About the EEM
The EEM service enables you to debug problems and provides general purpose logging for troubleshooting. There are two components: events to which the EEM responds or listens, and event manager applets that define actions as well as the events to which the EEM responds. You may configure multiple event manager applets to respond to different events and perform different actions.
Supported Events
The EEM supports the following events:
-
Syslog—The ASA uses syslog message IDs to identify syslog messages that trigger an event manager applet. You may configure multiple syslog events, but the syslog message IDs may not overlap within a single event manager applet.
-
Timers—You may use timers to trigger events. You may configure each timer only once for each event manager applet. Each event manager applet may have up to three timers. The three types of timers are the following:
-
Watchdog (periodic) timers trigger an event manager applet after the specified time period following the completion of the applet actions and restart automatically.
-
Countdown (one-shot) timers trigger an event manager applet once after the specified time period and do not restart unless they are removed, then re-added.
-
Absolute (once-a-day) timers cause an event to occur once a day at a specified time, and restart automatically. The time-of-day format is in hh:mm:ss.
You may configure only one timer event of each type for each event manager applet.
-
-
None—The none event is triggered when you run an event manager applet manually using the CLI or ASDM.
-
Crash—The crash event is triggered when the ASA crashes. In some scenarios, a force crash is triggered:
If ASA is configured to reload on block depletion, and when ASA remains out of memory for a configured duration, it sends out syslog and collects troubleshoot data. ASA force crashes and triggers the reload process to release the memory block. In a HA setup, under such cases, failover is triggered. On a cluster setup, the node leaves the cluster.
Regardless of the value of the output command, the action commands are directed to the crashinfo file. The output is generated before the show tech command.
Actions on Event Manager Applets
When an event manager applet is triggered, the actions on the event manager applet are performed. Each action has a number that is used to specify the sequence of the actions. The sequence number must be unique within an event manager applet. You may configure multiple actions for an event manager applet. The commands are typical CLI commands, such as show blocks .
Output Destinations
You may send the output from the actions to a specified location using the output command. Only one output value may be enabled at any one time. The default value is output none . This value discards any output from the action commands. The command runs in global configuration mode as a user with privilege level 15 (the highest). The command may not accept any input, because it is disabled. You may send the output of the action CLI commands to one of three locations:
-
None, which is the default and discards the output
-
Console, which sends the output to the ASA console
-
File, which sends the output to a file. The following four file options are available:
-
Create a unique file, which creates a new, uniquely named file each time that an event manager applet is invoked
-
Create/overwrite a file, which overwrites a specified file each time that an event manager applet is invoked.
-
Create/append to a file, which appends to a specified file each time that an event manager applet is invoked. If the file does not yet exist, it is created.
-
Create a set of files, which creates a set of uniquely named files that are rotated each time that an event manager applet is invoked.
-