Cisco IOS Software Releases 12.3 T

Table Of Contents

Embedded Event Manager 1.0

Contents

Prerequisites for Embedded Event Manager 1.0

Information About Embedded Event Manager 1.0

Embedded Event Manager 1.0

Event Detectors and Events

Embedded Event Manager Actions

How to Configure Embedded Event Manager 1.0

Defining an Embedded Event Manager Applet

EEM Policies and Applets

Troubleshooting Tips

Displaying Embedded Event Manager Registered Policies

Configuration Examples for Embedded Event Manager 1.0

Embedded Event Manager Applet Configuration: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

action cns-event

action force-switchover

action reload

action syslog

debug event manager

event manager applet

event snmp

event syslog

show event manager policy registered

Embedded Event Manager 1.0

---

Embedded Event Manager 1.0 is a distributed, scalable, and customized approach to event detection and recovery offered directly in a Cisco IOS device.

Release	Modification
12.0(26)S	This feature was introduced.
12.3(4)T	This feature was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE	This feature was introduced into Cisco IOS Release 12.3(2)XE.

Feature History for Embedded Event Manager 1.0

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for Embedded Event Manager 1.0

•Information About Embedded Event Manager 1.0

•How to Configure Embedded Event Manager 1.0

•Configuration Examples for Embedded Event Manager 1.0

•Additional References

•Command Reference

Prerequisites for Embedded Event Manager 1.0

•If the action cns-event command is used, access to a CNS Event gateway must be configured.

•If the action force-switchover command is used, a secondary processor must be configured on the device.

Information About Embedded Event Manager 1.0

To configure Embedded Event Manager 1.0, you should understand the following concepts:

•Embedded Event Manager 1.0

•Event Detectors and Events

•Embedded Event Manager Actions

Embedded Event Manager 1.0

Event tracking and management has traditionally been performed by devices external to the networking device. Embedded Event Manager (EEM) has been designed to offer event management capability directly in Cisco IOS based devices. The on-device, proactive event management capabilities of EEM are useful because not all event management can be done off router because some problems compromise communication between the router and the external network management device. Capturing the state of the router during such situations can be invaluable in taking immediate recovery actions and gathering information to perform root-cause analysis. Network availability is also improved if automatic recovery actions are performed without the need to fully reboot the routing device.

EEM 1.0 is a flexible, policy driven framework that supports in-box monitoring of different components of the system with the help of software agents known as event detectors. Figure 1 shows the relationship between the EEM server, the event publishers (event detectors), and the event subscribers (applets). Event detectors notify the EEM when an event of interest occurs. The EEM applets that are configured using the Cisco IOS command-line interface (CLI) then implement recovery based on the current state of the system and on the actions specified in the applet for the given event.

Figure 1 Embedded Event Manager 1.0

Event Detectors and Events

Events are detected by routines called event detectors. Event detectors are separate systems that provide an interface between the agent being monitored, for example Simple Network Management Protocol (SNMP), and the EEM applets where an action can be triggered. EEM 1.0 includes syslog and SNMP event detectors.

Syslog Event Detector

The syslog event detector allows for screening syslog messages for a regular expression pattern match. The selected messages can be further qualified, requiring that a specific number of occurrences be logged within a specified time. A match on a specified event criteria triggers a configured policy action.

SNMP Event Detector

The SNMP event detector allows a standard SNMP MIB object to be monitored and an event to be generated when the object matches specified values or crosses specified thresholds. The SNMP event detector enables self-health monitoring in a Cisco IOS device and provides proactive notification.

Embedded Event Manager Actions

The CLI-based corrective actions that are taken when event detectors report events enable a powerful on-device event management mechanism. EEM 1.0 supports the following actions:

•Generating prioritized syslog messages.

•Generating a CNS event for upstream processing by Cisco CNS devices.

•Reloading the Cisco IOS software.

•Switching to a secondary processor in a fully redundant hardware configuration.

How to Configure Embedded Event Manager 1.0

This section contains the following tasks:

•Defining an Embedded Event Manager Applet (required)

•Displaying Embedded Event Manager Registered Policies (optional)

Defining an Embedded Event Manager Applet

Perform this task to define an EEM applet using event applet and action applet commands. Only one event applet command—event snmp or event syslog—is allowed in an EEM applet. Multiple action applet commands are permitted. If no event and no action commands are specified, the applet is removed when you exit configuration mode.

EEM Policies and Applets

EEM offers the ability to monitor events and take informational or corrective action when the monitored events occur or reach a threshold. An EEM policy is an entity that defines an event and the actions to be taken when that event occurs. There are two types of EEM policies: an applet or a script. An applet is a simple form of policy that is defined within the CLI configuration.

SUMMARY STEPS

1. enable

2. configure terminal

3. event manager applet applet-name

4. event snmp oid oid-value get-type {exact | next} entry-op operator entry-val entry-value [exit-comb {or | and}] [exit-op operator] [exit-val exit-value] [exit-time exit-time-value] poll-interval poll-int-value

5. action label syslog [priority priority-level] msg msg-text

6. Repeat Step 5 for more action CLI commands as needed.

7. exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	event manager applet applet-name Example: Router(config)# event manager applet memory-fail	Registers the applet with the Embedded Event Manager (EEM) and enters applet configuration mode.
Step 4	event snmp oid oid-value get-type {exact | next} entry-op operator entry-val entry-value [exit-comb {or | and}] [exit-op operator] [exit-val exit-value] [exit-time exit-time-value] poll-interval poll-int-value Example: Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op lt entry-val 5120000 poll-interval 10	Specifies the event criteria for an EEM applet that is run by sampling SNMP object ID values. •An EEM event is triggered when one of the fields specified by an SNMP object ID crosses a defined threshold. •Exit criteria are optional, and if not specified, event monitoring is reenabled immediately.
Step 5	action label syslog [priority priority-level] msg msg-text Example: Router(config-applet)# action 1.0 syslog priority critical msg "Memory exhausted; current available memory is $_snmp_oid_val bytes"	Writes a message to syslog. •The optional priority keyword specifies the priority level of the syslog messages. If selected, the priority-level argument must be defined. •The msg-text argument can be character text or an environment variable, or a combination of the two.
Step 6	Repeat Step 5. Example: Router(config-applet)# action 2.0 force-switchover	Repeat Step 5 to add other action CLI commands to the applet.
Step 7	exit Example: Router(config-applet)# exit	Exits EEM applet configuration mode and returns the router to global configuration mode. •Repeat this step one more time to exit global configuration mode.

Troubleshooting Tips

Use the debug event manager command in privileged EXEC mode to troubleshoot EEM command operations. Use any debugging command with caution as the volume of output generated can slow or stop the router operations. We recommend that this command be used only under the supervision of a Cisco engineer.

Displaying Embedded Event Manager Registered Policies

Perform this optional task to display EEM registered policies.

SUMMARY STEPS

1. enable

2. show event manager policy registered [event-type event-name] [time-ordered | name-ordered]

DETAILED STEPS

---

Step 1 enable

Enables privileged EXEC mode. Enter your password if prompted:

Router> enable

Step 2 show event manager policy registered [event-type event-name] [time-ordered | name-ordered]

Use this command with the time-ordered keyword to display information about currently registered policies sorted by time, for example:

Router# show event manager policy registered time-ordered

No.  Type    Event Type          Time                    Registered Name 

1    applet  snmp                Thu Jan30 05:57:16 2003 memory-fail 

 oid {1.3.6.1.4.1.9.9.48.1.1.1.6.1} get-type exact entry-op lt entry-val {5120000} 
poll-interval 10 

 action 1.0 syslog priority critical msg Memory exhausted; current available memory is 
$_snmp_oid_val bytes 

 action 2.0 force-switchover 

2    applet  syslog              Wed Jul16 00:05:17 2003 intf-down

 pattern {.*UPDOWN.*Ethernet1/0.*}

 action 1.0 cns-event msg Interface state change: $_syslog_msg

Use this command with the name-ordered keyword to display information about currently registered policies sorted by name, for example:

Router# show event manager policy registered name-ordered

No.  Type    Event Type          Time Registered           Name 

1    applet  syslog              Wed Jul16  00:05:17 2003  intf-down

 pattern {.*UPDOWN.*Ethernet1/0.*}

 action 1.0 cns-event msg Interface state change: $_syslog_msg

2    applet  snmp                Thu Jan30 05:57:16 2003   memory-fail 

 oid {1.3.6.1.4.1.9.9.48.1.1.1.6.1} get-type exact entry-op lt entry-val {5120000} 
poll-interval 10 

 action 1.0 syslog priority critical msg Memory exhausted; current available memory is 
$_snmp_oid_val bytes 

 action 2.0 force-switchover

Use this command with the event-type keyword to display information about currently registered policies for the event type specified in the event-name argument, for example:

Router# show event manager policy registered event-type syslog

No.  Type    Event Type          Time Registered           Name 

1    applet  syslog              Wed Jul16  00:05:17 2003  intf-down

 pattern {.*UPDOWN.*Ethernet1/0.*}

 action 1.0 cns-event msg Interface state change: $_syslog_msg

---

Configuration Examples for Embedded Event Manager 1.0

This section contains the following configuration example:

•Embedded Event Manager Applet Configuration: Example

Embedded Event Manager Applet Configuration: Example

The following example shows how to configure an EEM applet that causes a switch to the secondary (redundant) Route Processor (RP) when the primary RP runs low on memory.

Figure 2 Dual RP Topology

The commands used to register the policy are shown below.

event manager applet memory-demo 

 event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op lt entry-val 5120000 
poll-interval 10

 action 1.0 syslog priority critical msg "Memory exhausted; current available memory is 
$_snmp_oid_val bytes"

 action 2.0 force-switchover

The registered applet is displayed using the show event manager policy registered command:

Router# show event manager policy registered

No.  Type    Event Type          Time Registered           Name

1    applet  snmp                Thu Jan30  05:57:16 2003  memory-demo

 oid {1.3.6.1.4.1.9.9.48.1.1.1.6.1} get-type exact entry-op lt entry-val {5120000} 
poll-interval 10

 action 1.0 syslog priority critical msg Memory exhausted; current available memory is 
$_snmp_oid_val bytes

 action 2.0 force-switchover

A memory depletion is forced on the router, and a series of show memory commands are executed to watch the memory deplete:

Router# show memory

                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)

Processor   53585260   212348444   119523060    92825384    92825384    92365916

Fast        53565260      131080       70360       60720       60720       60668

Router# show memory

                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)

Processor   53585260   212364664   164509492    47855172    47855172    47169340

Fast        53565260      131080       70360       60720       60720       60668

Router# show memory

                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)

Processor   53585260   212369492   179488300    32881192    32881192    32127556

Fast        53565260      131080       70360       60720       60720       60668

When the threshold is reached, an EEM event is triggered. The applet named memory-demo runs, causing a syslog message to be written to the console, and a switch is made to the secondary RP. The following messages are logged:

00:08:31: %HA_EM-2-LOG: memory-demo: Memory exhausted; current available memory is 4484196 
bytes

00:08:31: %HA_EM-6-FMS_SWITCH_HARDWARE: fh_io_msg: Policy has requested a hardware 
switchover

Configuration for the Primary RP and Secondary RP

The following is partial output from the show running-config command on both the primary RP and the secondary (redundant) RP:

redundancy

 mode rpr-plus

.

.

.

!

event manager applet memory-demo 

 event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op lt entry-val 5120000 
poll-interval 10

 action 1.0 syslog priority critical msg "Memory exhausted; current available memory is 
$_snmp_oid_val bytes"

 action 2.0 force-switchover

Additional References

The following sections provide references related to Embedded Event Manager 1.0.

Related Documents

Related Topic	Document Title
CNS event agent	CNS Event Agent feature document, Release 12.2(2)T
CNS Configuration Engine	Cisco Intelligence Engine 2100 Configuration Registrar Manual, Release 1.1 or later

Standards

Standards	Title
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.	—

MIBs

MIBs	MIBs Link
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFCs	Title
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.	—

Technical Assistance

Description	Link
Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/public/support/tac/home.shtml

Command Reference

This section documents new commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 T command reference publications.

•action cns-event

•action force-switchover

•action reload

•action syslog

•debug event manager

•event manager applet

•event snmp

•event syslog

•show event manager policy registered

action cns-event

To specify the action of writing a message to the CNS Event Bus when an Embedded Event Manager (EEM) applet is triggered, use the action cns-event command in applet configuration mode. To remove the action of sending a message to the CNS Event Bus, use the no form of this command.

action label cns-event msg msg-text

no action label cns-event msg msg-text

Syntax Description

label

Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric key sequence using the label as the sort key.

msg

Specifies that the message to be sent to the CNS Event Bus. •msg-text—Character text or an environment variable, or a combination of the two. Environment variables are as follows. Environment Variables Available for All Events $_event_type—The event type that triggered the event. $_event_pub_time—The time at which the event type was published. Environment Variables Available for SNMP Events $_snmp_oid—The Simple Network Management Protocol (SNMP) object ID that caused the event to be published. $_snmp_oid_val—The SNMP object ID value when the event was published. Environment Variables Available for Syslog Events $_syslog_msg—The syslog message that caused the event to be published.

Defaults

No messages are sent to the CNS Event Bus.

Command Modes

Applet configuration

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE	This command was integrated into Cisco IOS Release 12.3(2)XE.

Examples

The following example shows how to specify a message to be sent to the CNS Event Bus when the memory-fail applet is triggered.

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op 
lt entry-val 5120000 poll-interval 10

Router(config-applet)# action 1.0 cns-event msg "Memory exhausted; current available 
memory is $_snmp_oid_val bytes"

Related Commands

Command	Description
event manager applet	Registers an event applet with the Embedded Event Manager and enters applet configuration mode.

action force-switchover

To specify the action of switching to a secondary processor in a fully redundant environment when an Embedded Event Manager (EEM) applet is triggered, use the action force-switchover command in applet configuration mode. To remove the action of switching to a secondary processor, use the no form of this command.

action label force-switchover

no action label force-switchover

Syntax Description

label

Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric key sequence using the label as the sort key.

Defaults

A switch to a secondary processor is not made.

Command Modes

Applet configuration

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE	This command was integrated into Cisco IOS Release 12.3(2)XE.

Usage Guidelines

Before using the action force-switchover command, you must install a backup processor in the device. If the hardware is not fully redundant, the switchover action will not be performed.

Examples

The following example shows how to specify a switch to the secondary Route Processor (RP) when the memory-fail applet is triggered.

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op 
lt entry-val 5120000 poll-interval 10

Router(config-applet)# action 2.0 force-switchover

Related Commands

Command	Description
event manager applet	Registers an event applet with the Embedded Event Manager and enters applet configuration mode.

action reload

To specify the action of reloading the Cisco IOS software when an Embedded Event Manager (EEM) applet is triggered, use the action reload command in applet configuration mode. To remove the action of reloading the Cisco IOS software, use the no form of this command.

action label reload

no action label reload

Syntax Description

label

Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric key sequence using the label as the sort key.

Defaults

No reload of the Cisco IOS software is performed.

Command Modes

Applet configuration

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE	This command was integrated into Cisco IOS Release 12.3(2)XE.

Usage Guidelines

Before configuring the action reload command, you should ensure that the device is configured to reboot the software version that you are expecting. Use the show startup-config command and look for any boot system commands.

Examples

The following example shows how to reload the Cisco IOS software when the memory-fail applet is triggered.

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op 
lt entry-val 5120000 poll-interval 10

Router(config-applet)# action 3.0 reload

Related Commands

Command	Description
boot system	Configures the locations from which the router loads software when the router reboots.
event manager applet	Registers an event applet with the Embedded Event Manager and enters applet configuration mode.
show startup-config	Displays the configuration to be run when the router reboots.

action syslog

To specify the action of writing a message to syslog when an Embedded Event Manager (EEM) applet is triggered, use the action syslog command in applet configuration mode. To remove the syslog message event criteria, use the no form of this command.

action label syslog [priority priority-level] msg msg-text

no action label syslog [priority priority-level] msg msg-text

Syntax Description

label	Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric key sequence using the label as the sort key.
priority	(Optional) Specifies the priority level of the syslog messages. If selected, the priority-level argument must be defined. If not specified, all syslog messages are set at the informational priority level. •priority-level—Number or name of the desired priority level at which syslog messages are set. Priority levels are as follows (enter the number or the keyword): –{0 | emergencies}—System is unusable. –{1 | alerts}—Immediate action needed. –{2 | critical}—Critical conditions. –{3 | errors}—Error conditions. –{4 | warnings}—Warning conditions. –{5 | notifications}—Normal but significant conditions. –{6 | informational}—Informational messages. –{7 | debugging}—Debugging messages.
msg	Specifies the message to be logged. •msg-text—Character text or an environment variable, or a combination of the two. Environment variables are as follows. Environment Variables Available for All Events $_event_type—The event type that triggered the event. $_event_pub_time—The time at which the event type was published. Environment Variables Available for SNMP Events $_snmp_oid—The Simple Network Management Protocol (SNMP) object ID that caused the event to be published. $_snmp_oid_val—The SNMP object ID value when the event was published. Environment Variables Available for Syslog Events $_syslog_msg—The syslog message that caused the event to be published.

Defaults

If the priority keyword is not defined, all syslog messages are set at the informational priority level.

Command Modes

Applet configuration

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.

Examples

The following example shows how to specify a message to be sent to syslog when the memory-fail applet is triggered:

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op 
lt entry-val 5120000 poll-interval 10

Router(config-applet)# action 4.0 syslog msg "Memory exhausted; current available memory 
is $_snmp_oid_val bytes"

Related Commands

Command	Description
event manager applet	Registers an event applet with the Embedded Event Manager and enters applet configuration mode.

debug event manager

To turn on the debugging output of Embedded Event Manager (EEM) processes, use the debug event manager command in privileged EXEC mode. To turn off debugging output, use the no form of this command or the undebug command.

debug event manager {all | appletdir | detector snmp | detector syslog | server events | server scheduling}

no debug event manager {all | appletdir | detector snmp | detector syslog | server events | server scheduling}

Syntax Description

all	Displays all debugging messages.
appletdir	Displays debugging messages about the EEM applet directory.
detector snmp	Displays debugging messages about the SNMP event detector.
detector syslog	Displays debugging messages about the syslog event detector.
server events	Displays debugging messages about the EEM server events.
server scheduling	Displays all debugging messages about the EEM server scheduling events.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE	This command was integrated into Cisco IOS Release 12.3(2)XE.

Usage Guidelines

Use the debug event manager command in privileged EXEC mode to troubleshoot EEM command operations. Use any debugging command with caution as the volume of output generated can slow or stop the router operations. We recommend that this command be used only under the supervision of a Cisco engineer.

Examples

The following example turns on debugging messages about EEM server events:

Router# debug event manager server events

server events debugging is on

Router#

00:32:44: fd_pulse_hndlr: received a pulse from /dev/fm/fd_syslog

00:32:44: fh_fd_syslog_info_publish: pe = 6164A04C

00:32:44: fd_pulse_hndlr: received FH_MSG_EVENT_PUBLISH

00:32:44: fh_schedule_callback: fh_schedule_callback: cc=621C36C0 prev_epc=0; epc=621E7BEC

00:32:44: fh_server: fh_io_msg: received msg 10 from client jobid 94

00:32:44: fh_server: fh_io_msg: received msg 18 from client jobid 94

00:32:44: fh_server: fh_io_msg: received msg 52 from client jobid 94

00:32:44: fh_schedule_callback: fh_schedule_callback: cc=621C36C0 prev_epc=621E7BEC; epc=0

00:32:45: fd_pulse_hndlr: received a pulse from /dev/fm/fd_syslog

00:32:45: fh_fd_syslog_info_publish: pe = 6164A04C

00:32:45: fd_pulse_hndlr: received FH_MSG_EVENT_PUBLISH

00:32:45: fh_schedule_callback: fh_schedule_callback: cc=621C36C0 prev_epc=0; epc=618E0BE0

00:32:45: fh_server: fh_io_msg: received msg 10 from client jobid 94

00:32:45: fh_server: fh_io_msg: received msg 18 from client jobid 94

00:32:45: fh_server: fh_io_msg: received msg 52 from client jobid 94

00:32:45: fh_schedule_callback: fh_schedule_callback: cc=621C36C0 prev_epc=618E0BE0; epc=0

Table 1 describes some of the significant fields shown in the display. The other fields are self-explanatory.

Table 1 debug event manager Field Descriptions 

Field	Description
server events debugging	Indicates the type of debugging output and whether the debugging is on or off.
fh_server	Indicates that a server event message has been received from a client process.
fh_fd_syslog_info_publish	Indicates that a syslog message has been received.

event manager applet

To register an applet with the Embedded Event Manager (EEM) and to enter applet configuration mode, use the event manager applet command in global configuration mode. To remove the applet command from the configuration file, use the no form of this command.

event manager applet applet-name

no event manager applet applet-name

Syntax Description

applet-name

Name of the applet file.

Defaults

No EEM applets are registered.

Command Modes

Global configuration

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE	This command was integrated into Cisco IOS Release 12.3(2)XE.

Usage Guidelines

An EEM applet is a concise method for defining event screening criteria and the action to be taken when that event occurs.

Only one event configuration command is allowed within an applet configuration. When applet configuration submode is exited and no event command is present, a warning is displayed stating that no event is associated with this applet. If no event is specified, this applet is not considered registered and the applet is not displayed. Use the show event manager policy registered command to display a list of registered applets.

Multiple action applet configuration commands are allowed within an applet configuration. When applet configuration submode is exited and no event command is present, a warning is displayed stating that no action is associated with this applet. When no action is associated with this applet, events are still triggered but no actions will be performed.

Action configuration commands are uniquely identified using the label argument, which can be any string value. Actions are sorted in ascending alphanumeric key sequence using the label argument as the sort key and are run using this sequence.

The EEM schedules and runs policies on the basis of an event specification that is contained within the policy itself. When applet configuration mode is exited, EEM examines the event and action commands that are entered and registers the applet to be run when a specified event occurs.

Examples

The following example shows how to register an applet named memory-fail with EEM:

Router(config)# event manager applet memory-fail

Related Commands

Command	Description
show event manager policy registered	Displays registered Embedded Event Manager policies.

event snmp

To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by sampling Simple Network Management Protocol (SNMP) object identifier values, use the event snmp command in applet configuration mode. To remove the SNMP event criteria, use the no form of this command.

event snmp oid oid-value get-type {exact | next} entry-op operator entry-val entry-value [exit-comb {or | and}] [exit-op operator] [exit-val exit-value] [exit-time exit-time-value] poll-interval poll-int-value

no event snmp oid oid-value get-type {exact | next} entry-op operator entry-val entry-value [exit-comb {or | and}] [exit-op operator] [exit-val exit-value] [exit-time exit-time-value] poll-interval poll-int-value

Syntax Description

oid	Specifies the SNMP object identifier (object ID) values in the oid-value argument as the event criteria. •oid-value—Object ID value of the data element, in SNMP dotted notation.
get-type	Specifies the type of SNMP get operation to be applied to the object ID specified by the oid-value argument. •exact—Retrieves the object ID specified by the oid-value argument. •next—Retrieves the object ID that is the alphanumeric successor to the object ID specified by the oid-value argument.
entry-op	Compares the contents of the current object ID with the entry value using the specified operator. If there is a match, an event is triggered and event monitoring is disabled until the exit criteria are met. The operator argument takes one of the following values: •gt—Greater than. •ge—Greater than or equal to. •eq—Equal to. •ne—Not equal to. •lt—Less than. •le—Less than or equal to.
entry-val	Specifies the value with which the contents of the current object ID are compared to decide if an SNMP event should be raised. •entry-value—Entry object ID value of the data element.
exit-comb	(Optional) Indicates the combination of exit conditions that must be met before event monitoring is reenabled. •If the or operator is specified, an exit comparison operator and an exit object ID value, or an exit time value must exist. •If the and operator is specified, an exit comparison operator, an exit object ID value, and an exit time value must exist.
exit-op	(Optional) Compares the contents of the current object ID with the exit value using the specified operator. If there is a match, an event is triggered and event monitoring is reenabled. The operator argument takes one of the following values: •gt—Greater than. •ge—Greater than or equal to. •eq—Equal to. •ne—Not equal to. •lt—Less than. •le—Less than or equal to.
exit-val	(Optional) Specifies the value with which the contents of the current object ID are compared to decide whether the exit criteria are met. •exit-value—Exit object ID value of the data element.
exit-time	(Optional) Specifies the time period after which the event monitoring is reenabled. The timing starts after the event is triggered. •exit-time-value—Number that represents seconds and optional milliseconds in the format ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.
poll-interval	Specifies the time interval between consecutive polls. •poll-int-value—Number that represents seconds and optional milliseconds in the format ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm. The minimum polling interval is 1 second.

Defaults

No EEM events are triggered.

Command Modes

Applet configuration

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE	This command was integrated into Cisco IOS Release 12.3(2)XE.

Usage Guidelines

An EEM event is triggered when one of the fields specified by an SNMP object ID crosses a defined threshold. If multiple conditions exist, the SNMP event will be triggered when all the conditions are met.

Exit criteria are optional. If exit criteria are not specified, event monitoring will be reenabled immediately. If exit criteria are specified—on the basis of time periods or values—event monitoring is not reenabled until the criteria are met.

Examples

The following example shows how to specify event criteria based on SNMP object ID values:

Router(config)# event manager applet memory-fail

Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op 
lt entry-val 5120000 poll-interval 10

Router(config-applet)# action 1.0 syslog msg "Memory exhausted; current available memory 
is $_snmp_oid_val bytes"

Related Commands

Command	Description
event manager applet	Registers an event applet with the Embedded Event Manager and enters applet configuration mode.

event syslog

To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by matching syslog messages, use the event syslog command in applet configuration mode. To remove the syslog message event criteria, use the no form of this command.

event syslog [occurs num-occurrences] [period period-value] [priority priority-level] pattern regular-expression

no event syslog [occurs num-occurrences] [period period-value] [priority priority-level] pattern regular-expression

Syntax Description

occurs	(Optional) Specifies the number of matching occurrences before an EEM event is triggered. If a number is not specified, an EEM event is triggered after the first match. •num-occurrences—The number of occurrences. The value must be greater than 0.
period	(Optional) Specifies the time interval during which the specified number of occurrences must take place. If not specified, no time period check is applied. •period-value—The number that represents seconds and optional milliseconds in the format ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.
priority	(Optional) Specifies the priority level of the syslog messages to be screened. If selected, the priority-level argument must be defined. If not specified, the software will use the default of priority all, and all priorities will be considered when log messages are screened. •priority-level—The number or name of the desired priority level at which syslog messages are matched. Messages at or numerically lower than the specified level are matched. Priority levels are as follows (enter the keyword or number, if available): –all—All priorities are considered when log messages are scanned. –{0 | emergencies}—System is unusable. –{1 | alerts}—Immediate action needed. –{2 | critical}—Critical conditions. –{3 | errors}—Error conditions. –{4 | warnings}—Warning conditions. –{5 | notifications}—Normal but significant conditions. –{6 | informational}—Informational messages. –{7 | debugging}—Debugging messages.
pattern	Specifies the regular expression used to perform the syslog message pattern match. •regular-expression—Regular expression.

Defaults

No EEM events are triggered.

Command Modes

Applet configuration

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.

Usage Guidelines

Use the event syslog command to set up event criteria against which syslog messages are matched. Syslog messages are compared against a specified regular expression. After a specified number of matches occurs within a specified time period, an EEM event is triggered. If multiple conditions exist, the EEM event is triggered when all the conditions are met.

Examples

The following example shows how to specify event criteria based on syslog messages:

Router(config)# event manager applet memory-fail

Router(config-applet)# event syslog occurs 4 pattern {.*UPDOWN.*Ethernet1/0.*}

Router(config-applet)# action 1.0 syslog msg "Memory exhausted; current available memory 
is $_snmp_oid_val bytes"

Related Commands

Command	Description
event manager applet	Registers an event applet with the Embedded Event Manager and enters applet configuration mode.

show event manager policy registered

To display Embedded Event Manager (EEM) policies that are already registered, use the show event manager policy registered command in privileged EXEC mode.

show event manager policy registered [event-type event-name] [time-ordered | name-ordered]

Syntax Description

event-type	(Optional) Displays the registered policies for the event type specified in the event-name argument. If not specified, all registered policies are displayed. •event-name—The type of event. The event can be one of the following options: –snmp—Simple Network Management Protocol (SNMP) event type. –syslog—Syslog event type.
time-ordered	(Optional) Displays the policies according to the time at which the policies were registered.
name-ordered	(Optional) Displays the policies in alphabetical order by the policy name.

Defaults

If this command is invoked with no options, it displays the registered EEM policies for all event types. The policies are displayed according to the time at which the policies were registered.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.0(26)S	This command was introduced.
12.3(4)T	This command was integrated into Cisco IOS Release 12.3(4)T.

Usage Guidelines

The output of this command is most helpful to the person who has the task of writing and monitoring Embedded Event Manager policies. The output shows registered policy information in two parts. The first line in each policy description lists the index number assigned to the policy, the policy type, the type of event registered, the time when the policy was registered, and the name of the policy. The remaining lines of each policy description show information about the registered event and, for applets, the policy actions.

Examples

The following is sample output for the show event manager policy registered command:

Router# show event manager policy registered

No.       Type    Event Type          Time Registered              Name

1         applet  syslog              Thu Jul25  10:08:55 2002     fe0trans

 occurs 1 priority all pattern {.*UPDOWN.*FastEthernet0_0.*}

 action ac01 cns-event msg Interface FastEthernet0_0 changed state

2         applet  snmp                Thu Jul25  10:09:20 2002     totcpualert

 oid {1.3.6.1.4.1.9.9.109.1.1.1.1.6.1} get-type exact entry-op ge entry-val {0} exit-comb 
and exit-op lt exit-val {100}

 exit-time 60 poll-interval 30

 action ac01 syslog priority info msg SNMP Event 1 occurred

 action ac02 cns-event msg *** Warning*** CPU utilization is above 90%

Table 2 describes the significant fields shown in the display.

Table 2 show event manager policy registered Field Descriptions

Field	Description
No.	Index number automatically assigned to the policy.
Type	Indicates if the policy is a system or a user policy.
Event Type	Indicates the type of event.
Time Registered	Time stamp that indicates when the policy file was registered.
Name	Name of the Embedded Event Manager policy file.

Related Commands

Command	Description
event manager applet	Registers an applet with the EEM and enters applet configuration mode.

Copyright © 2003 Cisco Systems, Inc. All rights reserved.