Cisco Embedded Event Manager (EEM) is a scripting and automation mechanism within the IOS that triggers specific actions in response to network events. It is a flexible and robust tool which can provide scalable solution to given scenarios. It is composed with 2 pieces:

-Applets which a collection of CLI commands
-Scripting which are defined using the ASCII editor of the network device

Let’s dive into 1 basic scenario to see how it works.

Scenario

Here, we have 2 routers which are directly connected. Let’s write a script that re-enable Eth0/0 on R1 if it is shutdown for any reasons…

Here, we have an applet called “UPTIME”. Note that the naming convention of the applet is totally up to you. This applet inspect the syslog pattern that matches the output “Line protocol on Interface Ethernet0/0, changed state to down” which indicates basically that interface Eth0/0 is down. When a match is found, a set of actions take place which are denominated starting from the 3rd line. We basically enter the configuration mode and then unshut the port at the interface level. Let’s see that in action. First, let’s turn on debugging on R1 and run constant pings from R2…

Debugging is on. Let’s run a constant ping from R2…

While this ping is going, let’s shut Eth0/0 on R1 and see what happens…

Excellent, here we can clearly see that EEM detected the interface going down via the syslog message and performed the actions defined in the configuration. The interface came right back up ! Let’s check our pings and see how many packets we’ve lost so far…

We’ve only lost 2 packets ! You can see here how useful this tool can be.

That’s all for today.

Please let me know if you have any questions ! Thank you for checking in !