EEM

Version:

Embedded Event Manager (EEM) is a distributed and customized approach to event detection and recovery offered by Cisco IOS-XE software. EEM enables network operators to automate responses to system events through user-defined applets that monitor and react to events such as interface state changes, syslog pattern matches, timer expirations, or CLI command executions. This powerful automation framework reduces manual intervention, enables proactive network management, and allows for custom remediation workflows that can execute CLI commands, manipulate variables, perform pattern matching, and implement complex decision logic to maintain network stability and operational efficiency.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
eem	Class	`[eem]`	No

eem (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
environment_variables	List	`[environment_variables]`	No
session_cli_username	String		No
session_cli_username_privilege	Integer	min: `0`, max: `15`	No
history_size_events	Integer	min: `0`, max: `50`	No
history_size_traps	Integer	min: `0`, max: `50`	No
directory_user_policy	String		No
scheduler_applet_thread_class	Class	`[scheduler_applet_thread_class]`	No
detector_rpc_max_sessions	Integer	min: `4`, max: `16`	No
detector_routing_bootup_delay	Number		No
applets	List	`[applets]`	No

environment_variables (iosxe.devices.configuration.eem)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
value	String		Yes

scheduler_applet_thread_class (iosxe.devices.configuration.eem)

Name	Type	Constraint	Mandatory	Default Value
classes	List	String	Yes
number	Integer	min: `1`, max: `65535`	Yes

applets (iosxe.devices.configuration.eem)

Name	Type	Constraint	Mandatory
name	String		Yes
authorization	Choice	`bypass`	No
class	String		No
description	String		No
event	Class	`[event]`	No
actions	List	`[actions]`	No

event (iosxe.devices.configuration.eem.applets)

Name	Type	Constraint	Mandatory
timer_watchdog	Class	`[timer_watchdog]`	No
syslog	Class	`[syslog]`	No
timer_cron	Class	`[timer_cron]`	No
cli	Class	`[cli]`	No

actions (iosxe.devices.configuration.eem.applets)

Name	Type	Constraint	Mandatory
sequence	Any	Integer or String	Yes
cli_command	String		No
set	Class	`[set]`	No
foreach	Class	`[foreach]`	No
string_trim	String		No
string_first	Class	`[string_first]`	No
if_statement	Class	`[if_statement]`	No
else_statement	Boolean	`true`, `false`	No
end_statement	Boolean	`true`, `false`	No
regexp	Class	`[regexp]`	No
wait	Integer		No
continue_statement	Boolean	`true`, `false`	No
exit_statement	Integer		No

timer_watchdog (iosxe.devices.configuration.eem.applets.event)

Name	Type	Mandatory
time	Integer	Yes
name	String	No
maxrun	Integer	No
ratelimit	Integer	No

syslog (iosxe.devices.configuration.eem.applets.event)

Name	Type	Constraint	Mandatory
pattern	String		Yes
maxrun	Integer		No
occurs	Integer	min: `1`, max: `32`	No
ratelimit	Number		No
period	Number		No

timer_cron (iosxe.devices.configuration.eem.applets.event)

Name	Type	Mandatory
cron_entry	String	Yes
name	String	No
maxrun	Integer	No
ratelimit	Integer	No

cli (iosxe.devices.configuration.eem.applets.event)

Name	Type	Constraint	Mandatory
pattern	String		Yes
sync	Choice	`yes`, `no`	No
skip	Choice	`yes`, `no`	No

set (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Constraint	Mandatory	Default Value
variable_name	String		Yes
variable_value	String		Yes

foreach (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Mandatory
loop_variable	String	Yes
list_variable	String	Yes
delimiter	String	Yes

string_first (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Constraint	Mandatory	Default Value
string	String		Yes
substring	String		Yes

if_statement (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Constraint	Mandatory
operand1	String		Yes
operator	Choice	`eq`, `ne`, `gt`, `ge`, `lt`, `le`	Yes
operand2	String		Yes

regexp (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Mandatory
pattern	String	Yes
input	String	Yes
match_variable	String	No
submatch1	String	No
submatch2	String	No
submatch3	String	No

Examples

Basic Syslog Event with CLI Command

This example demonstrates a simple EEM applet that triggers on a syslog pattern and executes CLI commands.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: config_change_alert
              description: "Log configuration changes"
              event:
                syslog:
                  pattern: "%SYS-5-CONFIG_I"
                  occurs: 1
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show clock"

Timer Watchdog Event with Variable Operations

This example shows a periodic timer that captures CLI output and stores it in variables.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: interface_monitor
              description: "Check interface status every 5 minutes"
              event:
                timer_watchdog:
                  time: 300
                  maxrun: 60
              actions:
                - sequence: "010"
                  cli_command: "show ip interface brief"
                - sequence: "020"
                  set:
                    variable_name: "interface_output"
                    variable_value: "$_cli_result"

Pattern Matching with Regular Expressions

This example demonstrates using regexp to extract data from CLI output with submatch groups.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: version_check
              description: "Extract IOS version information"
              event:
                timer_watchdog:
                  time: 3600
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show version"
                - sequence: "020"
                  regexp:
                    pattern: "Version ([0-9]+)\\.([0-9]+)"
                    input: "$_cli_result"
                    match_variable: "version_found"
                    submatch1: "major_version"
                    submatch2: "minor_version"

Conditional Logic with If Statements

This example shows conditional branching based on variable comparison.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: cpu_threshold_alert
              description: "Alert on high CPU utilization"
              event:
                timer_watchdog:
                  time: 60
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show processes cpu | include five minutes"
                - sequence: "020"
                  regexp:
                    pattern: "five minutes: ([0-9]+)%"
                    input: "$_cli_result"
                    match_variable: "cpu_found"
                    submatch1: "cpu_percent"
                - sequence: "030"
                  if_statement:
                    operand1: "$cpu_percent"
                    operator: "gt"
                    operand2: "75"
                - sequence: "040"
                  cli_command: "send log CPU utilization high: $cpu_percent%"
                - sequence: "050"
                  end_statement: true

Loop Iteration with Foreach

This example demonstrates iterating over a list of items using foreach loops.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: process_interface_list
              description: "Process each interface in a list"
              event:
                timer_watchdog:
                  time: 600
                  maxrun: 120
              actions:
                - sequence: "010"
                  set:
                    variable_name: "interface_list"
                    variable_value: "Gi1/0/1,Gi1/0/2,Gi1/0/3"
                - sequence: "020"
                  foreach:
                    loop_variable: "interface"
                    list_variable: "$interface_list"
                    delimiter: ","
                - sequence: "030"
                  cli_command: "show interface $interface status"
                - sequence: "040"
                  end_statement: true

Cron-Based Scheduled Execution

This example shows a cron timer for time-of-day scheduling.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: daily_backup
              description: "Backup configuration daily at 2 AM"
              event:
                timer_cron:
                  cron_entry: "0 2 * * *"
                  name: backup_schedule
                  maxrun: 300
              actions:
                - sequence: "010"
                  cli_command: "copy running-config flash:/daily-backup.cfg"

Global EEM Configuration

This example demonstrates global EEM settings including environment variables and session configuration.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          environment_variables:
            - name: SMTP_SERVER
              value: smtp.example.com
            - name: ADMIN_EMAIL
              value: admin@example.com
          session_cli_username: admin
          session_cli_username_privilege: 15
          history_size_events: 25
          history_size_traps: 20
          directory_user_policy: flash:/eem_policies
          detector_routing_bootup_delay: 180
          applets:
            - name: simple_applet
              description: "Simple applet using environment variables"
              event:
                timer_watchdog:
                  time: 3600
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show clock"