Feedback
Contents
event mat through R Commands
event mat through R Commands
event mat
To publish an event when a mac-address is learned in the mac-address-table, use the event matcommand in applet configuration mode. To disable the publishing of events, use the no form of this command.
event [ tag event-tag ] mat { interface { type number | regexp interface-name } [ mac-address mac-address ] | mac-address mac-address [ interface { type number | regexp interface-name } ] } [ maxrun maxruntime-number ] [ hold-down seconds ] [ type { add | delete } ]
no event mat
Syntax Description
Usage Guidelines
You must specify either interface or mac-address. If one of them is specified, the other one is optional. All the keywords can be used in any combination.
event neighbor-discovery
To publish an event when a Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) cache entry changes or a interface link status changes in an Embedded Event Manager (EEM) applet, use the event neighbor-discoverycommand in applet configuration mode. To disable the action of publishing the event, use the no form of this command.
event [ tag event-tag ] neighbor-discovery interface { type number | regexp interface-name } [ maxrun maxruntime-number ] event-to-monitor
no event neighbor-discovery
Syntax Description
Usage Guidelines
You must specify interface and at least one of cdp, lldp, link-event and line-event for the event specification to be accepted. You can use interface and maxrun keywords and the event-trigger-criteria argument in any order.
event nf
To publish an event when a NetFlow operation is triggered in an Embedded Event Manager (EEM) applet, use the event nf command in applet configuration mode. To disable the action of publishing an event when NetFlow operations are triggered, use the no form of this command.
event [ tag event-tag ] nf monitor-name name event-type { create | delete | update } [exit-event-type] { create | delete | update } subevent field field-type entry-value value-string [ exit-value value-string ] entry-op operator-value [ exit-op operator-value ] [ rate-interval seconds ] [ exit-rate-interval seconds ] [ maxrun maxruntime-number ]
no event [ tag event-tag ] nf
Syntax Description
Usage Guidelines
You can use the event nfcommand to monitor the NetFlow events. Multiple events can be specified together for additional filtering on more than one event.
event none
To specify that an Embedded Event Manager (EEM) policy is to be registered with the EEM and can be run manually, use the event none command in applet configuration mode. To remove the event none command from the configuration file, use the no form of this command.
event [ tag event-tag ] none [ sync { yes | no } ] [default] [ maxrun maxruntime-number ]
no event none
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
synch
Indicates whether the policy should be executed synchronously before the CLI command executes.
- If the yes keyword is specified, the policy will run synchronously with the CLI command.
- If the no keyword is specified, the policy will run asynchronously with the CLI command.
default
(Optional) The time period during which the CLI event detector waits for the policy to exit (specified in ssssssssss[.mmm] format, where ssssssssss must be an integer representing seconds from 0 to 4294967295, and where mmm must be an integer representing milliseconds from 0 to 999). If the default time period expires before the policy exits, the default action will be executed. The default action is to run the command. If this argument is not specified, the default time period is set to 30 seconds.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).
Command History
Release
Modification
12.3(14)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The tag and maxrun keywords were added to support multiple event statements within an applet.
Usage Guidelines
EEM usually schedules and runs policies on the basis of an event specification that is contained within the policy itself. The event none command allows EEM to identify an EEM policy that can either be run manually or be run when an EEM applet is triggered. To run the policy, use either the action policy command in applet configuration mode or the event manager run command in global configuration mode.
Examples
The following example shows how to register a policy named manual-policy to be run manually and then how to execute the policy:
Router(config)# event manager applet manual-policy Router(config-applet)# event none Router(config-applet)# exit Router(config)# event manager run manual-policyevent oir
To specify that an Embedded Event Manager (EEM) applet be run on the basis of an event raised when a hardware card online insertion and removal (OIR) occurs, use the event oircommand in applet configuration mode. To remove the event oir command from the configuration, use the no form of this command.
event [ tag event-tag ] oir [ maxrun maxruntime-number ]
no event [ tag event-tag ] oir [ maxrun maxruntime-number ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).
Command History
Release
Modification
12.3(14)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The tag and maxrun keywords were added to support multiple event statements within an applet.
event process
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of an event raised when a Cisco IOS Software Modularity process starts, restarts, or stops, use the event processcommand in applet configuration mode. To remove the process event criteria, use the no form of this command.
event process { abort | start | term | user-restart | user-shutdown } path process-name [ instance instance-value ] [ node node-value ]
no event process { abort | start | term | user-restart | user-shutdown } path process-name [ instance instance-value ] [ node node-value ]
Syntax Description
abort
Specifies that an event is triggered when the specified process aborts with one of the following abnormal conditions:
- A nonzero exit status.
- A kernel-generated signal is received.
- A SIGTERM or SIGKILL signal is received but not as a result of a user request.
start
Specifies that an event is triggered when the specified process is started.
term
Specifies that an event is triggered when the specified process stops normally.
user-restart
Specifies that an event is triggered when there is a process restart request from the CLI command.
user-shutdown
Specifies that an event is triggered when there is a process stop request.
path process-name
Specifies the path of the process including the process name. If the value of the process-name argument contains embedded blanks, enclose it in double quotation marks.
instance instance-value
(Optional) Specifies the process instance ID. The ID must be a number in the range of 1 to 4294967295.
node node-value
(Optional) Specifies the node name which is a concatenation of the hardware slot number and the hardware CPU number.
Command Default
No EEM events are triggered on the basis of a Cisco IOS Software Modularity process starting, restarting, or stopping.
event resource
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of an Embedded Resource Manager (ERM) event report for a specified policy, use the event resource command in applet configuration mode. To remove the report event criteria, use the no form of this command.
event [ tag event-tag ] resource policy policy-filename [ maxrun maxruntime-number ]
no event [ tag event-tag ] resource policy policy-filename [ maxrun maxruntime-number ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
policy
Indicates that a specific policy is identified.
policy-filename
Policy name.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).
Command History
Release
Modification
12.4(2)T
This command was introduced.
12.2(31)SB3
This command was integrated into Cisco IOS Release 12.2(31)SB3.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
12.4(20)T
The tag and maxrun keywords were added to support multiple event statements within an applet.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
The resource event detector publishes an event when the ERM reports an event for the specified policy. The ERM infrastructure tracks resource depletion and resource dependencies across processes and within a system to handle various error conditions. The error conditions are handled by providing an equitable sharing of resources between various applications. The ERM framework provides a communication mechanism for resource entities and allows communication between these resource entities from numerous locations. The ERM framework also helps in debugging the CPU and memory- related issues. The ERM monitors system resource usage to better understand scalability needs by allowing you to configure threshold values for resources such as CPU, buffer, and memory.
Examples
The following example shows how to specify event criteria based on an ERM event report for a policy defined to report high CPU usage:
Router(config)# event manager applet policy-one Router(config-applet)# event resource policy cpu-high Router(config-applet)# action 1.0 syslog msg “CPU high at $_resource_current_value percent”event rf
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of Redundancy Framework (RF) state change notifications, use the event rfcommand in applet configuration mode. To remove the RF event criteria, use the no form of this command.
event [ tag event-tag ] rf event rf-state-name [ maxrun maxruntime-number ]
no event [ tag event-tag ] rf event rf-state-name [ maxrun maxruntime-number ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
event
Compares the regular expression contained in the rf-state-name argument with an RF state change notification. If there is a match, an event is triggered. The rf-state-name argument takes one of the following values:
- RF_EVENT_CLIENT_PROGRESSION
- RF_EVENT_CONTINUE_PROGRESSION
- RF_EVENT_GO_ACTIVE
- RF_EVENT_GO_ACTIVE_EXTRALOAD
- RF_EVENT_GO_ACTIVE_HANDBACK
- RF_EVENT_GO_STANDBY
- RF_EVENT_KEEP_ALIVE
- RF_EVENT_KEEP_ALIVE_TMO
- RF_EVENT_LOCAL_PROG_DONE
- RF_EVENT_NEGOTIATE
- RF_EVENT_NOTIFICATION_TMO
- RF_EVENT_PEER_PROG_DONE
- RF_EVENT_STANDBY_PROGRESSION
- RF_EVENT_START_PROGRESSION
- RF_EVENT_SWACT_INHIBIT_TMO
- RF_PROG_ACTIVE
- RF_PROG_ACTIVE_DRAIN
- RF_PROG_ACTIVE_FAST
- RF_PROG_ACTIVE_POSTCONFIG
- RF_PROG_ACTIVE_PRECONFIG
- RF_PROG_EXTRALOAD
- RF_PROG_HANDBACK
- RF_PROG_INITIALIZATION
- RF_PROG_PLATFORM_SYNC
- RF_PROG_STANDBY_BULK
- RF_PROG_STANDBY_COLD
- RF_PROG_STANDBY_CONFIG
- RF_PROG_STANDBY_FILESYS
- RF_PROG_STANDBY_HOT
- RF_REGISTRATION_STATUS
- RF_STATUS_MAINTENANCE_ENABLE
- RF_STATUS_MANUAL_SWACT
- RF_STATUS_OPER_REDUNDANCY_MODE_CHANGE
- RF_STATUS_PEER_COMM
- RF_STATUS_PEER_PRESENCE
- RF_STATUS_REDUNDANCY_MODE_CHANGE
- RF_STATUS_SWACT_INHIBIT
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm]format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999.
Command History
Release
Modification
12.4(2)T
This command was introduced.
12.2(31)SB3
This command was integrated into Cisco IOS Release 12.2(31)SB3.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
12.4(20)T
The tag and maxrun keywords were added to support multiple event statements within an applet.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
An EEM event is triggered when the expression in the rf-state-name argument matches an RF state change notification. The RF event detector publishes an event when one or more RF events occur during synchronization in a dual Route Processor (RP) system.
Examples
The following example shows how to specify event criteria based on an RF state change notification:
Router(config)# event manager applet start-rf Router(config-applet)# event rf event rf_prog_initialization Router(config-applet)# action 1.0 syslog msg "rf state rf_prog_initialization reached"event routing
To publish an event when route entries change in Routing Information Base (RIB) infrastructure, use the event routing command in applet configuration mode. To stop publishing events when route entries change in RIB, use the no form of this command.
event [ tag event-tag ] routing network ip-address/length [ ge ge-length ] [ le le-length ] [ protocol protocol-value ] [ type { add | all | modify | remove } ] [ maxrun maxruntime-number ]
no event [ tag event-tag ] routing
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
network
Specifies the network ip address and length, whose route is to be monitored.
ip-address / length
The ip address and length of the network to be monitored. For example, 192.0.2.4/8.
ge ge-length
(Optional) Specifies the minimum prefix length to be matched.
le le-length
(Optional) Specifies the maximum prefix length to be matched.
ne ne-length
(Optional) Specifies the prefix length not to be matched.
protocol
(Optional) Specifies the protocol value for the network being monitored.
protocol-value
The network protocol value. One of the following protocols can be used: all, bgp, connected, eigrp, isis, iso-igrp, mobile, odr, ospf, rip, and static. The default is all.
type
(Optional) Specifies the desired policy trigger. The default is all.
add
Specifies that an entry is added to the routing table.
all
Specifies that a routing table entry is added, removed, or modified.
modify
Specifies that an entry in the routing table is modified.
remove
Specifies that an entry is removed from the routing table
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds from 0 to 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999.
Command Default
By default, no events are published when route entries change in RIB infrastructure.
Usage Guidelines
An EEM event is published when route-entry changes are detected in a RIB infrastructure. The network IP address for the route to be monitored must be specified. Network prefixes to be matched, protocol values, and type are optional parameters.
NoteModification of an existing static route may result in a remove event followed by an add event for the old API (v1.0) or a modify event for the new API (v2.0) depending on the Cisco IOS release.
Examples
The following example shows how a specific route entries change when many parameters is monitored:
Router(config )# event manager applet EventRouting Router(config-applet)# event routing 192.0.2.4/8 protocol static type add ge 5 maxrun 56 Router(config-applet)#The following example shows the output for the Cisco IOS version that uses the old routing API (v1.0):
Router# show event manager detector routing No. Name Version Node Type 1 routing 01.00 node0/0 RPThe following example shows the output for the Cisco IOS version that uses the new routing API (v2.0):
Router# show event manager detector routing No. Name Version Node Type 1 routing 02.00 node0/0 RPevent rpc
To configure the router to accept Embedded Event Manger (EEM) applet using the remote procedure call (RPC) command, use the event rpccommand in applet configuration mode. To disable EEM applet using the RPC command, use the no form of this command.
event [ tag event-tag ] rpc [ maxrun maxruntime-number ]
no event [ tag event-tag ] rpc [ maxrun maxruntime-number ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).
Usage Guidelines
Use this command to allow an EEM applet to be executed using the RPC command.
When an applet is configured to run using the RPC command, all output is still sent to the Command-Line-Interface (CLI) console and not sent in the RPC reply message; so an RPC ED applet is not very useful.
Examples
The following example shows how to configure the event rpc command with maximum runtime set to 3000 seconds.
Router(onfig-applet)# event rpc maxrun 3000The following example shows how to send a Simple Object Access Protocol (SOAP) message request and receive reply:
Examples
<?xml version="1.0"?> <SOAP:Envelope xmlns:SOAP="http://www.cisco.com/eem.xsd"> <SOAP:Body> <run_emscript> <script_name> name of script </script_name> <argc> argc value </argc> <arglist> <l> argv1 value </l> <l> argv2 value </l> ... <l> argvn value </l> </arglist> </run_Eemscript> </SOAP:Body> </SOAP:Envelope>To send the request, enter “]]>]]>”
Examples
<?xml version="1.0"?> <SOAP:Envelope xmlns:SOAP="http://www.cisco.com/eem.xsd"> <SOAP:Body> <run_Eemscript_response> <return_code> rc </return_code> <output> output string </output> </run_eemscript_response> </SOAP:Body> </SOAP:Envelope>The following example shows how to configure the applet called RPC_example:
event manager applet RPC_example event rpc action output puts "hello world"The following example shows how to run the applet using SSH:
infra-view11 {/users/johndoe} ssh -2 -s user@172.16.0.0 eem_rpc Password: <?xml version="1.0" encoding="UTF-8"?> <SOAP:Envelope xmlns:SOAP="http://www.cisco.com/eem.xsd"> <SOAP:Body> <run_eemscript> <script_name>RPC_example</script_name> </run_eemscript> </SOAP:Body> </SOAP:Envelope> ]]>]]> <?xml version="1.0" encoding="UTF-8"?><SOAP:Envelope xmlns:SOAP="http://www.cisco.com/eem.xsd"><SOAP:Body><run_eemscript_response><return_code>0</return_code><output></output></run_eemscript_response></SOAP:Body></SOAP:Envelope>]]>]]>event snmp
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by sampling Simple Network Management Protocol (SNMP) object identifier values, use the event snmpcommand in applet configuration mode. To remove the SNMP event criteria, use the no form of this command.
event [ tag event-tag ] snmp oid oid-value get-type { exact | next } entry-op operator entry-val entry-value entry-type { value | increment | rate } [ exit-comb { or | and } ] [ exit-op operator ] [ exit-val exit-value ] [ exit-type { value | increment | rate } ] [ exit-time exit-time-value ] [ exit-event { true | false } ] [ average-factor average-factor-value ] poll-interval poll-int-value [ maxrun maxruntime-number ]
no event [ tag event-tag ] snmp oid oid-value get-type { exact | next } entry-op operator entry-val entry-value entry-type { value | increment | rate } [ exit-comb { or | and } ] [ exit-op operator ] [ exit-val exit-value ] [ exit-type { value | increment | rate } ] [ exit-time exit-time-value ] [ exit-event { true | false } ] [ average-factor average-factor-value ] poll-interval poll-int-value [ maxrun maxruntime-number ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
oid
Specifies the SNMP object identifier (object ID) value in the oid-value argument as the event criteria.
oid-value
Object ID value of the data element, in SNMP dotted notation. An OID is defined as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value. Monitoring of some OID types is supported. When the oid keyword is used, an error message is returned if the OID is not one of the following:
- INTEGER_TYPE
- COUNTER_TYPE
- GAUGE_TYPE
- TIME_TICKS_TYPE
- COUNTER_64_TYPE
- OCTET_PRIM_TYPE
- OPAQUE_PRIM_TYPE
get-type
Specifies the type of SNMP get operation to be applied to the object ID specified by the oid-value argument.
exact
Retrieves the object ID specified by the oid-value argument.
next
Retrieves the object ID that is the alphanumeric successor to the object ID specified by the oid-value argument.
entry-op
Compares the contents of the current object ID with the entry value using the specified operator. If there is a match, an event is triggered and event monitoring is disabled until the exit criteria are met.
operator
Two-character string. The operatorargument takes one of the following values:
- gt --Greater than.
- ge --Greater than or equal to.
- eq --Equal to.
- ne --Not equal to.
- lt --Less than.
- le --Less than or equal to.
entry-val
Specifies the value with which the contents of the current object ID are compared to decide if an SNMP event should be raised.
entry-value
Entry object ID value of the data element.
entry-type
Specifies a type of operation to be applied to the object ID specified by the entry-value argument.
value
Value is defined as the actual value of the entry-value or exit-valueargument.
increment
Increment uses the entry-value or exit-valuefield as an incremental difference and the entry-valueor exit-valueis compared with the difference between the current counter value and the value when the event was last triggered (or the first polled sample if this is a new event). A negative value checks the incremental difference for a counter that is decreasing.
rate
Rate is defined as the average rate of change over a period of time. The time period is the average-factor-value multiplied by the poll-int-value. At each poll interval the difference between the current sample and the previous sample is taken and recorded as an absolute value. An average of the previous average-factor-value samples is taken to be the rate of change.
exit-comb
(Optional) Indicates the combination of exit conditions that must be met before event monitoring is reenabled.
or
(Optional) Specifies that an exit comparison operator and an exit object ID value or an exit time value must exist.
and
(Optional) Specifies that an exit comparison operator, an exit object ID value, and an exit time value must exist.
exit-op
(Optional) Compares the contents of the current object ID with the exit value using the specified operator. If there is a match, an event is triggered and event monitoring is reenabled.
exit-val
(Optional) Specifies the value with which the contents of the current object ID are compared to decide whether the exit criteria are met.
exit-value
(Optional) Exit object ID value of the data element.
exit-type
(Optional) Specifies a type of operation to be applied to the object ID specified by the exit-value argument. If not specified, the value is assumed.
exit-time
(Optional) Specifies the time period after which the event monitoring is reenabled. The timing starts after the event is triggered.
exit-time-value
(Optional) Number that represents seconds and optional milliseconds in the format ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If only milliseconds are used, the format is 0.mmm.
exit-event
(Optional) Indicates whether a separate exit event is to be triggered when event monitoring is enabled after an initial event is triggered.
true
(Optional) Specifies that a separate exit event is triggered.
false
(Optional) Specifies that a separate exit event is not triggered. This is the default.
average-factor
(Optional) Specifies a number used to calculate the period used for rate-based calculations. The average-factor-value is multiplied by the poll-int-value to derive the period in milliseconds.
average-factor-value
(Optional) Number in the range from 1 to 64. The minimum average factor value is 1.
poll-interval
Specifies the time interval between consecutive polls.
poll-int-value
Number that represents seconds and optional milliseconds in the format ssssss[.mmm]. The range for seconds is from 1 to 4294967295. The range for milliseconds is from 0 to 999. The minimum polling interval is 1 second.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in SSSSSSSSSS[.MMM] format, where SSSSSSSSSS must be an integer representing seconds between 0 and 4294967295, inclusive, and where MMM must be an integer representing milliseconds between 0 and 999.
Command History
Release
Modification
12.0(26)S
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
12.3(2)XE
This command was integrated into Cisco IOS Release 12.3(2)XE.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
12.3(14)T
Optional keywords to support SNMP rate-based events were added.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The tag and maxrunkeywords and associated arguments were added.
Usage Guidelines
An EEM event is triggered when one of the fields specified by an SNMP object ID crosses a defined threshold. If multiple conditions exist, the SNMP event will be triggered when all the conditions are met.
Exit criteria are optional. If exit criteria are not specified, event monitoring will be reenabled immediately. If exit criteria are specified--on the basis of values or time periods--event monitoring is not reenabled until the criteria are met.
When the entry-op keyword is used and there is a match, an event is triggered and event monitoring is disabled until the exit criteria are met.
When the exit-op keyword is used and there is a match, an event is triggered and event monitoring is reenabled.
The entry-typekeyword triggers one of the following actions:
- If the value keyword is specified, the entry-value is an actual value and an SNMP event is raised whenever the absolute value occurs.
- If the increment keyword is specified, the entry-value is an increment and an SNMP event is raised whenever the incremental value is reached.
- If the rate keyword is specified, the entry-value is a rate of change and an SNMP event is raised whenever the rate of change value is reached.
When the optional exit-typekeyword is used, the following occurs:
- If the value keyword is specified, the exit-value is an actual value and the event monitoring is reenabled whenever the absolute value occurs. This is the default.
- If the increment keyword is specified, the exit-value is an increment and the event monitoring is reenabled whenever the incremental value is reached.
- If the rate keyword is specified, the exit-value is a rate of change and the event monitoring is reenabled whenever the rate of change value is reached.
The increment and rate types are supported only for the following OID types: INTEGER_TYPE, COUNTER_TYPE, and COUNTER_64_TYPE.
Examples
The following example shows how an EEM applet called memory-fail will run when there is an exact match on the value of a specified SNMP object ID that represents the amount of current process memory. A message saying that process memory is exhausted and noting the current available memory will be sent to syslog.
Router(config)# event manager applet memory-fail Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op lt entry-val 5120000 poll-interval 10 Router(config-applet)# action 1.0 syslog msg "Memory exhausted; current available memory is $_snmp_oid_val bytes"The following example shows an EEM applet called IPSLAping1 being registered to run when there is an exact match on the value of a specified SNMP object ID that represents a successful IP SLA ICMP echo operation (this is equivalent to a ping command). Four actions are triggered when the echo operation fails, and event monitoring is disabled until after the second failure.
A message saying that the ICMP echo operation to a server failed is sent to syslog, an SNMP trap is generated, EEM publishes an application-specific event, and a counter called IPSLA1F is incremented by a value of one.
Router(config)# event manager applet IPSLAping1 Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.4 get-type exact entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 5 Router(config-applet)# action 1.0 syslog priority critical msg "Server IP echo failed: OID=$_snmp_oid_val" Router(config-applet)# action 1.1 snmp-trap strdata "EEM detected server reachability failure to 10.1.88.9" Router(config-applet)# action 1.2 publish-event sub-system 88000101 type 1 arg1 10.1.88.9 arg2 IPSLAEcho arg3 failevent snmp-notification
To register the event criteria for an Embedded Event Manager (EEM) applet that is run by sampling Simple Network Management Protocol (SNMP) notification, use the event snmp-notificationcommand in applet configuration mode. To remove the SNMP notification event criteria, use the no form of this command.
event [ tag event-tag ] snmp-notification oid oid-string oid-val comparison-value op operator [ maxrun maxruntime-number ] [ src-ip-address ip-address ] [ dest-ip-address ip-address ] [ default seconds ] [ direction { incoming | outgoing } ] [ msg-op { drop | send } ]
no event [ tag event-tag ] snmp-notification
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
oid
Specifies the SNMP object identifier (object ID) values in the oid-val argument as the event criteria.
oid-string
Object ID value of the data element, in SNMP dotted notation. An OID is defined as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value. Monitoring of some OID types is supported. When the oid keyword is used, an error message is returned if the OID is not one of the following:
- COUNTER_TYPE
- COUNTER_64_TYPE
- GAUGE_TYPE
- INTEGER_TYPE
- OCTET_PRIM_TYPE
- OPAQUE_PRIM_TYPE
- TIME_TICKS_TYPE
oid-val comparison-value
Specifies the OID comparison value.
op
Compares the contents of the current object ID with the SNMP Protocol Data Unit (PDU) entry value using the specified operator. If there is a match, an event is triggered and event monitoring is disabled until the exit criteria are met.
operator
Two-character string. The operatorargument takes one of the following values:
- gt --Greater than.
- ge --Greater than or equal to.
- eq --Equal to.
- ne --Not equal to.
- lt --Less than.
- le --Less than or equal to.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999. The default value is 20 seconds.
src-ip-address
(Optional) Specifies the source IP address where the SNMP notification trap originates. The default is all; it is set to receive SNMP notification traps from all IP addresses.
ip-address
(Optional) The source IP address.
dest-ip-address
(Optional) Specifies the destination IP address where the SNMP notifications trap is sent. The default is all; it is set to receive SNMP traps from all destination IP addresses.
dest-ip-address
(Optional) The destination IP address.
default seconds
(Optional) Specifies the time period during which the snmp notification event detector waits for the policy to exit. The time period is specified in ssssssssss[.mmm] format, where ssssssssss must be an integer representing seconds between 0 and 4294967295 and mmm must be an integer representing milliseconds between 0 and 999.
direction
(Optional) Determines the direction of the SNMP trap or inform PDU to filter. The default is incoming.
incoming --Specifies the incoming direction of the SNMP trap or inform PDU to filter.
outgoing --Specifies the outgoing direction of the SNMP trap or inform PDU to filter.
msg-op
(Optional) Indicates the action to be taken on the SNMP PDU, drop it or send it once the event is triggered.
drop --Specifies to drop the messages.
send --Specifies to send the messages.
Command Default
No EEM events are triggered on the basis of SNMP notification object identifier values.
Usage Guidelines
The SNMP notification event detector provides the ability to intercept SNMP trap and inform messages coming into the router. An SNMP notification event is generated when an incoming SNMP trap or inform message matches specified values or crosses specified thresholds.
The SNMP and the SNMP server manager must be configured and enabled prior to the use of the snmp-notification event detector.
An EEM event is triggered when one of the fields specified by an SNMP notification object ID crosses a defined threshold. If multiple conditions exist, the SNMP notification event is triggered when all the conditions are met.
An OID is defined as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value. Monitoring of some OID types is supported. When the oid keyword is used, an error message is returned if the OID is not one of the following:
- INTEGER_TYPE
- COUNTER_TYPE
- GAUGE_TYPE
- TIME_TICKS_TYPE
- COUNTER_64_TYPE
- OCTET_PRIM_TYPE
- OPAQUE_PRIM_TYPE
When the op keyword is used and there is a match, an event is triggered and event monitoring is disabled until the exit criteria are met.
The operatorargument takes one of the following values:
- gt --Greater than.
- ge --Greater than or equal to.
- eq --Equal to.
- ne --Not equal to.
- lt --Less than.
- le --Less than or equal to.
Examples
The following example shows how to configure the snmp-server community public RW and snmp-server manager commands before event snmp-notification is configured.
Router(config)# snmp-server community public RW Router(config)# snmp-server managerThe following example shows how an EEM applet called SNMP_Notification is being registered to run an EEM script when the router receives an SNMP notification on destination IP address 192.168.1.1 for object OID 1 whose value equals 10.
Router(config)# event manager applet SNMP_Notification Router(config-applet)# event snmp-notification dest-ip-address 192.168.1.1 oid 1 op eq oid-val 10 Router(config-applet)# action 1 policy eem_scriptThe following example shows how to intercept an outgoing SNMP trap with the OID 1.3.6.1.4.1.318.2.3.3 and OID value of "UPS: Returned from battery backup power", drop the message and send out a different one.
Router(config)# event manager applet SNMP_Notification Router(config-applet)# event snmp-notification dest_ip_address 192.168.1.1 oid 1.3.6.1.4.1.318.2.3.3 op eq oid-value "UPS: Returned from battery backup power" direction outgoing msg-op dropevent snmp-object
To register the Simple Network Management Protocol (SNMP) object event for an Embedded Event Manager (EEM) applet that is run by sampling the SNMP object, use the event snmp-object command in applet configuration mode. To remove the SNMP object event criteria, use the no form of this command.
event snmp-object oid oid-value type value sync { yes | no } skip { yes | no } istable { yes | no } [ default seconds ] [ maxrun maxruntime-number ]
no event snmp-object
Syntax Description
oid
Specifies the SNMP object identifier (object ID).
oid-value
Object ID value of the data element in SNMP dotted notation. An OID is defined as a type in the associated MIB, CISCO-EMBEDDED-EVENT-MGR-MIB, and each type has an object value.
type value
Specifies the type of object. The following values are valid:
- counter --A 32-bit number with a minimum value of 0. When the maximum value is reached, the counter resets to 0.
- counter64 --A 64-bit number with a minimum value of 0. When the maximum value is reached, the counter resets to 0.
- gauge --A 32-bit number with a minimum value of 0. For example, the interface speed on a router is measured using a gauge object type.
- int --A 32-bit number used to specify a numbered type within the context of a managed object. For example, to set the operational status of a router interface, 1 represents up and 2 represents down.
- ipv4 --IP version 4 address.
- octet --An octet string in hex notation used to represent physical addresses.
- oid --Object identifier value.
- string --An octet string in text notation used to represent text strings.
- uint --A 32-bit number used to represent decimal value.
sync
Specifies the SNMP and EEM policy execution.
- no --Policy and SNMP will run asynchronously.
- yes --Run policy and the result determines whether to run SNMP request.
skip
Mandatory if sync is set to no and should not be used if sync is yes. Specifies whether to skip CLI command execution.
- no --CLI command should be executed.
- yes --CLI command should not be executed.
istable
(Optional) Specifies whether the OID is a SNMP table.
- yes --OID is an SNMP table.
- no --IOD is not an SNMP table.
default
(Optional) The time period during which the SNMP Object event detector waits for the policy to exit.
seconds
(Optional) Number that represents seconds and optional milliseconds in the format ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.
maxrun
(Optional) Specifies the maximum runtime of the applet.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds between 0 and 999. The default value is 20 seconds.
Usage Guidelines
Use the event snmp-object command to register the SNMP object event for an EEM applet that is run by sampling SNMP object.
event syslog
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by matching syslog messages, use the event syslogcommand in applet configuration mode. To remove the syslog message event criteria, use the no form of this command.
event [ tag event-tag ] syslog pattern regular-expression [ occurs num-occurrences ] [ period period-value ] [ priority priority-level ] [severity-level] [ maxrun maxruntime-number ]
no event [ tag event-tag ] syslog pattern regular-expression [ occurs num-occurrences ] [ period period-value ] [ priority priority-level ] [severity-level] [ maxrun maxruntime-number ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
pattern
Specifies that a regular expression is used to perform the syslog message pattern match.
regular-expression
String value that is the pattern to be matched.
occurs
(Optional) Specifies the number of matching occurrences before an EEM event is triggered. If a number is not specified, an EEM event is triggered after the first match.
num-occurrences
(Optional) Integer in the range of 1 to 32, inclusive.
period
(Optional) Specifies the time interval during which the one or more occurrences must take place. If the period keyword is not specified, no time-period check is applied.
period-value
(Optional) Number that represents seconds and optional milliseconds in the format ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.
priority
(Optional) Specifies the priority level of the syslog messages to be screened. If this keyword is selected, the priority-level argument must be defined. If this keyword is not specified, the software will use the default of priority all, and all priorities will be considered when log messages are screened.
priority-level
(Optional) Number or name of the desired priority level against which syslog messages are matched. Messages at or numerically lower than the specified level are matched.
Valid levels for the priority-level argument are as follows (enter the keyword or number, if available):
- all --All priorities are considered when log messages are screened.
- {0 | emergencies}--System is unusable.
- {1 | alerts}--Immediate action is needed.
- {2 | critical}--Critical conditions.
- {3 | errors}--Error conditions.
severity-level
(Optional) Specifies the severity level of the syslog messages to be screened. If no severity level is specified, the software will not use any severity filtering and all events will be considered when log messages are screened.
The severity-level argument may be one or more of the following keywords:
- severity-critical --Critical conditions.
- severity-debugging --Debugging messages.
- severity-fatal --Fatal conditions.
- severity-major --Major conditions.
- severity-minor --Minor conditions.
- severity-normal --Normal conditions.
- severity-notification --Significant conditions.
- severity-warning --Warning conditions.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).
Command History
Release
Modification
12.0(26)S
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
12.3(14)T
Optional severity-level keywords were added.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The tag and maxrun keywords were added were added to support multiple event statements within an applet.
Usage Guidelines
Use the event syslog command to set up event criteria against which syslog messages are matched. Syslog messages are compared against a specified regular expression. After a specified number of matches occurs within a specified time period, an EEM event is triggered. If multiple conditions exist, the EEM event is triggered when all the conditions are met.
Valid levels for the priority-level argument are as follows (enter the keyword or number, if available):
- all --All priorities are considered when log messages are screened.
- {0 | emergencies}--System is unusable.
- {1 | alerts}--Immediate action is needed.
- {2 | critical}--Critical conditions.
- {3 | errors}--Error conditions.
- {4 | warnings}--Warning conditions.
- {5 | notifications}--Normal but significant conditions.
- {6 | informational}--Informational messages.
- {7 | debugging}--Debugging messages.
The severity-level argument may be one or more of the following keywords:
- severity-critical --Critical conditions.
- severity-debugging --Debugging messages.
- severity-fatal --Fatal conditions.
- severity-major --Major conditions.
- severity-minor --Minor conditions.
- severity-normal --Normal conditions.
- severity-notification --Significant conditions.
- severity-warning --Warning conditions.
Examples
The following example shows how to specify an EEM applet to run when syslog identifies that Ethernet interface 1/0 is down. The applet sends a message about the interface to syslog.
Router(config)# event manager applet interface-down Router(config-applet)# event syslog pattern {.*UPDOWN.*Ethernet1/0.*} occurs 4event timer
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of time-specific events, use the event timercommand in applet configuration mode. To remove the time-specific event criteria, use the no form of this command.
event [ tag event-tag ] timer { absolute time time-value | countdown time time-value | cron cron-entry cron-entry | watchdog time time-value } [ name timer-name ]
no event [ tag event-tag ] timer { absolute time time-value | countdown time time-value | cron cron-entry cron-entry | watchdog time time-value } [ name timer-name ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
absolute
Specifies that an event is triggered when the specified absolute time of day occurs.
time
Specifies the time interval during which the event must take place.
time-value
Integer that specifies, in seconds and optional milliseconds, the time interval during which the event must take place. The range for seconds is from 0 to 4294967295 and the range for milliseconds is from 0 to 999. The format is ssssss[.mmm]. When only milliseconds are specified, use the format 0.mmm.
countdown
Specifies that an event is triggered when the specified time counts down to zero. The timer does not reset.
cron
Specifies that an event is triggered when the CRON string specification matches the current time.
cron-entry
Specifies the first five fields of a UNIX crontab entry as used with the UNIX CRON daemon.
cron-entry
Text string that consists of five fields separated by spaces. The fields represent the times and dates when CRON timer events will be triggered. Fields and corresponding values are as follows:
- minute --A number in the range from 0 to 59 that specifies when a CRON timer event is triggered.
- hour --A number in the range from 0 to 23 that specifies when a CRON timer event is triggered.
- day-of-month --A number in the range from 1 to 31 that specifies the day of the month when a CRON timer event is triggered.
- month --A number in the range from 1 to 12 or the first three letters (not case-sensitive) of the name of the month in which a CRON timer event is triggered.
- day-of-week --A number in the range from 0 to 6 (Sunday is 0) or the first three letters (not case-sensitive) of the name of the day when a CRON timer event is triggered.
Instead of the first five fields, special strings can be entered. See the “Usage Guidelines” section for details.
watchdog
Specifies that an event is triggered when the specified time counts down to zero. The timer automatically resets to the initial value and continues to count down.
name
(Optional) Specifies that the timer is named.
timer-name
(Optional) Name of the timer.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).
Command History
Release
Modification
12.2(25)S
This command was introduced.
12.3(14)T
This command was integrated into Cisco IOS Release 12.3(14)T.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The tag and maxrun keywords were added were added to support multiple event statements within an applet.
Usage Guidelines
For the cron-entryargument, the following special strings also are allowed in syntax:
- Range of numbers--The specified range is inclusive, and a hyphen separates the numbers. For example, 8-11 after the hour field specifies execution of a CRON timer event at hours 8, 9, 10, and 11.
- Asterisk (*)--Indicates that a field is not specified and can be any value.
- List--A list is a set of numbers or ranges separated by a comma but no space. For example, 1,2,5,9 or 0-4,8-12.
- Step value in conjunction with a range--Following a range with /number specifies skips of the number value through the range. For example, 0-23/2 in the hour field specifies that an event is triggered every second hour. Steps are permitted after an asterisk, for example */2 means every two hours.
Instead of the five fields of a UNIX crontab entry for the cron-entry argument, one of the following seven special strings can be entered:
- @yearly --An event is triggered once a year. This is the equivalent of specifying 0 0 1 1 * for the first five fields.
- @annually --Same as @yearly.
- @monthly --An event is triggered once a month. This is the equivalent of specifying 0 0 1 * * for the first five fields.
- @weekly --An event is triggered once a week. This is the equivalent of specifying 0 0 * * 0 for the first five fields.
- @daily --An event is triggered once a day. This is the equivalent of specifying 0 0 * * * for the first five fields.
- @midnight --Same as @daily.
- @hourly --An event is triggered once an hour. This is the equivalent of specifying 0 * * * * for the first five fields.
A CRON timer may not produce the intended result if the time-of-day clock is not set to the correct time. Network Time Protocol (NTP) services can be used to facilitate keeping an accurate time-of-day clock setting. For more details on NTP configuration, see the “Performing Basic System Management” chapter of the Cisco IOS Network Management Configuration Guide , Release 12.4.
Examples
The following example shows how to specify that an event is triggered one time after 5 hours:
Router(config)# event manager applet timer-absolute Router(config-applet)# event timer absolute time 18000The following example shows how to specify that an event is triggered once after 6 minutes and 6 milliseconds:
Router(config)# event manager applet timer-set Router(config-applet)# event timer countdown time 360.006 name six-minutesThe following example shows how to specify that an event is triggered at 1:01 a.m. on January 1 each year:
Router(config)# event manager applet timer-cron1 Router(config-applet)# event timer cron cron-entry 1 1 1 1 * name Jan1The following example shows how to specify that an event is triggered at noon on Monday through Friday of every week:
Router(config)# event manager applet timer-cron2 Router(config-applet)# event timer cron cron-entry 0 12 * * 1-5 name MonFriThe following example shows how to specify that an event is triggered at midnight on Sunday every week:
Router(config)# event manager applet timer-cron3 Router(config-applet)# event timer cron cron-entry @weekly name SundayThe following example shows how to specify that an event is triggered every 5 hours:
Router(config)# event manager applet timer-watch Router(config-applet)# event timer watchdog time 18000event track
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of a Cisco IOS Object Tracking subsystem report for the specified object number, use the event track command in applet configuration mode. To remove the report event criteria, use the no form of this command.
event [label] [ tag event-tag ] track object-number [ state { up | down | any } ] [ maxrun maxruntime-number ]
no event [label] [ tag event-tag ] track object-number [ state { up | down | any } ] [ maxrun maxruntime-number ]
Syntax Description
tag
(Optional) Specifies a tag using the event-tag argument that can be used with the trigger command to support multiple event statements within an applet.
event-tag
(Optional) String that identifies the tag.
label
(Optional) Unique identifier that can be any string. If the string contains embedded blanks, enclose it in double quotation marks.
object-number
Tracked object number in the range from 1 to 500, inclusive. The number is defined using the track stub command.
state
(Optional) Specifies that the tracked object transition will cause an event to be raised.
up
(Optional) Specifies that an event will be raised when the tracked object transitions from a down state to an up state.
down
(Optional) Specifies that an event will be raised when the tracked object transitions from an up state to a down state.
any
(Optional) Specifies that an event will be raised when the tracked object transitions to or from any state. This is the default.
maxrun
(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.
maxruntime-number
(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).
Command History
Release
Modification
12.4(2)T
This command was introduced.
12.2(31)SB3
This command was integrated into Cisco IOS Release 12.2(31)SB3.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
12.4(20)T
The tag and maxrunkeywords were added to support multiple event statements within an applet.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
There are two entry variables associated with this command:
- _track_number--Number of the tracked object that caused the event to be triggered.
- _track_state--State of the tracked object when the event was triggered; valid states are “up” or “down.”
This command is used to help track objects using EEM. Each tracked object is identified by a unique number that is specified on the tracking command-line interface (CLI). Client processes such as EEM use this number to track a specific object. The tracking process periodically polls the tracked objects and notes any change of value. The changes in the tracked object are communicated to interested client processes, either immediately or after a specified delay. The object values are reported as either up or down.
Examples
The following example shows how to specify event criteria based on a tracked object:
event manager applet track-ten event track 10 state any action 1.0 track set 10 state up action 2.0 track read 10Related Commands
Command
Description
action track read
Specifies the action of reading the state of a tracked object when an EEM applet is triggered.
action track set
Specifies the action of setting the state of a tracked object when an EEM applet is triggered.
event manager applet
Registers an event applet with the Embedded Event Manager and enters applet configuration mode.
show track
Displays tracking information.
track stub
Creates a stub object to be tracked.
event wdsysmon
To specify the event criteria for an Embedded Event Manager (EEM) applet that is run on the basis of Cisco IOS Software Modularity watchdog system monitor (WDSysMon) counters crossing a threshold, use the event wdsysmoncommand in applet configuration mode. To remove the event criteria, use the no form of this command.
event wdsysmon sub1 subevent1 [ timewin timewin-value ] [ sub12-op { and | or | andnot } sub2 subevent2 ] [ node node-name ]
no event wdsysmon sub1 subevent1 [ timewin timewin-value ] [ sub12-op { and | or | andnot } sub2 subevent2 ] [ node node-name ]
Subevent Syntax (for the subevent1 and subevent2 Arguments)
cpu-proc procname process-name op operator val value [ period period-value ]
cpu-tot op operator val value [ period period-value ]
deadlock procname process-name
dispatch-mgr procname process-name op operator val value [ period period-value ]
mem-proc procname process-name op operator val value [ is-percent { true | false } ] [ period period-value ]
mem-tot-avail op operator val value [ is-percent { true | false } ] [ period period-value ]
mem-tot-used op operator val value [ is-percent { true | false } ] [ period period-value ]
Syntax Description
sub1
Specifies the first subevent.
subevent1
First subevent. Use one of the seven forms of syntax shown above under the Subevent Syntax heading.
timewin
(Optional) Specifies the time window within which all the subevents must occur for an event to be generated.
timewin-value
(Optional) Number that represents seconds and optional milliseconds in the format ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.
sub12-op
(Optional) Indicates the combination operator for comparison between subevent 1 and subevent 2.
and
(Optional) Specifies that the results of both subevent 1 and subevent 2 must cross the specified thresholds.
or
(Optional) Specifies that the results of either subevent 1 or subevent 2 must cross the specified thresholds.
andnot
(Optional) Specifies that the results from subevent 1 must cross the specified threshold and the results from subevent 2 must not cross the specified threshold.
sub2
(Optional) Specifies the second subevent.
subevent2
(Optional) Second subevent. Use one of the seven forms of syntax shown above under the Subevent Syntax heading.
node
(Optional) Specifies the node.
node-name
(Optional) Node name.
Subevent Syntax
cpu-proc
Specifies the use of a sample collection of CPU process statistics.
cpu-tot
Specifies the use of a sample collection of CPU total statistics.
deadlock
Specifies the use of a sample collection of deadlock statistics.
dispatch-mgr
Specifies the use of a sample collection of dispatch manager statistics.
mem-proc
Specifies the use of a sample collection of process memory statistics.
mem-tot-avail
Specifies the use of a sample collection of total available memory statistics.
mem-tot-used
Specifies the use of a sample collection of total used memory statistics.
procname
Specifies a Cisco IOS Software Modularity process name.
process-name
Name of the Software Modularity process to be monitored. If the process name contains embedded blanks, enclose it in double quotation marks.
op
Compares the collected CPU, deadlock, dispatch manager, or memory statistics sample with the value specified in the value argument. If there is a match, the subevent is triggered.
operator
Two-character string. The operator argument takes one of the following values:
val
Specifies the value with which the collected CPU, deadlock, dispatch manager, or memory statistics sample is compared to decide if the subevent should be raised.
value
Number in the range from 1 to 4294967295.
period
(Optional) Specifies the elapsed time period for the collection samples to be averaged.
period-value
(Optional) Number that represents seconds and optional milliseconds in the format ssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If only milliseconds are used, the format is 0.mmm. If the time period is 0, the most recent sample is used.
is-percent
(Optional) Indicates whether the value argument is a percentage.
true
(Optional) Specifies that the value argument is a percentage.
false
(Optional) Specifies that the value argument is not a percentage.
Command Default
No EEM events are triggered on the basis of Cisco IOS Software Modularity WDSysMon counters.
Usage Guidelines
An EEM event is triggered when one of the Cisco IOS Software Modularity WDSysMon counters crosses a defined threshold. Depending on the operator, the threshold may be crossed when the value is greater than the threshold or when the value is less than the threshold.
Examples
The following example shows how to configure a Cisco IOS Software Modularity policy to trigger an applet when the total amount of memory used by the process named “tcp.proc” has increased by more than 50 percent over the sample period of 60 seconds:
Router(config)# event manager applet WD_Sample Router(config-applet)# event wdsysmon sub1 mem-proc procname “tcp.proc” op gt val 50 is-percent true period 60 Router(config-applet)# action 1 syslog msg “WD_Sample Policy Triggered”
