Cisco EEM Applets: Automate with event syslog Triggers

Cisco Embedded Event Manager (EEM) lets the router react to events by itself — no external monitoring server required. An EEM applet pairs an event detector (a syslog pattern, an SNMP OID crossing a threshold, a timer, an interface state) with a list of actions (run CLI commands, write syslog messages, send mail). It is the built-in automation layer for the kind of "watch for X, then do Y" operations that otherwise keep engineers on call. This article shows the applet structure and the most useful production examples.

Applet Anatomy

event manager applet NAME
 event <detector>
 action <sequence> <action type> <parameters>

Actions run in sequence-number order; numbering by decimals (1.0, 1.5, 2.0) lets you insert steps later. Applets support environment variables, and $_cli_result holds the output of the last CLI action so it can be embedded in a message.

Example 1: Auto-Recovery on Interface Shutdown

When an interface is shut down (or flaps), this applet re-enables it and emails the current users:

event manager applet interface_Shutdown
 event syslog pattern "Interface FastEthernet1/0, changed state to administratively down"
 action 1.0 cli command "enable"
 action 1.5 cli command "configure terminal"
 action 2.0 cli command "interface fa1/0"
 action 2.5 cli command "no shutdown"
 action 3.0 cli command "end"
 action 3.5 cli command "who"
 action 4.0 mail server "192.168.1.1" to "netops@example.com" from "eem@example.com" subject "ISP1 interface recovered" body "Users: $_cli_result"

Use event syslog pattern with a regex for finer matching, e.g. event syslog pattern ".*UPDOWN.*Ethernet1/0.*" occurs 4 to fire only after the link has bounced four times.

Example 2: Capture Data When CPU Spikes

An SNMP-polled applet that snapshots diagnostics to flash when CPU exceeds 60 percent:

event manager applet HIGH-CPU
 event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3 get-type next entry-op gt entry-val 60 poll-interval 5
 action 0.1 cli command "enable"
 action 0.3 cli command "term length 0"
 action 1.1 cli command "show process cpu sorted | append flash:EEM_CPU"
 action 1.4 cli command "show ip traffic | append flash:EEM_TRAFFIC"
 action 1.6 cli command "show logging | append flash:EEM_LOGS"
 action 4.2 syslog msg "High CPU captured to flash:"

The same pattern — event triggers, CLI snapshots appended to flash — turns a router into a self-documenting device for post-mortems.

Example 3: Load-Based ACL toggling

EEM can also poll interface load and apply or remove an access-group when rxload crosses a threshold, giving lightweight congestion control on a WAN edge without QoS redesign.

Verification and Debugging

show event manager policy registered
show event manager history events
debug event manager action cli

show event manager policy registered lists every applet with its event type and maxrun; debug event manager action cli shows each CLI action as it executes, which is the fastest way to see why an applet fails. Remember the default applet run time is 20 seconds (maxrun extends it), and cli actions in an applet always need an enable step first. EEM complements SNMP-based platforms like Zabbix network monitoring for detection, and pairs with the troubleshooting workflow in Catalyst unexpected reload troubleshooting.

原文链接：https://community.cisco.com/t5/networking-knowledge-base/cisco-eem-basic-overview-and-sample-configurations/ta-p/3148479