Cisco EEM

By | 14/07/2014

Embedded Event Manager

Last version: Cisco IOS Software is EEM v4.0 Types of EEM policies:

  • Applet policies – using CLI
  • Tcl policies – using Tcl programming language (tool command language)

Available on:

  • Switches Ca talyst 3700, 4500, 6500
  • Routers ISR, 7200, 7300, 7600, 10000, ASR-1000


  • Event Detectors (or event publisher)
  • Event Manager Server
  • Policy Director (or event subscriber)



Applet example – wait for an event, change config and log information

event manager applet NAME
event syslog pattern "Interface GigabitEthernet0/0, changed state to down"
action 1.0 cli command "enable"
action 1.1 cli command "configure term"
action 1.2 cli command "interface g0/1"
action 1.3 cli command "no shut"
action 1.4 cli command "sh int g0/0 | append flash:infofromeem"
action 1.5 cli command "sh int g0/1 | append flash:infofromeem"

Applet example – log information every x time

event manager applet show-rtp-streams
event timer watchdog name timer time 30
action 0.5 cli command "enable"
action 1.0 cli command "show clock | append flash:filename.txt"
action 2.0 cli command "show ip cache flow | append flash:filename.txt"
action 3.0 cli command "show voip rtp conn" | append flash:filename.txt"
action 4.0 cli command "show call active voice br" | append flash:filename.txt"

Applet example – log information in FTP

event manager applet dump-log
event timer watchdog name timer time 1800
action 0.5 cli command "enable"
action 1.0 cli command "show log | append ftp://user:pass@"


Useful links:

EEM Scripting Support Community – Example scripts and discussions

EEM Best Practices

Writting EEM Policies using CLI

Writting EEM Policies using Tcl



EEM Configuration for ISR platforms – Link

Scripts used to Troubleshoot – Link