct an EEM applet to automate configuration, troubleshooting, or data collection

What this objective tests

This is a construct objective. The exam asks you to build or complete a small EEM applet.

Embedded Event Manager (EEM) runs on the device. It watches for an event. Then it runs actions. No external server is necessary. This makes EEM useful for local reaction, data collection, and guardrails.

Applet anatomy

Every applet has two required parts:

• Event detector: the trigger. One per applet. Examples: syslog pattern, CLI pattern, timer, track state.
• Action: the work. One or more lines. Actions run in numeric order.

event manager applet NAME
 event <detector> <trigger>
 action 1.0 <work>
 action 2.0 <work>

Common event detectors:

Warning: Applets that change configuration can cause loops or outages. Test in a lab first.

Example A: syslog-triggered interface recovery

This applet watches for a link-down message on GigabitEthernet1. It bounces the interface to recover it. Then it logs the result.

event manager applet RECOVER_GI1
 event syslog pattern "LINK-3-UPDOWN.*GigabitEthernet1.*down"
 action 1.0 syslog msg "EEM: Gi1 went down, starting recovery"
 action 2.0 cli command "enable"
 action 3.0 cli command "configure terminal"
 action 4.0 cli command "interface GigabitEthernet1"
 action 5.0 cli command "shutdown"
 action 6.0 cli command "no shutdown"
 action 7.0 cli command "end"
 action 8.0 syslog msg "EEM: Gi1 recovery complete"

Read each action line:

• 1.0 writes a syslog message. This proves the applet fired.
• 2.0 enters privileged mode. CLI actions start in user mode.
• 3.0 enters global configuration mode.
• 4.0 selects the interface.
• 5.0 shuts the interface down.
• 6.0 brings the interface back up. The bounce clears many transient faults.
• 7.0 leaves configuration mode.
• 8.0 writes a closing syslog message.

Warning: The no shutdown at line 6.0 creates a new syslog message. Make sure your pattern does not match the messages your own applet creates. A self-matching applet loops forever.

Example B: CLI event applet for audit logging

This applet fires when an operator runs write memory. It logs who ran the command. The command still runs normally.

event manager applet AUDIT_WRITE_MEMORY
 event cli pattern "write memory" sync no skip no
 action 1.0 syslog msg "EEM: user $_cli_username ran write memory"

Read each line:

• event cli pattern "write memory" matches the typed command.
• sync no means EEM does not wait for the applet. The command runs without approval from the applet.
• skip no means EEM does not skip the command. The command executes normally.
• $_cli_username is an EEM variable. The CLI event detector fills it with the current username.

Change sync yes and the applet must approve the command with an action ... set exit status. That blocks the command until the applet finishes. Use sync no for logging-only applets.

Verification

Check registration first:

show event manager policy registered

Expected output:

No.  Class     Type    Event Type          Trap  Time Registered     Name
1    applet    user    syslog              Off   Mon Jul 20 09:14:03 RECOVER_GI1
    pattern {LINK-3-UPDOWN.*GigabitEthernet1.*down} maxrun 20
2    applet    user    cli                 Off   Mon Jul 20 09:15:41 AUDIT_WRITE_MEMORY
    pattern {write memory} sync no skip no occurs 1

Then prove the applet fired and completed:

Other useful checks:

show running-config | section event manager
show event manager history events
show logging | include EEM

Lab: build and fire the audit applet

Topology: one IOS XE router or switch. No traffic is necessary.

[Console] ---- [R1: IOS XE]

Do these steps:

1. Enter configuration mode: configure terminal.
2. Create the applet AUDIT_WRITE_MEMORY from Example B.
3. Exit configuration mode.
4. Run show event manager policy registered. Confirm the applet appears with event type cli.
5. Run write memory.
6. Run show logging | include EEM. Confirm the message shows your username.
7. Remove the applet: no event manager applet AUDIT_WRITE_MEMORY.

Expected syslog line:

%HA_EM-6-LOG: AUDIT_WRITE_MEMORY: EEM: user admin ran write memory

Repeat the lab with Example A if you can shut down a lab interface safely. The shutdown command generates the LINK-3-UPDOWN message. The applet fires and bounces the interface.

Exam traps

• An applet without an event never fires. The event detector is mandatory.
• Actions run in numeric order. action 1.0 runs before action 2.0.
• CLI actions need enable before privileged commands.
• sync no lets the command run freely. sync yes makes the applet gate the command.
• The syslog pattern must match the real message text. Check the exact mnemonic, such as LINK-3-UPDOWN versus LINEPROTO-5-UPDOWN.
• Do not match a syslog pattern that your own applet generates. That creates a loop.

Pass check

You are ready when you can do these things:

• Name the event detector and the actions in any applet.
• Build a syslog-triggered applet with three or more actions.
• Build a CLI event applet that logs the operator name.
• Explain sync no and skip no in one sentence each.
• Prove an applet works with show event manager policy registered and syslog evidence.

Sources used

• Cisco ENCOR 350-401 v1.2 exam topics: https://learningcontent.cisco.com/documents/marketing/exam-topics/350-401-ENCORE-v1.2.pdf
• Cisco IOS XE EEM CLI applet configuration guide: https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/syst-mgmt/b-system-management/m_eem-policy-cli.html
• Cisco EEM best practices and useful scripts: https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-16/216091-best-practices-and-useful-scripts-for-ee.html