Embedded Event Manager (EEM) – Event Actions- Part IV

Posted by

Before proceeding with EEM Actions, let me explain the EEM environmental variables.

We have already looked at builtin variables. The other type is user-defined.User-defined variable is configured globally and can be called by any EEM applet. In the below config, ENV1 is the variable name and Test is the value assigned to variable.

Router(config)# event manager environment ENV1

Lets continue with Actions now.

1. Add / Subtract / Multiply / Divide

As the name suggests, these actions will perform the mathematic operation on the variables. The action actually do not alter the value if variables but just internally gets stored in environmental Variable “_result”

In the below EEM, I am using two variables X=100 and Y=50. After each action, I am displaying the value if “_result”

Screen Shot 2018-04-12 at 8.41.22 PM.png

2. Append

This action appends the given string value to the current value of a variable.
In the below example, I have set the variables test and test2. And then appended both of them.

In the first event, I am appending the value of test2 variable to test variable.

Screen Shot 2018-04-12 at 8.42.50 PM.png

In the second event, I am appending string “test2” to the variable test.

Screen Shot 2018-04-13 at 7.35.48 AM.png

3. Break/Continue/End/While

  • Break is an action of exiting from loop of events
  • With continue, it will continue executing the events.
  • End action is used to end a conditional block in if/else and while loop.

I am using While loop to demonstrate these actions.Below EEM is used to increment variable Count by 1 and break/continue from while loop.

With break, we see that loop is exited after 1st occurrence only.

Screen Shot 2018-04-13 at 7.36.26 AM.png

With Continue, we see that while loop is executed until the condition is met which is till Count is less than equal to 4.

Screen Shot 2018-04-13 at 7.36.56 AM.png

4. CLI: The cli action will execute the specified command when an event is triggered.

The output of cli can be saved in disk as well.

In the below example, I am performing two CLI actions with saving only one in flash. The output of cli action is temporarily saved in builtin variable “_cli_result”

Screen Shot 2018-04-13 at 7.39.28 AM.png

There are two types of Cisco IOS CLI commands:

  • Normal–Those Cisco IOS CLI commands that produce output followed by a display of the normal router prompt. The action cli command ends when the normal router prompt is received.
  • Solicited–Those Cisco IOS CLI commands that ask one or more questions before the normal router prompt is displayed, such as “confirm,” which has to be completed with a “yes” or a “no”input.

The pattern keyword is optional and is used only when the command string solicits input. It is a regular expression pattern that will match the next solicited prompt.

R1# clear counters
Clear "show interface" counters on all interfaces [confirm]y

*Apr  9 10:59:07.256: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console

Lets add a cli action to clear counters with pattern confirm.

Screen Shot 2018-04-13 at 7.40.48 AM

5. Comment : It helps to add a comment in an applet. It actually does nothing when EEM is run, it is just to add a description in an EEM.

I have added action comment in the same CLI EEM. Once the EEM is run, we dont see the action 2.0 being kicked in anywhere. Comments are used to make it easier for user to see whats happening.

Screen Shot 2018-04-13 at 7.41.29 AM.png

6. Context

  • Retrieve: retrieve the variable(s) identified by a given set of context name keys. Information that is retrieved is automatically deleted from the context database.

The information for the variable specified in the command is retrieved, only if a variable with the same name was saved in the corresponding context save call, using the action context savecommand.

Router(config)# event manager applet one
Router(config-applet)# action 1.0 context retrieve key pki-72a variable var1
  • Save: he command saves variables that match the given pattern with the context name key as identification. Saved information can be retrieved by a different applet using the action context retrieve command.
Router(config)# event manager applet one
Router(config-applet)# action 1.0 context save key pki-72a variable var1

7. Counter : Counter action of sets or modify a named counter. We have already discussed counter action and detector in detector’s section.

8. Increment/Decrement:

This action will increment/decrement the value of a variable. Using the same While loop EEM, below snapshots will demonstrate increment and decrement actions.

Screen Shot 2018-04-13 at 7.42.36 AM.png

9. If/Else/Elseif

This action specifies a condition block to perform specified actions.

Lets write an EEM to get the input from user and add the two integers. Gets action is used to take input from user. We will use a condition to print a specific message.

If the sum is less than or equal to 100, print “The sum is less than equal to 100”. Else print “The sum of X and Y is <>”

Using only If statement. Note the indentation in the EEM which is automatically done by the software.

Screen Shot 2018-04-13 at 7.43.22 AM

Using If with else. Action end is used to come out of conditional block.

Screen Shot 2018-04-13 at 7.44.17 AM.png

Using if/elseif/else blocks:

Screen Shot 2018-04-13 at 7.44.55 AM.png

10. File

Action file is used to read/write/append to a file saved in a disk or server.

In the below example, I am appending every command a user runs to a file CMDHIS saved in flash.

Screen Shot 2018-04-13 at 7.45.34 AM.png

nonewline keyword can be used if you don’t want content to be written in new line.

11. Force-switchover

Action force-switchover is used to forcibly switchover the RSP. Before using it, device should have redundancy RP. If the hardware is not fully redundant, the switchover action will not be performed.

Below EEM is used to switchover the RSP.

Screen Shot 2018-04-13 at 7.46.14 AM.png

Screen Shot 2018-04-13 at 7.46.38 AM.png

Screen Shot 2018-04-13 at 7.47.18 AM.png

12. Foreach

Action foreach command is used to iterate an input string using the delimiter as a tokenizing pattern. The delimiter is a regular expression pattern string. The token found in each iteration is assigned to the given iterator variable. All arithmetic calculations are performed as long integers without any checks for overflow.

Below EEM will ping each ip in the list “ip” configured with “foreach” so the loop will be executed for each element. I am using the same topology as in routing detector.

Screen Shot 2018-04-13 at 7.47.54 AM.png

Let me shut the Lo0 on R5

Screen Shot 2018-04-13 at 7.48.29 AM.png

Screen Shot 2018-04-13 at 7.50.45 AM.png

Now the output of EEM will show that is unreachable.

Screen Shot 2018-04-13 at 7.51.29 AM.png

13. Gets/Puts/Sets

Action gets is used to take a input from user and puts is used to print a message.

Sets will set a value to the variable.

We have already used these actions in multiple examples before.

14. Handle-error

If the handle-error action is “ignore” then any error will be stored in the $_error variable.  This error will be a string value.  A healthy result is always “FH_EOK”.

action 1 handle-error type <exit/ignore/warn>

15. Info

Action info is used to request some system information.

action label info type { cli frequency | cli history | syslog frequency | syslog history | routername | snmp oid oid-value get-type { exact| next } }

Below is the example of action info where I am using Routername and CLI info types.

Screen Shot 2018-04-13 at 7.52.02 AM.png

One more illustration of type interface names:

The action info type interface-names command obtains the current interface names and stores them as a space-separated list in the $_info_interface_names built-in variable.

Below EEM will get the interface names and use it as an input to foreach loop to display the config of each interface.

Screen Shot 2018-04-13 at 7.52.52 AM.png

Screen Shot 2018-04-13 at 7.53.48 AM.png

We can also use info type snmp and below the parameters which can be retrieved

  • Oid
  • Trap
  • Inform
  • Getid
    • Set-type
    • Get-type
Router(config)# event manager applet
Router(config-applet)# action 1.3 info type snmp oid get-type exact community public ipaddr

16. Mail

Action mail is used to send an email to the server.

Action 1.0 mail server $_email_server from $_email_from to $_email_to cc $_email_cc subject <> body  <>

We can predefine the variables like. Email server ip, To, from and cc list like below:

Screen Shot 2018-04-13 at 7.55.18 AM.png

Screen Shot 2018-04-13 at 7.55.38 AM

17. Regexp

Regexp is used to match a regular expression pattern on an input string.

The string-pattern argument is a regular expression. If some part of the string matches the pattern, it returns 1; otherwise it returns 0.


The result of the regular expression pattern matching is stored in this variable.

Common regular expressions:

^  =  Start of string
$  =  End of string
.   =  Any single character
*  =  Zero or more instances
+ =  One or more instance
?  =  Zero or one instance

Screen Shot 2018-04-13 at 7.56.18 AM.png

18. Reload

Action reload, as name depicts will reload the router.

Screen Shot 2018-04-13 at 7.56.51 AM.png

19. String

Action string is used to do actions like compare, trim, word count etc.

Below are the actions which can be done using string:

Screen Shot 2018-04-13 at 7.57.27 AM.png

Lets use trim and length for illustration:

Screen Shot 2018-04-13 at 7.57.59 AM

20. Syslog : This is used to print a syslog message, we have used this in many examples.

21. Track

Action track is used to set or read the track state.

_track_state is the State of the specified tracked object. The text string returned is either up or down. If the state is up, it means that the object exists and is in an up state. If the state is down, it means that the object either does not exist or is in a down state.

Below EEM is reading the status of Track 1.

Screen Shot 2018-04-13 at 7.58.39 AM.png

Lets bring down the track, and we can see that EEM also returned the state to be down.

Screen Shot 2018-04-13 at 7.59.15 AM

22. Policy

Action policy is used to run another policy , it can be either EEM or TCL script.

EEM POLICY is configured to run policy STRING

Screen Shot 2018-04-13 at 7.59.54 AM

23. SNMP

  • Use the action snmp-object-value command to set the object ID and value to be returned for the SNMP get request.
  • Action snmp-trap is used to send a SNMP trap message to server.

The following example shows how to set the object ID and value to be returned by the SNMP get request.

Router(config)# event manager applet action
Router(config-applet)# event snmp-object oid type gauge sync yes
Router(config-applet)# action 1 syslog msg "oid = $_snmp_oid”
Router(config-applet)# action 2 syslog msg "request = $_snmp_request"
Router(config-applet)# action 3 syslog msg "request_type = $_snmp_request_type"
Router(config-applet)# action 4 syslog msg "value = $_snmp_value"
Router(config-applet)# action 5 snmp-object-value gauge 1111 next-oid
Router(config-applet)# action 6 exit 1


EEM Series:

  1. Embedded Event Manager (EEM) – Basic Overview- Part I
  2. Embedded Event Manager (EEM) – Event Detectors- Part II
  3. Embedded Event Manager (EEM) – Event Detectors- Part III
  4. Embedded Event Manager (EEM) – Event Actions- Part IV

For Reference:



Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s