Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Embedded event manager
open-in-new
<h2 id="cisco-embedded-management-family">Cisco embedded management family</h2> <p>EEM is a member of a family of embedded management technologies in Cisco IOS including SNMP, NetFlow, IP SLA, Web Services Management Agent, <a href="/facts/Syslog/n6a7vIkt">Syslog</a>, ESM (Embedded Syslog Manager), ERM (Embedded Resource Manager), EMM (Embedded Menu Manager), <a href="/facts/Tcl/s7fbKYtR">Tcl</a> and Service Diagnostics. </p><p>When a situation is detected by EEM, it uses policies to invoke actions based on the type of event and the configured policy. EEM currently supports three different types of programming actions (see Programming Capabilities below). </p> <h2 id="about">About</h2> <p>With EEM, users can capture complex network events and run sophisticated programs on Cisco devices. The version of EEM on most Cisco devices is version 2.1, or version is 3.0 which was introduced in IOS 12.4(22)T. The latest version is version 4.0, which was released November 2011, targeting IOS releases 12.2SR, 12.2SB, 12.4, and 12.4T, 15.0M, 12.2SG, 12.2SE, Cisco IOS XE, and future versions. EEM consists of three areas; event detectors, policies and programming languages. </p> <h3>Event detectors</h3> <p>The brains of EEM are event detectors. These event detectors are built-in capabilities to watch for specific situations or conditions. Newer versions of EEM have more event detectors than older ones. </p><p>Typical of EEM Event Detectors: </p> <ul><li><a href="/facts/SNMP/UNYPVA1C">SNMP</a></li> <li>OIR (Online Insertion and Removal)</li> <li>CLI <a href="/facts/Command-line_interface/R9JpGmXQ">command-line interface</a></li> <li><a href="/facts/Syslog/n6a7vIkt">Syslog</a></li> <li><a href="/facts/XML-RPC/UleaeVRo">XML-RPC</a></li> <li>IP SLAs</li> <li><a href="/facts/NetFlow/GRcaBhUF">NetFlow</a></li> <li>Application specific event</li> <li>Config change</li> <li>Interface counters</li> <li>Redundancy framework</li> <li>SNMP notification (i.e. when the device receives a trap)</li> <li>Resource</li> <li>Timer</li> <li>Timer subscriber</li> <li>IOS Process</li> <li>Counter</li> <li>GOLD (Generic OnLine Diagnostics)</li> <li>Environmental</li> <li>Routing</li> <li>Enhanced Object Tracking (EOT)</li> <li>None (launch the event manually)</li></ul> <h3>Policies</h3> <p>Policies determine what is run when an event is detected. Policies save users from having to enumerate an action for every possible event. </p> <h3>Programming capabilities</h3> <p>EEM supports three methods of programmability and scripting. </p> <ol><li>Applets - these allow CLI to be run when a certain set of conditions occurs</li> <li><a href="/facts/Tcl/s7fbKYtR">Tcl</a> - when more complex programs need to be built, EEM supports Tcl (Tool Command Language) development</li> <li>IOS.sh - newer versions of IOS support IOS.sh (IOS shell) macros similar to Linux bash shell</li></ol> <h2 id="version-comparison">Version comparison</h2> <table><tbody><tr><th>EEM Version</th><th>1.0</th><th>2.0</th><th>2.1</th><th>2.1.5</th><th>2.2/2.3</th><th>2.4</th><th>3.0</th></tr><tr><th>IOS Version Introduced</th><th>12.3(4)T, 12.0(26)S</th><th>12.2(27)SBC</th><th>12.3(14)T1, 12.2(28)SBC, 12.2(33)SR</th><th>12.2(18)SXF4 (IOS with modularity) 12.2(18)SXF5 (IOS)</th><th>12.4(2)T, 12.2(33)SRB1, 12.4(11)T (EEM 2.3), 12.2(33)SRC (EEM 2.3), 12.2(33)SXH (EEM 2.3)</th><th>12.4(20)T, 12.2(40)SE, 12.2(40)SG, 12.2(33)SXI</th><th>12.4(22)T</th></tr><tr><td>Syslog, SNMP EDs</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Syslog, SNMP Actions</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Watchdog, Counter, Interface Counter, Timer, Application-Specific EDs</td><td></td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Counter Modification, System Info, Email Actions</td><td></td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>OIR, CLI EDs</td><td></td><td></td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>User and System Tcl Policies</td><td></td><td></td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>GOLD, System Manager, WDSysMon EDs</td><td></td><td></td><td></td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Resource, RF, EOT EDs</td><td></td><td></td><td></td><td></td><td>X</td><td>X</td><td>X</td></tr><tr><td>Multiple event support, SNMP Proxy, XML RPC EDs</td><td></td><td></td><td></td><td></td><td></td><td>X</td><td>X</td></tr><tr><td>Programmatic applets, Netflow, IP SLA, Routing EDs</td><td></td><td></td><td></td><td></td><td></td><td></td><td>X</td></tr></tbody></table> <h2 id="example">Example</h2> <p>There are four steps to setting up an EEM system. In this example, we will get an email of the status of the system when the <a href="/facts/HSRP/uw9NmWK2">HSRP</a> state changes. This example defines an applet action rather than Tcl. </p> <ol><li>event manager environment _email_server 172.27.121.177 <i><-- define the environment variable</i></li> <li>event manager environment _email_to EMAIL_ADDRESS <i><-- define the address to which email will be sent</i></li> <li>event manager environment _email_from EMAIL_ADDRESS <i><-- define the address from which the email will be sent</i></li> <li>event manager applet email_hsrp_state_change <i><-- set up the policy</i></li> <li>event syslog pattern ".*%HSRP-5-STATECHANGE.*" <i><-- define the trigger</i></li> <li>action 1.0 info type routername <i><-- obtain the current device hostname and place it in the $_info_routername variable</i></li> <li>action 1.1 cli command "enable" <i><-- actions such as writing to flash, making config changes, etc. require enable privilege</i></li> <li> append flash:hsrp_state_change.txt" <i><-- write some debugging output to flash</i></li> <li> flash:append hsrp_state_change.txt" <i><-- more debugging output</i></li> <li>action 1.5 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "HSRP_STATE_CHANGE Alert from $_info_routername: $_syslog_msg" body "$_cli_result" <i><-- send an email with the result of the last CLI command in the body of the message</i></li></ol> <h2 id="network-management-software-and-tools-support">Network management software and tools support</h2> <p>Network management Software utilizing EEM include: </p> <ul><li>CiscoWorks and CiscoWorks LMS</li> <li><a href="http://progrizon.com/products/tools-overview.html">Progrizon: EEM Deployment Application Suite and EEM Policy Builder</a> <a href="https://web.archive.org/web/20110715120502/http://www.progrizon.com/products/tools-overview.html">Archived</a> 2011-07-15 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a></li> <li><a href="http://www.davranetworks.com">Davra Networks: EEM Solutions</a></li></ul> <h2 id="further-reading">Further reading</h2> <ul><li>Blair, Ray; Durai, Arvind; Lautmann, John (2010). "Embedded Event Manager (EEM)". <i>TcL Scripting for Cisco IOS</i>. Networking Technology Series. Cisco Press. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 9781587059452.</li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6815/datasheet_c78-492444.html">EEM Data Sheet</a></li> <li><a href="http://www.cisco.com/go/eem">Go EEM</a></li> <li><a href="http://www.cisco.com/go/ciscobeyond">EEM Scripting Community</a></li> <li><a href="https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-16/eem-xe-16-book/eem-overview.html">Embedded Event Manager Configuration Guide</a></li></ul> <h3>EEM-Based Solution Development</h3> <ul><li><a href="http://www.progrizon.com/index.html">Progrizon, Inc. EEM Solution Development and Consulting</a> <a href="https://web.archive.org/web/20110715120534/http://www.progrizon.com/index.html">Archived</a> 2011-07-15 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a></li></ul> <h3>Training</h3> <ul><li><a href="http://progrizon.com/products/training-overview.html">Progrizon, Inc. Training</a> <a href="https://web.archive.org/web/20110715120410/http://www.progrizon.com/products/training-overview.html">Archived</a> 2011-07-15 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a></li> <li><a href="https://web.archive.org/web/20110715120414/http://www.progrizon.com/products/training-CIOSC.html">Cisco IOS Automation and Customization (CIOSC)</a></li> <li><a href="https://web.archive.org/web/20110715120457/http://www.progrizon.com/products/training-ACEEM.html">Advanced IOS Customization using EEM (ACEEM)</a></li> <li><a href="https://aboutnetworks.net/cisco-eem/">"Cisco Embedded Event Manager (EEM)"</a>. <i>aboutnetworks.net</i>.</li></ul>