EEM - Embedded Event Manager

• https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-16/216091-best-practices-and-useful-scripts-for-ee.html
• https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-book_CLT_chapter.html

• by default EEM scripts will only run for 20 seconds. So if you need it to run for longer - you need to set maxrun <seconds> in the event line - example:

   event timer cron cron-entry "5 0,12 * * *" maxrun 180

• View the last 10 EEM Scripts run by using the command:

  show event manager history events

In this example, the MAC address b4e9.b0d3.6a41 is tracked. The script checks every 30 seconds to see if the specified MAC address has been learned in the ARP or MAC tables. If the MAC is seen, the script takes these actions:

outputs a syslog message (This is useful when you want to confirm where a MAC address is learned, or when/how often it is learned).

event manager applet mac_trace authorization bypass 
event timer watchdog time 30
action 0001 cli command "enable"
action 0002 cli command "term exec prompt timestamp"
action 0003 cli command "term length 0"
action 0010 cli command "show ip arp | in b4e9.b0d3.6a41"
action 0020 regexp ".*(ARPA).*" $_cli_result
action 0030 if $_regexp_result eq 1
action 0040 syslog msg $_cli_result
action 0050 end
action 0060 cli command "show mac add vlan 1 | in b4e9.b0d3.6a41"
action 0070 regexp ".*(DYNAMIC).*" $_cli_result
action 0080 if $_regexp_result eq 1
action 0090 syslog msg $_cli_result
action 0100 end

This script shuts down port Te2/1/15 every day at 6PM.

event manager applet shut_port authorization bypass 
event timer cron cron-entry "0 18 * * *"
action 0001 cli command "enable"
action 0002 cli command "term exec prompt timestamp"
action 0003 cli command "term length 0"
action 0010 syslog msg  "shutting port Te2/1/15 down"
action 0030 cli command "config t"
action 0040 cli command "int Te2/1/15"
action 0050 cli command "shutdown"
action 0060 cli command "end"

event manager applet int_util_check auth bypass
event timer watchdog time 300 maxrun 120
action 0001 cli command "enable"
action 0002 cli command "term exec prompt timestamp"
action 0003 cli command "term length 0"
action 0010 set loop_iteration 1
action 0020 while $loop_iteration le 6
action 0030 syslog msg "Running iteration $loop_iteration of command"
action 0040 cli command "show interface te2/1/15 | append flash:interface_util.txt"
action 0050 wait 10
action 0060 increment loop_iteration 1
action 0070 end

Reference: https://community.cisco.com/t5/network-management/if-statements-eem/td-p/2541451

event manager applet model
 event none
 action 010 cli command "enable"
 action 020 cli command "show snmp sysobjectid"
 action 030 regexp "1\.3\.6\.1\.4\.1\.9\.1\.([0-9]+)" "$_cli_result" match modelid
 action 040 syslog msg "sysobject = $modelid"
 action 050 if $modelid eq "1496"
 action 060  syslog msg "sysobject index $modelid is an 819 router"
 action 070 else
 action 080  syslog msg "sysobject index $modelid is not an 819 router"
 action 090 end

outer# show event manager history events
No.  Time of Event             Event Type          Name
1    Fri Aug13  21:42:57 2004  snmp                applet: SAAping1 
2    Fri Aug13  22:20:29 2004  snmp                applet: SAAping1 
3    Wed Aug18  21:54:48 2004  snmp                applet: SAAping1 
4    Wed Aug18  22:06:38 2004  snmp                applet: SAAping1 
5    Wed Aug18  22:30:58 2004  snmp                applet: SAAping1 
6    Wed Aug18  22:34:58 2004  snmp                applet: SAAping1 
7    Wed Aug18  22:51:18 2004  snmp                applet: SAAping1 
8    Wed Aug18  22:51:18 2004  application         applet: CustApp1

Restart Voice Ports at 00:05 and 12:05 every day.

Note - we could have two while loops instead of 4 - which would make the script more simple. i.e. Shutting down 1/0/X and 3/0/X within the same while loop etc.

event manager applet disconnect_calls_eem_script authorization bypass
 event timer cron cron-entry "5 0,12 * * *" maxrun 180
 action 0010 syslog msg "Restarting Analog Voice Ports 1/0/X & 3/0/X ..."
 action 0010 syslog msg "Restarting Analog Voice Ports 1/0/X & 3/0/X ..."
 action 0020 cli command "enable"
 action 0030 cli command "conf t"
 action 0040 set loop_iteration "0"
 action 0050 while $loop_iteration le 71
 action 0060  syslog msg "Shutting down voice-port 1/0/$loop_iteration"
 action 0070  cli command "voice-port 1/0/$loop_iteration"
 action 0080  cli command "shutdown"
 action 0090  syslog msg "Shutting down voice-port 3/0/$loop_iteration"
 action 0100  cli command "voice-port 3/0/$loop_iteration"
 action 0110  cli command "shutdown"
 action 0120  wait 2
 action 0130  syslog msg "No shutdown on voice-port 1/0/$loop_iteration"
 action 0140  cli command "voice-port 1/0/$loop_iteration"
 action 0150  cli command "no shutdown"
 action 0160  syslog msg "No shutdown on voice-port 3/0/$loop_iteration"
 action 0170  cli command "voice-port 3/0/$loop_iteration"
 action 0180  cli command "no shutdown"
 action 0190  increment loop_iteration
 action 0200 end
 action 0210 syslog msg "Reset of Voice Ports Completed Successfully."
 action 0250 exit

The log of the above script when run

This script enables all ports from 0 to 71 Note - I found that if all ports were shutdown and you tried to enable all ports - that the script can bomb out, I assume due to trying to bring so many interfaces into service at the same time - CPU maxes out. Hence a good idea to add in a Script completed successfully at the end of the script!

To run the below script - which doesn't have an event - so will not run automatically use the following command:

event manager run ENABLE_VOICE_PORTS

event manager applet ENABLE_VOICE_PORTS
 event none
 action 0005 syslog msg "Enabling ports from 1/0/0 to 1/0/71 and 3/0/0 to 3/0/71"
 action 0010 cli command "enable"
 action 0020 cli command "conf t"
 action 0030 set loop_iteration "0"
 action 0040 while $loop_iteration le 71
 action 0050  cli command "voice-port 1/0/$loop_iteration"
 action 0060  cli command "no shutdown"
 action 0070  cli command "voice-port 3/0/$loop_iteration"
 action 0080  cli command "no shutdown"
 action 0090  increment loop_iteration
 action 0100 end
 action 0105 syslog msg "Script Completed Successfully."
 action 0110 exit