Feedback
Contents
S through Z Commands
S through Z Commands
set (EEM)
NoteEffective with Cisco IOS Release 12.4(22)T, the set (EEM) command is replaced by the action set(EEM) command. See the action set (EEM) command for more information.
To set the value of a local Embedded Event Manager (EEM) applet variable, use the setcommand in applet configuration mode. To remove the value of an EEM applet variable, use the no form of this command.
Syntax Description
label
Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in double quotation marks.
variable-name
The EEM applet variable name. Currently only the _exit_status variable is supported.
variable-value
Integer value that represents the variable. For the _exit_status variable, this is the value that represents the exit status for the applet. Zero represents a successful exit status, and a nonzero value represents a failed exit status.
Command History
Release
Modification
12.3(14)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(22)T
This command was replaced by the action set command.
Usage Guidelines
In EEM applet configuration mode, three types of configuration statements are supported. The event commands are used to specify the event criteria to trigger the applet to run, the action commands are used to specify an action to perform when the EEM applet is triggered, and the set command is used to set the value of an EEM applet variable. Currently only the _exit_status variable is supported for the set command.
Examples
The following example shows how to set the _exit_status variable to represent a successful status after an event has occurred three times and an action has been performed:
Router(config)# event manager applet cli-match Router(config-applet)# event cli pattern {.*interface loopback*} sync yes occurs 3 Router(config-applet)# action 1.0 cli command "no shutdown" Router(config-applet)# set 1.0 _exit_status 0show event manager detector
To display information about Embedded Event Manager (EEM) event detectors, use the show event manager detector command in privileged EXEC mode.
Syntax Description
Usage Guidelines
Use the show event manager detector command to display information about EEM event detectors. The all keyword displays information about all event detectors. The detailed keyword displays detailed information, including:
- The event registration syntax for the Tool Command Language (Tcl) policies.
- The available array variables for the Tcl policies after event_reqinfo() is called.
- The event registration syntax for applet policies.
- The built-in variables available when an applet policy is triggered by this event detector.
Examples
The following is sample output from the show event manager detector command specifying the counter value:
Router# show event manager detector counter No. Name Version Node Type 1 counter 01.00 node5/1 RP Router# show event manager detector counter detailed No. Name Version Node Type 1 counter 01.00 node5/1 RP Tcl Configuration Syntax: ::cisco::eem::event_register_counter [tag <tag-val>] name <counter-name> entry_val <entry-val> entry_op {gt | ge | eq | ne | lt | le} exit_val <exit-val> exit_op {gt | ge | eq | ne | lt | le} [queue_priority {normal | low | high | last}] [maxrun <sec.msec>] [nice {0 | 1}] Tcl event_reqinfo Array Names: event_id event_type event_type_string event_pub_time event_pub_sec event_pub_msec event_severity name value Applet Configuration Syntax: [ no ] event [tag <tag-val>] counter name <counter-name> entry-val <entry-val> entry-op {gt | ge | eq | ne | lt | le} exit-val <exit-val> exit-op {gt | ge | eq | ne | lt | le} [maxrun <sec.msec>] Applet Built-in Environment Variables: $_event_id $_event_type $_event_type_string $_event_pub_time $_event_pub_sec $_event_pub_msec $_event_severity $_counter_name $_counter_valueThe table below describes the significant fields shown in the display.
show event manager directory user
To display the directory to use for storing user library files or user-defined Embedded Event Manager (EEM) policies, use the show event manager directory user command in privileged EXEC mode.
Command History
Release
Modification
12.3(14)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
Use the event manager directory user command to specify the directory to use for storing user library or user policy files.
show event manager environment
To display the name and value of Embedded Event Manager (EEM) environment variables, use the show event manager environment command in privileged EXEC mode.
Command Default
If no argument or keyword is specified, information for all environment variables is displayed.
Command History
Release
Modification
12.2(25)S
This command was introduced.
12.3(14)T
This command was integrated into Cisco IOS Release 12.3(14)T.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Examples
The following is sample output from the show event manager environmentcommand:
Router# show event manager environment No. Name Value 1 _cron_entry 0-59/1 0-23/1 * * 0-7 2 _show_cmd show version 3 _syslog_pattern .*UPDOWN.*Ethernet1/0.* 4 _config_cmd1 interface Ethernet1/0 5 _config_cmd2 no shutdownThe table below describes the significant fields shown in the display.
show event manager history events
To display the Embedded Event Manager (EEM) events that have been triggered, use the show event manager history events command in privileged EXEC mode.
Command History
Release
Modification
12.2(25)S
This command was introduced.
12.3(14)T
This command was integrated into Cisco IOS Release 12.3(14)T.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The output was modified to include the Job ID and Status fields.
Usage Guidelines
Use the show event manager history events command to track information about the EEM events that have been triggered.
Examples
The following is sample output from the show event manager history eventscommand showing that two types of events, Simple Network Management Protocol (SNMP) and application, have been triggered.
Router# show event manager history events No. Time of Event Event Type Name 1 Fri Aug13 21:42:57 2004 snmp applet: SAAping1 2 Fri Aug13 22:20:29 2004 snmp applet: SAAping1 3 Wed Aug18 21:54:48 2004 snmp applet: SAAping1 4 Wed Aug18 22:06:38 2004 snmp applet: SAAping1 5 Wed Aug18 22:30:58 2004 snmp applet: SAAping1 6 Wed Aug18 22:34:58 2004 snmp applet: SAAping1 7 Wed Aug18 22:51:18 2004 snmp applet: SAAping1 8 Wed Aug18 22:51:18 2004 application applet: CustApp1The following is sample output from the show event manager history eventscommand that includes the Job ID and Status fields:
Router# show event manager history events No. Job ID Status Time of Event Event Type Name 1 1 success Thu Sep 7 02:54:04 2006 syslog applet: two 2 2 success Thu Sep 7 02:54:04 2006 syslog applet: three 3 3 success Thu Sep 7 02:54:04 2006 syslog applet: four 4 4 abort Thu Sep 7 02:54:04 2006 syslog applet: five 5 5 abort Thu Sep 7 02:54:04 2006 syslog applet: six 6 6 abort Thu Sep 7 02:54:04 2006 syslog applet: seven 7 7 abort Thu Sep 7 02:54:04 2006 syslog applet: eight 8 8 cleared Thu Sep 7 02:54:04 2006 syslog applet: nine 9 9 cleared Thu Sep 7 02:54:04 2006 syslog applet: ten 10 10 cleared Thu Sep 7 02:54:04 2006 syslog applet: elevenThe following is sample output from the show event manager history eventscommand using the detailed keyword:
Router# show event manager history events detailed No. Job ID Status Time of Event Event Type Name 1 1 success Thu Sep 7 02:54:04 2006 syslog applet: two msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 2 2 success Thu Sep 7 02:54:04 2006 syslog applet: three msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 3 3 success Thu Sep 7 02:54:04 2006 syslog applet: four msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 4 4 abort Thu Sep 7 02:54:04 2006 syslog applet: five msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 5 5 abort Thu Sep 7 02:54:04 2006 syslog applet: six msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 6 6 abort Thu Sep 7 02:54:04 2006 syslog applet: seven msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 7 7 cleared Thu Sep 7 02:54:04 2006 syslog applet: eight msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 8 8 cleared Thu Sep 7 02:54:04 2006 syslog applet: nine msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 9 9 cleared Thu Sep 7 02:54:04 2006 syslog applet: ten msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console} 10 10 success Thu Sep 7 02:54:04 2006 syslog applet: eleven msg {23:13:29: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console}The table below describes the significant fields shown in the displays.
show event manager history traps
To display the Embedded Event Manager (EEM) Simple Network Management Protocol (SNMP) traps that have been sent, use the show event manager history traps command in privileged EXEC mode.
Command History
Release
Modification
12.2(25)S
This command was introduced.
12.3(14)T
This command was integrated into Cisco IOS Release 12.3(14)T.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
Use the show event manager history traps command to identify whether the SNMP traps were implemented from the EEM server or from an EEM policy.
Examples
The following is sample output from the show event manager history trapscommand:
Router# show event manager history traps policy No. Time Trap Type Name 1 Wed Aug18 22:30:58 2004 policy EEM Policy Director 2 Wed Aug18 22:34:58 2004 policy EEM Policy Director 3 Wed Aug18 22:51:18 2004 policy EEM Policy DirectorThe table below describes the significant fields shown in the display.
show event manager metric processes
To display Embedded Event Manager (EEM) reliability metric data for Cisco IOS Software Modularity processes, use the show event manager metric processescommand in privileged EXEC mode.
Usage Guidelines
Use this command to display the reliability metric data for Cisco IOS Software Modularity processes. The system keeps a record of when processes start and end, and this data is used as the basis for reliability analysis.
The information provided by this command allows you to get availability information for a process or group of processes. A process is considered available when it is running.
Examples
The following is partial sample output from the show event manager metric processescommand. In this partial example, the first and last entries showing the metric data for the processes on all the cards inserted in the system are displayed.
Router# show event manager metric processes all ===================================== node name: node0 process name: devc-pty, instance: 1 sub_system: 0, version: 00.00.0000 -------------------------------- last event type: process start recent start time: Fri Oct10 20:34:40 2003 recent normal end time: n/a recent abnormal end time: n/a number of times started: 1 number of times ended normally: 0 number of times ended abnormally: 0 most recent 10 process start times: -------------------------- Fri Oct10 20:34:40 2003 -------------------------- most recent 10 process end times and types: cumulative process available time: 6 hours 30 minutes 7 seconds 378 milliseconds cumulative process unavailable time: 0 hours 0 minutes 0 seconds 0 milliseconds process availability: 0.100000000 number of abnormal ends within the past 60 minutes (since reload): 0 number of abnormal ends within the past 24 hours (since reload): 0 number of abnormal ends within the past 30 days (since reload): 0 . . . ===================================== node name: node0 process name: cdp2.iosproc, instance: 1 sub_system: 0, version: 00.00.0000 -------------------------------- last event type: process start recent start time: Fri Oct10 20:35:02 2003 recent normal end time: n/a recent abnormal end time: n/a number of times started: 1 number of times ended normally: 0 number of times ended abnormally: 0 most recent 10 process start times: -------------------------- Fri Oct10 20:35:02 2003 -------------------------- most recent 10 process end times and types: cumulative process available time: 6 hours 29 minutes 45 seconds 506 milliseconds cumulative process unavailable time: 0 hours 0 minutes 0 seconds 0 milliseconds process availability: 0.100000000 number of abnormal ends within the past 60 minutes (since reload): 0 number of abnormal ends within the past 24 hours (since reload): 0 number of abnormal ends within the past 30 days (since reload): 0The table below describes the significant fields shown in the display.
Table 5 show event manager metric processes Field Descriptions Field
Description
node name
Node name.
process name
Software Modularity process name.
instance
Instance number of the Software Modularity process.
sub_system
Subsystem number.
version
Version number.
show event manager policy active
To display Embedded Event Manager (EEM) policies that are executing, use the show event manager policy active command in privileged EXEC mode.
show event manager policy active [ queue-type { applet | call-home | axp | script } | class class-options | detailed ]
Syntax Description
Examples
The following is sample output from the show event manager policy activecommand that includes the priority, scheduler node, and event type fields:
Router# show event manager policy active no. job id p s status time of event event type name 1 1 N A wait Wed Oct8 21:45:10 2008 syslog continue.tcl 2 12609 N A running Mon Oct29 20:49:42 2007 timer watchdog loop.tclThe table below describes the significant fields shown in the displays.
show event manager policy available
To display Embedded Event Manager (EEM) policies that are available to be registered, use the show event manager policy available command in privileged EXEC mode.
show event manager policy available [ description [policy-name] | [ detailed policy-filename ] [ system | user ] ]
Syntax Description
description
(Optional) Specifies a brief description of the available policy.
policy-name
(Optional) Name of the policy.
detailed
(Optional) Displays the actual sample policy for the specified policy-filename.
policy-filename
(Optional) Name of sample policy to be displayed.
system
(Optional) Displays all available system policies.
user
(Optional) Displays all available user policies.
Command Default
If no keyword is specified, information for all available system and user policies is displayed.
Command History
Release
Modification
12.2(25)S
This command was introduced.
12.3(14)T
The user keyword was added, and this command was integrated into Cisco IOS Release 12.3(14)T.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
The detailed keyword and the policy-filename argument were added, and this command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The output was modified to display bytecode scripts with a file extension of .tbc.
15.0(1)M
The command was modified. The description keyword and policy-name argument were added.
Usage Guidelines
This command is useful if you forget the exact name of a policy required for the event manager policy command.
The detailed keyword displays the actual specified sample policy. Use description policy-name to describe a policy. If policy-name is not specified, the output of show command displays the description of all the available policies.
In Cisco IOS Release 12.4(20)T, EEM 2.4 introduced bytecode support to allow storage of Tcl scripts in bytecode format, and the output of this command was modified to display files with a .tbc extension as well as the usual .tcl extension for Tcl scripts.
Examples
The following is sample output from the show event manager policy availablecommand:
Router# show event manager policy available No. Type Time Created Name 1 system Tue Sep 12 09:41:32 2002 sl_intf_down.tcl 2 system Tue Sep 12 09:41:32 2002 tm_cli_cmd.tclThe table below describes the fields shown in the display.
Table 7 show event manager policy available Field Descriptions Field
Description
No.
Index number automatically assigned to the policy.
Type
Indicates whether the policy is a system policy.
Time Created
Time stamp indicating the date and time when the policy file was created.
Name
Name of the EEM policy file.
The following is sample output from the show event manager policy availablecommand with the detailed keyword and a policy name specified:
Router# show event manager policy available detailed tm_cli_cmd.tcl ::cisco::eem::event_register_timer cron name crontimer2 cron_entry $_cron_entry maxrun 240 #------------------------------------------------------------------ # EEM policy that will periodically execute a cli command and email the # results to a user. # # July 2005, Cisco EEM team # # Copyright (c) 2005 by cisco Systems, Inc. # All rights reserved. #------------------------------------------------------------------ ### The following EEM environment variables are used: ### ### _cron_entry (mandatory) - A CRON specification that determines ### when the policy will run. See the ### IOS Embedded Event Manager ### documentation for more information ### on how to specify a cron entry. ### Example: _cron_entry 0-59/1 0-23/1 * * 0-7 ### ### _email_server (mandatory) - A Simple Mail Transfer Protocol (SMTP) ### mail server used to send e-mail. ### Example: _email_server mailserver.customer.com ###The following is sample output from the show event manager policy availablecommand showing a Tcl script with a .tcl filename extension and a bytecode script with a filename extension of .tbc. This example is for a Cisco IOS Release 12.4(20)T or later image.
Router# show event manager policy available No. Type Time Created Name 1 system Tue Jun 10 09:41:32 2008 sl_intf_down.tcl 2 system Tue Jun 10 09:41:32 2008 tm_cli_cmd.tbcshow event manager policy pending
To display Embedded Event Manager (EEM) policies that are pending for execution, use the show event manager policy pending command in privileged EXEC mode.
show event manager policy pending [ queue-type { applet | call-home | axp | script } | class class-options | detailed ]
Syntax Description
Command History
Release
Modification
12.2(25)S
This command was introduced.
12.3(14)T
This command was integrated into Cisco IOS Release 12.3(14)T.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
12.4(20)T
The output was modified to include the Job ID and Status fields.
12.4(22)T
This command is supported with new options to qualify the policy queues reported in the output display and provides detailed policy information.
Usage Guidelines
Pending policies are policies that are pending execution in the EEM server execution queue. When an event is triggered, the policy that is registered to handle the event is queued for execution in the EEM server. Use the show event manager policy pending command to display the policies in this queue and to view the policy details.
Examples
The following is sample output from the show event manager policy pendingcommand:
Router# show event manager policy pending no. job id p s status time of event event type name 1 12851 N A pend Mon Oct29 20:51:18 2007 timer watchdog loop.tcl 2 12868 N A pend Mon Oct29 20:51:24 2007 timer watchdog loop.tcl 3 12873 N A pend Mon Oct29 20:51:27 2007 timer watchdog loop.tcl 4 12907 N A pend Mon Oct29 20:51:41 2007 timer watchdog loop.tcl 5 13100 N A pend Mon Oct29 20:52:55 2007 timer watchdog loop.tclThe table below describes the significant fields shown in the displays.
show event manager policy registered
To display Embedded Event Manager (EEM) policies that are already registered, use the show event manager policy registered command in privileged EXEC mode.
show event manager policy registered [ description [policy-name] | detailed policy-filename [ system | user ] | [ event-type event-name ] [ system | user ] [ time-ordered | name-ordered ] ]
Syntax Description
Command Default
If this command is invoked with no optional keywords, it displays all registered EEM system and user policies for all event types. The policies are displayed according to the time at which they were registered.
Command History
Release
Modification
12.0(26)S
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
12.3(14)T
Additional event types and the user keyword were added, and this command was integrated into Cisco IOS Release 12.3(14)T.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
The detailed keyword and the policy-filename argument were added, and this command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
15.0(1)M
This command was modified. The description keyword and the policy-name argument were added.
Usage Guidelines
The output shows registered policy information in two parts. The first line in each policy description lists the index number assigned to the policy, the policy type (system), the type of event registered, the time when the policy was registered, and the name of the policy file. The remaining lines of each policy description display information about the registered event and how the event is to be handled; the information comes directly from the Tool Command Language (Tcl) command arguments that make up the policy file. Output of the show event manager policy registered command is most helpful to persons who are writing and monitoring EEM policies.
The detailed keyword displays the actual specified sample policy including details about the environment variables used by the policy and instructions for running the policy.
Examples
The following is sample output from the show event manager policy registeredcommand:
Router# show event manager policy registered No. Class Type Event Type Trap Time Registered Name 1 applet system snmp Off Fri Aug 13 17:42:52 2004 IPSLAping1 oid {1.3.6.1.4.1.9.9.42.1.2.9.1.6.4} get-type exact entry-op eq entry-val {1} exit-op eq exit-val {2} poll-interval 5.000 action 1.0 syslog priority critical msg Server IPecho Failed: OID=$_snmp_oid_val action 1.1 snmp-trap strdata EEM detected server reachability failure to 10.1.88.9 action 1.2 publish-event sub-system 88000101 type 1 arg1 10.1.88.9 arg2 IPSLAEcho arg3 fail action 1.3 counter name _IPSLA1F value 1 op incThe table below describes the significant fields shown in the display.
Table 9 show event manager policy registered Field Descriptions Field
Description
No.
Index number automatically assigned to the policy.
Class
Class of policy, either applet or script.
Type
Identifies whether the policy is a system policy.
Event Type
Type of event.
Trap
Identifies whether an SNMP trap is enabled.
Time Registered
Time stamp indicating the day, date, and time when the policy file was registered.
Name
Name of the EEM policy file.
The following is sample output from the show event manager policy registeredcommand showing the use of the detailed keyword for the policy named tm_cli_cmd.tcl:
Router# show event manager policy registered detailed tm_cli_cmd.tcl ::cisco::eem::event_register_timer cron name crontimer2 cron_entry $_cron_entry maxrun 240 #------------------------------------------------------------------ # EEM policy that will periodically execute a cli command and email the # results to a user. # # July 2005, Cisco EEM team # # Copyright (c) 2005 by cisco Systems, Inc. # All rights reserved. #------------------------------------------------------------------ ### The following EEM environment variables are used: ### ### _cron_entry (mandatory) - A CRON specification that determines ### when the policy will run. See the ### IOS Embedded Event Manager ### documentation for more information ### on how to specify a cron entry. ### Example: _cron_entry 0-59/1 0-23/1 * * 0-7 ### ### _email_server (mandatory) - A Simple Mail Transfer Protocol (SMTP) ### mail server used to send e-mail. ### Example: _email_server mailserver.example.com ###show event manager scheduler
To display the schedule activities of the scheduled Embedded Event Manager (EEM) policies, use the show event manager scheduler command in privileged EXEC mode.
Syntax Description
thread
Specifies the thread for the scheduler.
queue-type
(Optional) Specifies the queue type of the EEM policy.
applet
(Optional) Specifies EEM applet policy.
call-home
(Optional) Specifies EEM Call-Home policy.
axp
(Optional) Specifies EEM axp policy.
script
(Optional) Specifies EEM script policy.
detailed
(Optional) Specifies the detailed content of the EEM policies.
Usage Guidelines
Use the show event manager scheduler commandto show the EEM’s scheduler activities. This command shows all the EEM execution threads from the scheduler perspective and the details of the running policies.
You can specify one or all of the following options: applet, call-home, axp, script, and detailed.
Examples
The following is sample output from the show event manager schedulercommand:
Router# show event manager scheduler thread 1 Script threads service class default total: 1 running: 1 idle: 0 2 Script threads service class range A-D total: 3 running: 0 idle: 3 3 Applet threads service class default total: 32 running: 0 idle: 32 4 Applet threads service class W X total: 5 running: 0 idle: 5 Router# show event manager scheduler script thread detailed 1 Script threads service class default total: 1 running: 1 idle: 0 1 job id: 1, pid: 215, name: continue.tcl 2 Script threads service class range A-D total: 3 running: 0 idle: 3 3 Applet threads service class default total: 32 running: 0 idle: 32 4 Applet threads service class W X total: 5 running: 0 idle: 5show event manager session cli username
To display the username associated with Embedded Event Manager (EEM) policies that use the command-line interface (CLI) library, use the show event manager session cli username command in privileged EXEC mode.
Command History
Release
Modification
12.3(14)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(18)SXF4
This command was integrated into Cisco IOS Release 12.2(18)SXF4 to support Software Modularity images only.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF5
This command was integrated into Cisco IOS Release 12.2(18)SXF5.
12.2SX
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
Use this command to display the username associated with a Tool Command Language (Tcl) EEM policy. If you are using authentication, authorization, and accounting (AAA) security and implement authorization on a command basis, you should use the event manager session cli username command to set a username to be associated with a Tcl session. The username is used when a Tcl policy executes a CLI command. TACACS+ verifies each CLI command using the username associated with the Tcl session that is running the policy. Commands from Tcl policies are not usually verified because the router must be in privileged EXEC mode to register the policy.
show event manager statistics
To track and display statistics including dropped events of Embedded Event Manager (EEM) policies, use the show event manager statistics command in privileged EXEC mode.
Usage Guidelines
Use the show event manager statistics command to display statistic including dropped events.
Examples
The following example shows the statistics of all the event detectors:
Router# show event manager statistics detector Triggered Dropped No. Name Node Type Events Events ----------------------------------------------------------------- 1 application node0/0 RP 0 0 2 rf node0/0 RP 0 0 3 identity node0/0 RP 0 0 4 neighbor-discovery node0/0 RP 0 0 5 routing node0/0 RP 0 0 6 nhrp node0/0 RP 0 0 7 track node0/0 RP 0 0 8 resource node0/0 RP 0 0 9 syslog node0/0 RP 0 0 10 cli node0/0 RP 0 0 11 counter node0/0 RP 0 0 12 interface node0/0 RP 0 0 13 ioswdsysmon node0/0 RP 0 0 14 none node0/0 RP 0 0 15 oir node0/0 RP 0 0 16 snmp node0/0 RP 0 0 17 snmp-object node0/0 RP 0 0 18 ipsla node0/0 RP 0 0 19 snmp-notification node0/0 RP 0 0 20 timer node0/0 RP 0 0 21 test node0/0 RP 0 0 22 config node0/0 RP 0 0 23 env node0/0 RP 0 0 24 nf node0/0 RP 0 0 25 rpc node0/0 RP 0 0The following example shows the statistics of all the servers:
Router# show event manager statistics server Triggered Dropped Queue Queue Average Client Events Events Size Max Run Time ---------------------------------------------------------------------- Call Home 0 0 0 64 0.000 EEM Applets 0 0 0 64 0.000 EEM IOS .sh Scripts 0 0 0 128 0.000 EEM Tcl Scripts 0 0 0 64 0.000 EEM Policy Counters Name Value ------------------------------------------------------------------ count2 0 counter1 0 EEM Policy Timers Name Type Time Remaining ------------------------------------------------------------------ EEMinternalname0 watchdog 19.460 crontimer cron N/A EEM User Context ------------------------------------------------------------------ Key: keyname Value: <first 1k of context value.>show event manager version
To display the version of Embedded Event Manager (EEM) software running on the device, use the show event manager versioncommand in privileged EXEC mode.
Usage Guidelines
Use the show event manager version command to display details about the EEM software running on the device. The following values are listed:
Examples
The following is sample output from the show event manager version command:
Router#show event manager version Embedded Event Manager Version 2.40 Component Versions: eem: (v240_throttle)2.21.49 eem-gold: (v240_throttle)1.2.34 eem-call-home: (v240_throttle)2.0.0 Event Detectors: Name Version Node Type appl 01.00 node0/0 RP syslog 01.00 node0/0 RP track 01.00 node0/0 RP cli 01.00 node0/0 RP counter 01.00 node0/0 RP interface 01.00 node0/0 RP ioswdsysmon 01.00 node0/0 RP none 01.00 node0/0 RP oir 01.00 node0/0 RP snmp 01.00 node0/0 RP snmp-notification 01.00 node0/0 RP timer 01.00 node0/0 RP test 01.00 node0/0 RP config 01.00 node0/0 RP env 01.00 node0/0 RPThe table below describes the significant fields shown in the display.
Table 10 show event manager version Field Descriptions Field
Description
Embedded Event Manager Version 2.40
Version of EEM software.
Component Versions:
Software components.
Event Detectors
Each available event detector.
Name
Name of the event detector.
Version
Version number.
Node
Node name.
Type
Where the event detector resides.
appl
Application event detector.
syslog
Syslog event detector.
track
Track event detector.
cli
Command-line interface (CLI) event detector.
counter
Counter event detector.
interface
Interface event detector.
ioswdsysmon
Watchdog system monitor event detector.
none
No event detector.
oir
Online insertion and removal (OIR) event detector.
snmp
Simple Network Management Protocol (SNMP) event detector.
snmp-notification
SNMP notification event detector.
timer
Timer event detector.
test
Test event detector.
config
Config event detector.
env
Environmental event detector.
track stub-object
To create a stub object that can be tracked by Embedded Event Manager (EEM) and to enter tracking configuration mode, use the track stub-object command in global configuration mode. To remove the stub object, use the no form of this command.
Command History
Release
Modification
12.4(2)T
This command was introduced.
12.2(31)SB3
This command was integrated into Cisco IOS Release 12.2(31)SB3.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Cisco IOS XE Release 2.1
This command was integrated into Cisco IOS XE Release 2.1.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
15.1(3)T
This command was modified. The valid range of the object-number argument increased to 1000.
15.1(1)S
This command was modified. The valid range for the object-number argument increased to 1000.
Usage Guidelines
Use the track stub-object command to create a stub object, which is an object that can be tracked and manipulated by an external process, EEM. After the stub object is created, the default-state command can be used to set the default state of the stub object.
EEM is a distributed, scalable, and customized approach to event detection and recovery offered directly in a Cisco IOS device. EEM offers the ability to monitor events and take informational or corrective action when the monitored events occur or when a threshold is reached. An EEM policy is an entity that defines an event and the actions to be taken when that event occurs.
As of Cisco IOS Release 15.1(3)T, a maximum of 1000 objects can be tracked. Although 1000 tracked objects can be configured, each tracked object uses CPU resources. The amount of available CPU resources on a router is dependent upon variables such as traffic load and how other protocols are configured and run. The ability to use 1000 tracked objects is dependent upon the available CPU. Testing should be conducted on site to ensure that the service works under the specific site traffic conditions.
trigger (EEM)
To enter trigger applet configuration mode and specify the multiple event configuration statements for an Embedded Event Manager (EEM) applet, use the triggercommand in applet configuration mode. To disable the multiple event configuration statements, use the no form of this command.
trigger [ occurs occurs-value ] [ period period-value ] [ period-start period-start-value ] [ delay delay-value ]
no trigger [ occurs occurs-value ] [ period period-value ] [ period-start period-start-value ] [ delay delay-value ]
Syntax Description
occurs
(Optional) Specifies the number of times the total correlation occurs before an EEM event is raised. When a number is not specified, an EEM event is raised on the first occurrence.
occurs-value
(Optional) Number in the range from 1 to 4294967295.
period
(Optional) Specifies the time interval during which the one or more occurrences must take place. If not specified, the time-period check is not applied.
period-value
(Optional) Number that represents seconds and optional milliseconds in the format ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.
period-start
(Optional) Specifies the start of an event correlation window. If not specified, event monitoring is enabled after the first CRON period occurs.
period-start-value
(Optional) String that specifies the beginning of an event correlation window.
delay
(Optional) Specifies the number of seconds after which an event will be raised if all the conditions are true. If not specified, the event will be raised immediately.
delay-value
(Optional) Number that represents seconds and optional milliseconds in the format ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.
Usage Guidelines
The trigger command relates multiple event statements using the optional tag keyword with the event-tag argument specified in each event statement.
Examples
The following example shows how to use the trigger command to enter trigger applet configuration mode and specify multiple event configuration statements for an EEM applet. In this example, the applet is run when the show bgp all command and any syslog message that contains the string “COUNT” occurs within a period of 60 seconds.
Router(config)# event manager applet delay_50 Router(config-applet)# event tag 1.0 cli pattern "show bgp all" sync yes occurs 32 period 60 maxrun 60 Router(config-applet)# event tag 2.0 syslog pattern "COUNT" Router(config-applet)# trigger occurs 1 delay 50 Router(config-applet-trigger)# correlate event 1.0 or event 2.0 Router(config-applet-trigger)# attribute tag 1.0 occurs 1 Router(config-applet-trigger)# attribute tag 2.0 occurs 1 Router(config-applet-trigger)# action 1.0 cli command "show memory" Router(config-applet)# action 2.0 cli command "enable" Router(config-applet)# action 3.0 cli command "config terminal" Router(config-applet)# action 4.0 cli command " ip route 192.0.2.0 255.255.255.224 192.0.2.12" Router(config-applet)# action 91.0 cli command "exit" Router(config-applet)# action 99.0 cli command "show ip route | incl 192.0.2.5"
