The EEM event detectors have evolved based on IOS releases. The functionality of the event detection and action depends on the specific release. Tables 4-1 through 4-9 pro-vide some insight as to which features are supported on which versions of code.
EEM is available for the Catalyst 6500 series switches, Integrated Services Routers (ISRs), 7200 series routers, 7300 series routers, 7600 series routers, 10000 series routers, Catalyst 4500 series switches, Catalyst 3550, 3560, and 3700 series switches, the ASR-1000 series routers, and the Nexus platform.
The following software release have support for EEM: IOS Software Release 12.2SX, 12.2SR, 12.2SB, 12.4, 12.4T, 12.2SG, 12.2SE, IOS XE and future versions, IOS XR, and NX OS.
Table 4-1 Embedded Event Manager 1.0
Software Release Supported Events Actions
Support available in Cisco IOS Releases 12.0(26)S and 12.3(4)T and later releases
SNMP event detector allows a standard SNMP MIB object to be monitored. When a specific threshold is crossed, an event is generated.
The syslog event detector allows for screening syslog messages.
Generate a Cisco Networking Services (CNS) event for upstream process by a CNS device.
Reload the Cisco IOS software.
Switch to a secondary proces-sor in a fully redundant hard-ware configuration.
Generate prioritized syslog messages.
Table 4-2 Embedded Event Manager 2.0
Software Release Supported Events Actions
Support available from Cisco IOS Release 12.2(25)S and later releases
Application-specific event allows the EEM to publish an event.
Counter event detector publishes an event when a named counter crosses a specified threshold.
The interface counter event detector publishes an event when an interface counter for a specified interface crosses a defined threshold.
The timer event detector publishes events for the following four different types of timers: absolute time of day, countdown, watchdog, and CRON.
The IOS WDSysMon event detector publishes an event when the CPU or memory utilization of a process crosses a threshold.
Run a
Chapter 4: Embedded Event Manager (EEM) 61
Table 4-3 Embedded Event Manager 2.1
Software Release Supported Events Actions
Support available from Cisco IOS Release 12.3(14)T, 12.2(18)SXF5, 12.2(28)SB, 12.2(33)SRA, and later releases
None. When the event manag-er run command executes an EEM policy, the None event detector publishes an event.
When an insertion or removal of a line card takes place, the OIR event detector publishes an event.
When a regular expression match is seen, the CLI event detector publishes an event.
GOLD support was added in EEM 2.1.5 for IOS modularity with 12.2(18)SXF4.
Execution of CLI command using a script.
Send a short e-mail.
Manually run an EEM policy and permit running of multiple concurrent policies using the new event manager schedule script command.
Support for SNMP event detector rate-based events.
Table 4-4 Embedded Event Manager 2.2
Software Release Supported Events Actions
Support available
Enhanced object tracking event detector. Enhanced object tracking provides complete separation between the objects to be tracked and the action to be taken by a client when a tracked object changes.
When the ERM reports an event for the specified policy, the resource event detector publishes an event.
When more than one event is seen during the syn-chronization of the dual RP system, the RF event detector publishes an event.
Read the state of a tracked object.
Set the state of tracked object.
Table 4-5 Embedded Event Manager 2.3
Software Release Supported Events Actions Supported from IOS
Release 12.2(33)SXH and later releases for the Cisco Catalyst 6500 series switches and introduces enhance-ments to the GOLD event detector for that product. EEM 2.3 was integrated into 12.4(11)T and was the first single-source release of EEM.
GOLD diagnostics Added support for the pattern keyword to the action CLI com-mand, which enables you to run interactive commands using applets
The event gold command was enhanced with the addition of the following com-mands:
GOLD event detector support the follow-ing environment variables:
Boot diagnostic level
Card index, name, serial number Port counts
Test counts
Read-only applet GOLD event detectors, which include the following:
Test name, attribute, total run count Test result per test, port, or device Total failure count, last fail time Error code
Occurrence of consecutive failures
Chapter 4: Embedded Event Manager (EEM) 63
Table 4-6 Embedded Event Manager 2.4
Software Release Supported Events Actions
Supported from Cisco IOS Release 12.4(20)T, 12.2(50)SE,
12.2(33)SXI, and later releases
The SNMP notification event detector enables you to view SNMP traps coming into the router. An SNMP notification event is generated when an incoming SNMP trap message matches specified values or crosses specified thresholds.
The RPC event detector enables you to invoke EEM policies from outside the router over an encrypted connection using SSH.
EEM 2.4 added enhancements to the following event detec-tors:
Interface counter rate-based trigger:
This feature adds the ability for an interface event to be trig-gered based on a rate of change over a period of time. For entry and exit value, the rate can be specified.
SNMP delta value:
This publishes the difference between the monitored object identifier (OID) value at the beginning of the monitored period and the actual OID value when the event is pub-lished.
Multiple event support The show event manager com-mands were enhanced to show multiple events.
The parameter argument has been added to the event manag-er run command for a maxi-mum of 15 parameters.
The display of job ID and status can be seen using the show event manager command.
The ability to kill a running pol-icy through the event manager scheduler clear command was also added.
EEM accepts extensions for byte-code scripts *.tbc on valid EEM policies.
Tcl extension support with EEM now include *.tcl for user policies and *tm for system policies.
Byte-code extension.
Registration substitution enhancement for multiple parameters.
Table 4-7 Embedded Event Manager 3.0
Software Release Supported Events Actions Cisco IOS Release
12.4(22)T and later releases
When route entries change in the Routing Information Base (RIB), the routing event detector publishes an event.
When a NetFlow event is triggered, a NetFlow event detector publishes an event.
When an IP SLA reaction is triggered, the IP SLA event detector publishes an event.
The custom CLI event detector publishes an event to add and enhance existing CLI command syntax.
Class-based scheduling can be assigned to a class.
Three new Tcl commands are intro-duced:
event_completion event_wait
event_completion_with_wait Two new IOS commands are sup-ported:
action gets action puts
Applet input support via the console.
Variable logic for applets:
Conditional logic can be applied to the applet through the variable logic feature in EEM.
A programmable interface that encapsulates show commands in an XML interface.
Signature verification for a Tcl script.
Support authenticating e-mail servers.
The keyword source addr is added in Tcl e-mail templates to specify it is either an IPv6 or IPv4 address.
SNMP library extensions for SNMP getid, inform, trap, and set-type operations included in the EEM applet action info and Tcl sys_reqin-fo_snmp commands.
SNMP notification IPv6 support:
IPv6 address is supported for the source and destination IP addresses.
CLI library XML-PI support:
Provides a programmable interface that encapsulates CLI show com-mands in an XML format in a consis-tent way across different Cisco prod-ucts.
Chapter 4: Embedded Event Manager (EEM) 65
Table 4-8 Embedded Event Manager 3.1
Software Release Supported Events Actions
Cisco IOS Release 15.0(1)M and later releases
The SNMP object event detector enables you to replace the trap with an OID.
SNMP notification and inter-cept outgoing SNMP mes-sages.
The action syslog command can now specify the facility.
The description command was added.
AAA (authentication, authorization, and account-ing) bypass is now enabled.
The cli_run and
cli_run_interactive were added.
Table 4-9 Embedded Event Manager 3.2
Software Release Supported Events Actions
Cisco IOS release 12.2(52)SE and later releases
Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) neighbor event detector pro-vides notification when a neighbor is added, deleted, or updated
Interface link and line status notifications.
Identity event detector for AAA.
MAC address table event detector that generates an event when new MAC is learned.
The following commands were added:
debug event manager event identity event mat
event neighbor-discovery show event manager detector