Event Commands

action (EEM)

To match a regular expression pattern on an input string, to specify the action of writing a message to syslog, and to specify the action of reloading the Cisco IOS software when an Embedded Event Manager (EEM) applet is triggered, use the action command in applet configuration mode. To disable this function, use the no form of this command.

action label { regexp string-submatch | | reload | | syslog msg msg-text | | wait wait-interval | else | break | continue | elseif | while | set | increment | handle-error | gets | foreach | divide | decrement | counter | append }

no action label

Syntax Description

label

Unique identifier that can be any string value. Actions are sorted and run in ascending alphanumeric key sequence using the label as the sort key. If the string contains embedded blanks, enclose it in double quotation marks.

string-submatch

(Optional) The variable name to store any submatches that are present. A maximum of three submatch strings can be specified.

msg

Specifies the message to be logged.

msg-text

Character text, an environment variable, or a combination of the two. If the string contains embedded blanks, enclose it in double quotation marks.

Note

 

Messages written to syslog from an EEM applet are not screened for EEM syslog events, which may lead to recursive EEM syslog events. Messages sent from an EEM applet include the applet name for identification.

wait-interval

The wait interval range is from 1 to 31536000.

else

Identifies the else conditional action block. If a statement is not associated with this applet, events are still triggered without any action or result.

break

Causes an immediate exit from a loop of actions. Skips all the actions down to the related end action.

continue

Causes the loop to continue with the next iteration.

elseif

Identifies the beginning of an elseif conditional action block when an EEM applet is triggered.

while

Identifies the while conditional action block when an EEM applet is triggered.

set

Sets the value of a variable when an EEM applet is triggered.

increment

Increments the value of the variable with the long integer specified.

handle-error

Specifies the error.

gets

Specifies an input from the local tty in a synchronous applet and stores the value in the given variable when an EEM applet is triggered

foreach

Specifies the iteration of an input string using the delimiter as a tokenizing pattern.

divide

Specifies the dividend value by the given divisor value when an EEM applet is triggered.

decrement

Decrements the value of the variable with the integer specified.

counter

Specifies the counter to be set or modified.

append

Appends the given string value to the current value of the variable specified.

Command Default

No messages are written to syslog.

No reload of the Cisco IOS software is performed.

No regular expression patterns are matched.

Command Modes

Applet configuration (config-applet)

Command History

Release

Modifications

Cisco IOS XE Catalyst SD-WAN Release 17.7.1a

This command was introduced.

Cisco IOS XE Catalyst SD-WAN Release 17.14.1a

The EEM configurations such as else, break, continue, elseif, while, set, increment, handle-error, gets, foreach, divide, decrement, counter, and append are supported.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE action (EEM) commands.

Use the action else command to identify the else conditional action block. If a statement is not associated with this applet, events are still triggered without any action or result. A warning message stating that no statements are associated with this applet is displayed at the exit time of the configuration.

The following example shows how to specify a message to be sent to syslog when the memory-fail applet is triggered:

Device(config)# event manager applet memory-fail
Device(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op lt entry-val 5120000 poll-interval 10
Device(config-applet)# action 4.0 syslog msg "Memory exhausted; current available memory is $_snmp_oid_val bytes"

The following example shows how to reload the Cisco IOS software when the memory-fail applet is triggered:

Device(config)# event manager applet memory-fail
Device(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op lt entry-val 5120000 poll-interval 10
Device(config-applet)# action 3.0 reload

The following example shows how to define a regular expression match:

Device(config-applet)# event manager applet regexp
Device(config-applet)# event none
Device(config-applet)# action 1 regexp "(.*) (.*) (.*)" "one two three" _match _sub1

The following example shows how to configure an EEM applet to break from a loop of actions:


Device(config)# event manager applet loop
Device(config-applet)# event none
Device(config-applet)# action 1 while 1 eq 1
Device(config-applet)# action 2 break
Device(config-applet)# action 3 end

The following example shows how to configure an EEM applet to continue from a loop of actions:


Device(config)# event manager applet loop
Device(config-applet)# event none
Device(config-applet)# action 2 continue
Device(config-applet)# action 3 end

The following example shows how to identify the beginning of an else action block:


Device(config)# event manager applet loop
Device(config-applet)# event none
Device(config-applet)# action label2 else
Device(config-applet)# action 3 end

The following example shows how to identify the beginning of the elseif conditional action block.

Device(config)# event manager applet action 
Device(config-applet)# event none
Device(config-applet)# action 1.0 set x "5" 
Device(config-applet)# action 2.0 if $x lt 3
Device(config-applet)# action 3.0  puts "$x is less than 3"
Device(config-applet)# action 4.0 elseif $x lt 10
Device(config-applet)# action 5.0  puts "$x is less than 10"
Device(config-applet)# action 6.0 end
Device(config)# event manager run action 5 is less than 10

event ipsla

To publish an event when an IP SLAs operation is triggered for an Embedded Event Manager (EEM) applet, use the eventipsla command in the applet configuration mode. To disable publishing events when an IP SLAs reaction gets triggered, use the no form of this command.

event ipsla [ group-name name ] [ maxrun maxruntime-number ] [ ratelimit ratelimit-number ] [ reaction-type type ]

no event ipsla

Syntax Description

group-name

Specifies the IP SLAs group ID.

name

Name of the IP SLAs group.

reaction-type

(Optional) Specifies the reaction to be taken for the specified IP SLAs operation.

type

(Optional) Type of IP SLAs reaction. One of the following keywords can be specified:

  • connectionLoss : Specifies that a reaction should occur if there is a one-way connection loss for the monitored operation.

  • icpif : Specifies that a reaction should occur if the one-way Calculated Planning Impairment Factor (ICPIF) value violates the upper threshold or lower threshold.

  • jitterAvg : Specifies that a reaction should occur if the average round-trip jitter value violates the upper threshold or lower threshold.

  • jitterDSAvg : Specifies that a reaction should occur if the average one-way destination-to-source jitter value violates the upper threshold or lower threshold.

  • jitterSDAvg : Specifies that a reaction should occur if the average one-way source-to-destination jitter value violates the upper threshold or lower threshold.

  • maxOfNegativeDS : Specifies that a reaction should occur if the one-way maximum negative jitter destination-to-source threshold is violated.

  • maxOfNegativeSD : Specifies that a reaction should occur if the one-way maximum negative jitter source-to-destination threshold is violated.

  • maxOfPositiveDS : Specifies that a reaction should occur if the one-way maximum positive jitter destination-to-source threshold is violated.

  • maxOfPositiveSD : Specifies that a reaction should occur if the one-way maximum positive jitter source-to-destination threshold is violated.

  • mos : Specifies that a reaction should occur if the one-way Mean Opinion Score (MOS) value violates the upper threshold or lower threshold.

  • packetLateArrival : Specifies that a reaction should occur if the one-way number of late packets violates the upper threshold or lower threshold.

  • packetLossDS : Specifies that a reaction should occur if the one-way destination-to-source packet loss value violates the upper threshold or lower threshold.

  • packetLossSD : Specifies that a reaction should occur if the one-way source-to-destination packet loss value violates the upper threshold or lower threshold.

  • packetMIA : Specif ies that a reaction should occur if the one-way number of missing packets violates the upper threshold or lower threshold.

  • packetOutOfSequence : Specifies that a reaction should occur if the one-way number of packets out of sequence violates the upper threshold or lower threshold.

  • rtt : Specifies that a reaction should occur if the round-trip time violates the upper threshold or lower threshold.

  • timeout : Specifies that a reaction should occur if there is a one-way timeout for the monitored operation.

  • verifyError : Specifies that a reaction should occur if there is a one-way error verification violation.

maxrun

(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number

(Optional) Number of seconds specified in ssssssss [mmm ] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds from 0 to 999.

ratelimit

(Optional) Specifies the ratelimit time interval of the applet. If the ratelimit keyword is specified, the ratelimit-number value must be specified.

ratelimit-number

(Optional) Number of seconds specified in ssssssss [mmm ] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds from 0 to 999.

Command Default

No events are published when IP SLAs operations are triggered.

Command Modes

Applet configuration (config-applet)

Command History

Release

Modification

Cisco IOS XE Catalyst SD-WAN Release 17.7.1a

This command was introduced.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event ipsla command.

The following example shows how to publish an event when an IP SLAs operation is triggered:

Device# config-transaction
Device(config)# event manager applet EventIPSLA
Device(config-applet)#  event ipsla group-name grp1 reaction-type timeout maxrun 3

event manager applet

To register an applet with the Embedded Event Manager (EEM) and to enter applet configuration mode, use the event manager applet command in global configuration mode. To unregister the applet, use the no form of the command.

event manager applet applet-name [ authorization bypass ]

no event manager applet

Syntax Description

applet-name

Name of the applet file.

authorization

(Optional) Specifies AAA authorization type for applet.

bypass

(Optional) Specifies EEM AAA authorization type bypass.

Command Default

No EEM applets are registered.

Command Modes

Global configuration (config)

Command History

Release Modification

Cisco IOS XE Catalyst SD-WAN Release 17.4.1a

This command was introduced.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event manager applet command.

The following example shows how to register an applet with the name one and class A and enter applet configuration mode where the timer event detector is set to trigger an event every 10 seconds. When the event is triggered, the action syslog command writes the message “hello world” to syslog:


Device(config)# event manager applet one class A
Device(config-applet)# event timer watchdog time 10
Device(config-applet)# action syslog syslog msg "hello world"
Device(config-applet)# exit

The following example shows how to bypass the AAA authorization when registering an applet with the name one and class A.


Device(config)# event manager applet one class A authorization bypass
Device(config-applet)#

event manager session cli username

To associate a username with Embedded Event Manager (EEM) policies that use the CLI library, use the event manager session cli username command in global configuration mode. To remove the username association with EEM policies that use the CLI library, use the no form of the command.

event manager session cli username username privilege privilege-level

no event manager session cli

Syntax Description

username

Username assigned to EEM CLI sessions that are initiated by EEM policies.

privilege privilege-level

Sets the privilege level for the user. Range: 0 to 15. Default is 1.

Command Modes

Global configuration (config)

Command Default

No username is associated with EEM CLI sessions.

Command History

Release Modification

Cisco IOS XE Catalyst SD-WAN Release 17.4.1a

This command was introduced.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event manager session cli username command.

The following example of the event manager session cli username command associates the username eemuser with EEM CLI sessions initiated by EEM policies:


Device(config)# event manager session cli username eemuser

event none

To specify that an Embedded Event Manager (EEM) policy is to be registered with the EEM and can be run manually, use the event none command in applet configuration mode. To remove the event none command from the configuration file, use the no form of the command.

event none [ maxrun maxruntime-number ] [ ratelimit ratelimit-number ]

no event none

Syntax Description

maxrun

(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number

(Optional) Number of seconds specified in ssssssss.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).

ratelimit

(Optional) Specifies the ratelimit time interval of the applet. If the ratelimit keyword is specified, the ratelimit-number value must be specified.

ratelimit-number

(Optional) Number of seconds specified in ssssssss [mmm ] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds from 0 to 999.

Command History

Release Modification

Cisco IOS XE Catalyst SD-WAN Release 17.7.1a

This command was introduced.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event none command.

The following example shows how to register a policy named manual-policy to be run manually and then how to execute the policy:


Device(config)# event manager applet manual-policy 
Device(config-applet)# event none 
Device(config-applet)# exit 
Device# event manager run manual-policy 

event routing

To publish an event when route entries change in Routing Information Base (RIB) infrastructure, use the event routing command in applet configuration mode. To stop publishing events when route entries change in RIB, use the no form of the command.

event routing network ip-address / length [ type { add | all | modify | remove } ] [ maxrun maxruntime-number ] [ ratelimit ratelimit-number ]

no event routing

Syntax Description

network

Specifies the network ip address and length, whose route is to be monitored.

ip-address / length

The ip address and length of the network to be monitored. For example, 192.0.2.4/8.

type

(Optional) Specifies the desired policy trigger. The default is all .

add

Specifies that an entry is added to the routing table.

all

Specifies that a routing table entry is added, removed, or modified.

modify

Specifies that an entry in the routing table is modified.

remove

Specifies that an entry is removed from the routing table

maxrun

(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number

(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds from 0 to 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999.

ratelimit

(Optional) Specifies the ratelimit time interval of the applet. If the ratelimit keyword is specified, the ratelimit-number value must be specified.

ratelimit-number

(Optional) Number of seconds specified in ssssssss [mmm ] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds from 0 to 999.

Command Default

By default, no events are published when route entries change in RIB infrastructure.

Command Modes

Applet configuration (config-applet)

Command History

Release Modification

Cisco IOS XE Catalyst SD-WAN Release 17.7.1a

This command was introduced.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event routing command.

The following example shows how a specific route entries change when many parameters are monitored:

Device# configure terminal
Device(config)# event manager applet EventRouting
Device(config-applet)# event routing network 192.0.2.4/8 type add maxrun 56
The following example shows the output for the Cisco IOS version that uses the old routing API (v1.0):

Device# show event manager detector routing
No. Name 	Version    Node       Type    
1   routing     01.00     node0/0     RP      
The following example shows the output for the Cisco IOS version that uses the new routing API (v2.0):

Device# show event manager detector routing
No. Name 	Version    Node       Type    
1   routing     02.00     node0/0     RP 

event syslog

To specify the event criteria for an Embedded Event Manager (EEM) applet that is run by matching syslog messages, use the event syslog command in applet configuration mode. To remove the syslog message event criteria, use the no form of the command.

event syslog [ pattern regular-expression ] [ occurs num-occurrences ] [ period period-value ] [ ratelimit ratelimit-number ] [ maxrun maxruntime-number ]

no event syslog

Syntax Description

pattern

Specifies that a regular expression is used to perform the syslog message pattern match.

regular-expression

String value that is the pattern to be matched.

occurs

(Optional) Specifies the number of matching occurrences before an EEM event is triggered. If a number is not specified, an EEM event is triggered after the first match.

num-occurrences

(Optional) Integer in the range of 1 to 32, inclusive.

period

(Optional) Specifies the time interval during which the one or more occurrences must take place. If the period keyword is not specified, no time-period check is applied.

period-value

(Optional) Number that represents seconds and optional milliseconds in the format ssssssssss[.mmm]. The range for seconds is from 0 to 4294967295. The range for milliseconds is from 0 to 999. If using milliseconds only, specify the milliseconds in the format 0.mmm.

maxrun

(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number

(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).

ratelimit

(Optional) Specifies the ratelimit time interval of the applet. If the ratelimit keyword is specified, the ratelimit-number value must be specified.

ratelimit-number

(Optional) Number of seconds specified in ssssssss [mmm ] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds from 0 to 999.

Command Default

No EEM events are triggered on the basis of matches with syslog messages.

Command Modes

Applet configuration (config-applet)

Command History

Release Modification

Cisco IOS XE Catalyst SD-WAN Release 17.7.1a

This command was introduced.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event syslog command.

The following example shows how to specify an EEM applet to run when the syslog identifies that Ethernet interface 1/0 is down. The applet sends a message about the interface to the syslog.

Device(config)# event manager applet interface-down 
Device(config-applet)#  event syslog pattern {.*UPDOWN.*Ethernet1/0.*} occurs 4  

event timer

To specify the event criteria for an Embedded Event Manager (EEM) applet that is run based on time-specific events, use the event timer command in applet configuration mode. To remove the time-specific event criteria, use the no form of this command.

event timer { cron [ cron-entry cron-entry | maxrun maxrun-number | name timer-name | ratelimit ratelimit-number ] | watchdog [ maxrun maxrun-number | name timer-name | ratelimit ratelimit-number | time time-value ] }

no event timer

Syntax Description

cron

Specifies that an event is triggered when the CRON string specification matches the current time.

cron-entry

Specifies the first five fields of a UNIX crontab entry as used with the UNIX CRON daemon.

cron-entry

Text string that consists of five fields separated by spaces. The fields represent the times and dates when CRON timer events will be triggered. Fields and corresponding values are as follows:

  • minute : A number in the range from 0 to 59 that specifies when a CRON timer event is triggered.

  • hour : A number in the range from 0 to 23 that specifies when a CRON timer event is triggered.

  • day-of-month : A number in the range from 1 to 31 that specifies the day of the month when a CRON timer event is triggered.

  • month : A number in the range from 1 to 12 or the first three letters (not case-sensitive) of the name of the month in which a CRON timer event is triggered.

  • day-of-week : A number in the range from 0 to 6 (Sunday is 0) or the first three letters (not case-sensitive) of the name of the day when a CRON timer event is triggered.

Instead of the first five fields, special strings can be entered. See the “Usage Guidelines” section for details.

watchdog

Specifies that an event is triggered when the specified time counts down to zero. The timer automatically resets to the initial value and continues to count down.

name

(Optional) Specifies that the timer is named.

timer-name

(Optional) Name of the timer.

maxrun

(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number

(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).

ratelimit

(Optional) Specifies the ratelimit time interval of the applet. If the ratelimit keyword is specified, the ratelimit-number value must be specified.

ratelimit-number

(Optional) Number of seconds specified in ssssssss [mmm ] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds from 0 to 999.

time

Specifies the time interval during which the event must take place.

time-value

Integer that specifies, in seconds and optional milliseconds, the time interval during which the event must take place. The range for seconds is from 0 to 4294967295 and the range for milliseconds is from 0 to 999. The format is ssssss[.mmm]. When only milliseconds are specified, use the format 0.mmm.

Command Default

No EEM events are triggered on the basis of time-specific events.

Command Modes

Applet configuration

Command History

Release Modification

Cisco IOS XE Catalyst SD-WAN Release 17.7.1a

This command was introduced.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event timer command.

The following example shows how to specify that an event is triggered at 1:01 a.m. on January 1 each year:


Device(config)# event manager applet timer-cron1
Device(config-applet)# event timer cron cron-entry 1 1 1 1 * name Jan1

The following example shows how to specify that an event is triggered at noon on Monday through Friday of every week:


Device(config)# event manager applet timer-cron2
Device(config-applet)# event timer cron cron-entry 0 12 * * 1-5 name MonFri

The following example shows how to specify that an event is triggered at midnight on Sunday every week:


Device(config)# event manager applet timer-cron3
Device(config-applet)# event timer cron cron-entry @weekly name Sunday

The following example shows how to specify that an event is triggered every 5 hours:


Device(config)# event manager applet timer-watch
Device(config-applet)# event timer watchdog time 18000 

event track

To specify the event criteria for an Embedded Event Manager (EEM) applet that is run based on a Cisco IOS Object Tracking subsystem report for the specified object number, use the event track command in applet configuration mode. To remove the report event criteria, use the no form of this command.

event track object-number [ state { up | down | any } ] [ maxrun maxruntime-number ] [ ratelimit ratelimit-number ]

no event track object-number

Syntax Description

object-number

Tracked object number in the range from 1 to 500, inclusive. The number is defined using the track stub command.

state

(Optional) Specifies that the tracked object transition will cause an event to be raised.

up

(Optional) Specifies that an event will be raised when the tracked object transitions from a down state to an up state.

down

(Optional) Specifies that an event will be raised when the tracked object transitions from an up state to a down state.

any

(Optional) Specifies that an event will be raised when the tracked object transitions to or from any state. This is the default.

maxrun

(Optional) Specifies the maximum runtime of the applet. If the maxrun keyword is specified, the maxruntime-number value must be specified. If the maxrun keyword is not specified, the default applet run time is 20 seconds.

maxruntime-number

(Optional) Number of seconds specified in ssssssss[.mmm] format, where ssssssss must be an integer representing seconds between 0 and 31536000, inclusive, and where mmm must be an integer representing milliseconds between 0 and 999).

ratelimit

(Optional) Specifies the ratelimit time interval of the applet. If the ratelimit keyword is specified, the ratelimit-number value must be specified.

ratelimit-number

(Optional) Number of seconds specified in ssssssss [mmm ] format, where ssssssss must be an integer representing seconds from 0 to 31536000, and where mmm must be an integer representing milliseconds from 0 to 999.

Command Default

No EEM event criteria are specified.

Command Modes

Applet configuration (config-applet)

Command History

Release Modification

Cisco IOS XE Catalyst SD-WAN Release 17.7.1a

Command qualified for use in Cisco SD-WAN Manager CLI templates.

Usage Guidelines

For usage guidelines, see the Cisco IOS XE event track command.

The following example shows how to specify event criteria based on a tracked object:


Device(config)# event manager applet track-ten
Device(config-applet)# event track 10 state any
Device(config-applet)# action 1.0 track set 10 state up
Device(config-applet)# action 2.0 track read 10