EEM

Embedded Event Manager (EEM) is a distributed and customized approach to event detection and recovery offered by Cisco IOS-XE software. EEM enables network operators to automate responses to system events through user-defined applets that monitor and react to events such as interface state changes, syslog pattern matches, timer expirations, or CLI command executions. This powerful automation framework reduces manual intervention, enables proactive network management, and allows for custom remediation workflows that can execute CLI commands, manipulate variables, perform pattern matching, and implement complex decision logic to maintain network stability and operational efficiency.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
eem	Class	`[eem]`	No

eem (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
environment_variables	List	`[environment_variables]`	No
session_cli_username	String		No
session_cli_username_privilege	Integer	min: `0`, max: `15`	No
history_size_events	Integer	min: `0`, max: `50`	No
history_size_traps	Integer	min: `0`, max: `50`	No
directory_user_policy	String		No
scheduler_applet_thread_class	Class	`[scheduler_applet_thread_class]`	No
detector_routing_bootup_delay	Number		No
applets	List	`[applets]`	No

environment_variables (iosxe.devices.configuration.eem)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
value	String		Yes

scheduler_applet_thread_class (iosxe.devices.configuration.eem)

Name	Type	Constraint	Mandatory	Default Value
classes	List	String	Yes
number	Integer	min: `1`, max: `65535`	Yes

applets (iosxe.devices.configuration.eem)

Name	Type	Constraint	Mandatory
name	String		Yes
authorization	Choice	`bypass`	No
class	String		No
description	String		No
event	Class	`[event]`	No
actions	List	`[actions]`	No

event (iosxe.devices.configuration.eem.applets)

Name	Type	Constraint	Mandatory
timer_watchdog	Class	`[timer_watchdog]`	No
syslog	Class	`[syslog]`	No
timer_cron	Class	`[timer_cron]`	No
cli	Class	`[cli]`	No

actions (iosxe.devices.configuration.eem.applets)

Name	Type	Constraint	Mandatory
sequence	Any	Integer or String	Yes
cli_command	String		No
set	Class	`[set]`	No
foreach	Class	`[foreach]`	No
string_trim	String		No
string_first	Class	`[string_first]`	No
if_statement	Class	`[if_statement]`	No
else_statement	Boolean	`true`, `false`	No
end_statement	Boolean	`true`, `false`	No
regexp	Class	`[regexp]`	No
wait	Integer		No
continue_statement	Boolean	`true`, `false`	No
exit_statement	Integer		No

timer_watchdog (iosxe.devices.configuration.eem.applets.event)

Name	Type	Mandatory
time	Integer	Yes
name	String	No
maxrun	Integer	No
ratelimit	Integer	No

syslog (iosxe.devices.configuration.eem.applets.event)

Name	Type	Constraint	Mandatory
pattern	String		Yes
maxrun	Integer		No
occurs	Integer	min: `1`, max: `32`	No
ratelimit	Number		No
period	Number		No

timer_cron (iosxe.devices.configuration.eem.applets.event)

Name	Type	Mandatory
cron_entry	String	Yes
name	String	No
maxrun	Integer	No
ratelimit	Integer	No

cli (iosxe.devices.configuration.eem.applets.event)

Name	Type	Constraint	Mandatory
pattern	String		Yes
sync	Choice	`yes`, `no`	No
skip	Choice	`yes`, `no`	No

set (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Constraint	Mandatory	Default Value
variable_name	String		Yes
variable_value	String		Yes

foreach (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Mandatory
loop_variable	String	Yes
list_variable	String	Yes
delimiter	String	Yes

string_first (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Constraint	Mandatory	Default Value
string	String		Yes
substring	String		Yes

if_statement (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Constraint	Mandatory
operand1	String		Yes
operator	Choice	`eq`, `ne`, `gt`, `ge`, `lt`, `le`	Yes
operand2	String		Yes

regexp (iosxe.devices.configuration.eem.applets.actions)

Name	Type	Mandatory
pattern	String	Yes
input	String	Yes
match_variable	String	No
submatch1	String	No
submatch2	String	No
submatch3	String	No

Examples

Basic Syslog Event with CLI Command

This example demonstrates a simple EEM applet that triggers on a syslog pattern and executes CLI commands.

event manager applet config_change_alert
 description Log configuration changes
 event syslog pattern "%SYS-5-CONFIG_I" occurs 1 ratelimit 120 maxrun 30
 action 010 cli command "show clock"

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: config_change_alert
              description: "Log configuration changes"
              event:
                syslog:
                  pattern: "%SYS-5-CONFIG_I"
                  occurs: 1
                  ratelimit: 120
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show clock"

Timer Watchdog Event with Variable Operations

This example shows a periodic timer that captures CLI output and stores it in variables.

event manager applet interface_monitor
 description Check interface status every 5 minutes
 event timer watchdog time 300 ratelimit 60 maxrun 60
 action 010 cli command "show ip interface brief"
 action 020 set interface_output "$_cli_result"

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: interface_monitor
              description: "Check interface status every 5 minutes"
              event:
                timer_watchdog:
                  time: 300
                  ratelimit: 60
                  maxrun: 60
              actions:
                - sequence: "010"
                  cli_command: "show ip interface brief"
                - sequence: "020"
                  set:
                    variable_name: "interface_output"
                    variable_value: "$_cli_result"

Pattern Matching with Regular Expressions

This example demonstrates using regexp to extract data from CLI output with submatch groups.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: version_check
              description: "Extract IOS version information"
              event:
                timer_watchdog:
                  time: 3600
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show version"
                - sequence: "020"
                  regexp:
                    pattern: "Version ([0-9]+)\\.([0-9]+)"
                    input: "$_cli_result"
                    match_variable: "version_found"
                    submatch1: "major_version"
                    submatch2: "minor_version"

Conditional Logic with If Statements

This example shows conditional branching based on variable comparison, including the exit_statement action to terminate the applet early.

event manager applet cpu_threshold_alert
 description Alert on high CPU utilization
 event timer watchdog time 60 maxrun 30
 action 010 cli command "show processes cpu | include five minutes"
 action 020 regexp "five minutes: ([0-9]+)%" "$_cli_result" cpu_found cpu_percent
 action 030 if $cpu_percent gt 75
 action 040 cli command "send log CPU utilization high: $cpu_percent%"
 action 050 else
 action 060 exit
 action 070 end

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: cpu_threshold_alert
              description: "Alert on high CPU utilization"
              event:
                timer_watchdog:
                  time: 60
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show processes cpu | include five minutes"
                - sequence: "020"
                  regexp:
                    pattern: "five minutes: ([0-9]+)%"
                    input: "$_cli_result"
                    match_variable: "cpu_found"
                    submatch1: "cpu_percent"
                - sequence: "030"
                  if_statement:
                    operand1: "$cpu_percent"
                    operator: "gt"
                    operand2: "75"
                - sequence: "040"
                  cli_command: "send log CPU utilization high: $cpu_percent%"
                - sequence: "050"
                  else_statement: true
                - sequence: "060"
                  exit_statement: 0
                - sequence: "070"
                  end_statement: true

String Manipulation with string_first

This example demonstrates using the string_first action to find the first occurrence of a substring within a string.

event manager applet parse_hostname
 description Extract hostname from output
 event timer watchdog time 3600
 action 010 cli command "show running-config | include hostname"
 action 020 string first "$_cli_result" "hostname"

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: parse_hostname
              description: "Extract hostname from output"
              event:
                timer_watchdog:
                  time: 3600
              actions:
                - sequence: "010"
                  cli_command: "show running-config | include hostname"
                - sequence: "020"
                  string_first:
                    string: "$_cli_result"
                    substring: "hostname"

Loop Iteration with Foreach

This example demonstrates iterating over a list of items using foreach loops.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: process_interface_list
              description: "Process each interface in a list"
              event:
                timer_watchdog:
                  time: 600
                  maxrun: 120
              actions:
                - sequence: "010"
                  set:
                    variable_name: "interface_list"
                    variable_value: "Gi1/0/1,Gi1/0/2,Gi1/0/3"
                - sequence: "020"
                  foreach:
                    loop_variable: "interface"
                    list_variable: "$interface_list"
                    delimiter: ","
                - sequence: "030"
                  cli_command: "show interface $interface status"
                - sequence: "040"
                  end_statement: true

Cron-Based Scheduled Execution

This example shows a cron timer for time-of-day scheduling.

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          applets:
            - name: daily_backup
              description: "Backup configuration daily at 2 AM"
              event:
                timer_cron:
                  cron_entry: "0 2 * * *"
                  name: backup_schedule
                  maxrun: 300
              actions:
                - sequence: "010"
                  cli_command: "copy running-config flash:/daily-backup.cfg"

Global EEM Configuration

This example demonstrates global EEM settings including environment variables, session configuration, and detector settings.

event manager environment SMTP_SERVER smtp.example.com
event manager environment ADMIN_EMAIL admin@example.com
event manager session cli username admin privilege 15
event manager history size events 25
event manager history size traps 20
event manager directory user policy flash:/eem_policies
event manager detector routing bootup-delay 180

iosxe:
  devices:
    - name: Device1
      configuration:
        eem:
          environment_variables:
            - name: SMTP_SERVER
              value: smtp.example.com
            - name: ADMIN_EMAIL
              value: admin@example.com
          session_cli_username: admin
          session_cli_username_privilege: 15
          history_size_events: 25
          history_size_traps: 20
          directory_user_policy: flash:/eem_policies
          detector_routing_bootup_delay: 180
          applets:
            - name: simple_applet
              description: "Simple applet using environment variables"
              event:
                timer_watchdog:
                  time: 3600
                  maxrun: 30
              actions:
                - sequence: "010"
                  cli_command: "show clock"