EEM Applets for Automation

EEM Applets for Automation and AI - CCNP ENCOR Guide

Understanding EEM Applets for Automation

EEM (Embedded Event Manager) is a powerful automation feature in Cisco IOS that allows network administrators to monitor events and automatically execute actions in response to those events. EEM Applets are simple scripts that define this event-action relationship without requiring extensive programming knowledge.

Why EEM Applets Are Important

In modern networking, automation is critical for reducing manual intervention, improving network stability, and responding quickly to network events. EEM Applets are important because they:

• Reduce Manual Intervention: Automatically respond to network issues without administrator involvement
• Improve Network Stability: Execute corrective actions immediately when problems are detected
• Enable Proactive Monitoring: Monitor system health, interface status, and performance metrics continuously
• Lower Operational Costs: Minimize downtime by automating recovery procedures
• Provide Flexibility: Create custom responses to specific network conditions
• Support Self-Healing Networks: Enable devices to remediate issues without human intervention

What Are EEM Applets?

An EEM Applet is a simple, script-based automation tool that consists of two main components:

1. Event Detector: Monitors the network device for specific conditions or events. Common event detectors include:

• Syslog events - Triggered when specific log messages appear
• SNMP traps - Triggered when SNMP trap conditions occur
• Interface events - Triggered when interface status changes (up/down)
• Timer events - Triggered at specific time intervals
• Routing events - Triggered by routing table changes
• Environmental events - Triggered by temperature, power supply, or fan failures
• CLI events - Triggered when specific commands are executed

2. Action List: Defines what actions the device should take when the event is detected. Common actions include:

• Execute CLI commands - Run IOS commands automatically
• Send notifications - Send syslog messages or SNMP traps
• Reload the router - Perform device restart
• Generate logs - Document the event and actions taken
• Run scripts - Execute TCL scripts for complex operations
• Send email or trap - Notify administrators of issues

How EEM Applets Work

Step 1: Event Detection
The EEM Applet monitors the device continuously for the specified event. When the event occurs, the event detector triggers the applet.

Step 2: Condition Evaluation
If conditions are specified, EEM evaluates whether they are met. This allows for more granular control over when actions should execute.

Step 3: Action Execution
Once the event is detected and conditions are satisfied, EEM executes the defined actions in the order specified.

Step 4: Logging and Notification
The applet logs the event and actions taken, which can be viewed in system logs or sent as notifications.

Example Workflow:
Device detects interface goes down → EEM Applet triggers → Applet checks if interface is critical → Applet sends alert to administrator → Applet attempts automatic recovery → Actions are logged

Common EEM Applet Use Cases

1. Interface Monitoring:
Automatically log when an interface goes down and send notifications to administrators.

2. Memory Monitoring:
Trigger actions when available memory drops below a threshold, such as reloading the router during low-traffic hours.

3. CPU Monitoring:
Execute commands to investigate high CPU usage when thresholds are exceeded.

4. Log-Based Automation:
Respond automatically to specific error messages in syslog, such as tackling authentication failures.

5. Scheduled Actions:
Execute configuration changes or backups at specified times using timer events.

6. BGP Monitoring:
Detect BGP neighbor state changes and automatically take corrective actions.

EEM Applet Configuration Basics

EEM Applets are configured using the CLI with a simple syntax:

event manager applet <applet_name>
event <event_detector> [event_parameters]
action <action_number> cli command <command>

Key Configuration Commands:

• event manager applet: Define a new EEM applet with a unique name
• event: Specify the event detector and associated parameters
• action: Define the action to execute with a numerical priority
• correlate: Define event correlation rules for complex scenarios
• exit: Complete the applet configuration

Practical EEM Applet Example

Consider this example of an interface monitoring applet:

event manager applet Interface_Down
event syslog pattern "LINEPROTO-5-UPDOWN"
action 1 cli command "enable"
action 2 cli command "config terminal"
action 3 syslog msg "CRITICAL: Interface down event detected"
action 4 cli command "exit"

This applet:

• Monitors syslog for interface state changes
• Enters enable mode
• Logs the event with a critical severity message
• Exits configuration mode

Types of EEM Events

Syslog Events: Monitor system logs for specific patterns and keywords. Most flexible for detecting various conditions.

SNMP Events: Respond to SNMP trap conditions from the device or external sources.

Interface Events: Detect interface state transitions (up to down or vice versa).

Timer Events: Execute actions at specific times or intervals for scheduled automation.

Environmental Events: Monitor device health including temperature, power supplies, and fan status.

Routing Events: Detect changes in routing table, including neighbor state changes.

Counter Events: Monitor interface counters like errors, drops, or CRC failures.

How to Answer EEM Applet Exam Questions

Question Type 1: Identifying When to Use EEM
Approach: Look for scenarios requiring automated response to network events. EEM is ideal for continuous monitoring and automatic action execution without human intervention.

Key indicators: "automatically," "respond to," "monitoring," "trigger," "event-based"

Question Type 2: Selecting the Correct Event Detector
Approach: Match the monitoring requirement to the appropriate detector type. For interface status: use interface events. For error messages: use syslog. For scheduled tasks: use timer events.

Common mistakes: Confusing SNMP events with syslog events, or using timers when monitoring specific conditions.

Question Type 3: Determining Appropriate Actions
Approach: Select actions that address the root cause or mitigate the impact. Actions should be proportionate to the severity of the event.

Example: For a memory threshold event, actions might include: investigate process usage, clear buffers, or schedule a reload.

Question Type 4: Understanding Event-Action Relationships
Approach: Understand that events trigger applets, and multiple actions execute sequentially. Each action has a priority number that determines execution order.

Question Type 5: Scenario-Based Questions
Approach: Break down the scenario into components: What needs monitoring? What should trigger? What should happen? Match these to EEM concepts.

Exam Tips: Answering Questions on EEM Applets for Automation

Tip 1: Know the Event-Action Model
Remember that EEM operates on a simple principle: Event Detection → Condition Check → Action Execution. When reading questions, identify which part you're being asked about.

Tip 2: Understand Event Detector Types
Be familiar with common detectors: syslog patterns are most flexible, interface events detect up/down transitions, timer events are for scheduled tasks, and environmental events monitor device health. The exam will likely test your ability to select the right detector for a scenario.

Tip 3: Action Sequence and Numbering
Actions execute in numerical order. If a question asks about action priority or sequence, remember that lower numbers execute first. Actions are often numbered 1, 2, 3, etc.

Tip 4: Recognize Automation Use Cases
EEM is used for self-healing networks, reducing manual work, and enabling rapid response. Questions may describe a problem and ask how to automate the solution. Think about what should be monitored and what corrective action would help.

Tip 5: Distinguish EEM from Other Technologies
Don't confuse EEM Applets with Cisco DNA Center automation, Ansible, or other orchestration tools. EEM is a device-level automation tool built into IOS, while other tools provide network-wide automation. The exam may test this distinction.

Tip 6: Focus on Syslog Event Patterns
Syslog event questions often require understanding pattern matching. Know that you specify patterns or keywords to match against log messages. For example, matching "LINEPROTO-5-UPDOWN" for interface events or "CPUHIGH" for CPU alerts.

Tip 7: Remember CLI Command Execution Context
When an EEM Applet executes CLI commands, consider whether you need to enter configuration mode first. Most corrective actions require entering enable mode, then config terminal, before executing commands. The applet must handle this sequence.

Tip 8: Understand Action Limitations
EEM Applets can execute CLI commands, send notifications, and run scripts, but they cannot perform all possible operations. If a question asks whether EEM can do something complex, consider whether it's beyond device-level scripting capabilities.

Tip 9: Syslog vs. SNMP Events
Know the difference: Syslog events monitor local device logs and are more commonly used for monitoring device conditions. SNMP events respond to SNMP traps, which could be from external sources. Most questions focus on syslog.

Tip 10: Exam Question Formats
Watch for multiple-choice questions asking which event detector to use, fill-in-the-blank questions requiring specific commands, and scenario questions describing a problem that needs automation. For scenario questions, first identify the event, then the appropriate action.

Tip 11: Common Exam Scenarios
Expect questions about: interface monitoring and automatic recovery, memory/CPU threshold actions, BGP neighbor state changes, configuration backup scheduling, and log-based alerting. Practice recognizing these scenarios.

Tip 12: Review Configuration Syntax
While you won't need to write complex EEM scripts, knowing basic syntax is important. Familiarize yourself with: event manager applet, event keyword, action with numbering, and common action types like cli command and syslog msg.

Tip 13: Understand Logging and Troubleshooting
Know that EEM applets generate logs visible in system logs. Troubleshooting questions may ask how to verify if an applet executed correctly. The answer involves checking logs and verifying actions were taken.

Tip 14: Think About Real-World Impact
Questions may ask about the impact of automating certain actions. Consider whether automatic actions could cause problems (like automatically reloading a router during business hours) and whether conditions or timing restrictions are needed.

Tip 15: Integration with Monitoring
Understand that EEM complements monitoring solutions. While SNMP and syslog provide visibility, EEM provides automated response. Questions may ask how these tools work together for a comprehensive automation solution.

Key Takeaways for EEM Applets

• EEM Applets provide device-level automation through event detection and action execution
• Event detectors monitor for specific conditions (syslog patterns, interface changes, timers, environmental events)
• Actions are executed sequentially in numerical order when events occur
• Common use cases include interface monitoring, resource threshold management, and automated recovery
• EEM is powerful for self-healing networks but operates at the device level, not network-wide
• Configuration is straightforward using CLI commands defining events and actions
• For exams, focus on understanding event types, selecting appropriate detectors, and understanding the event-action workflow