Lab - Configure Cisco IOS EEM (Answers)

Topology

Addressing Table

Device	Interface	IPv4 Address
R1	G0/0/1	192.168.1.1/24
D1	VLAN 1	192.168.1.2/24

Objectives

Part 1: Build the Network and Configure Basic Device Settings and Interface Addressing
Part 2: Configure, Verify, and Test Cisco IOS EEM Applets

Background / Scenario

Embedded Event Manager (EEM) is a flexible system that lets you customize and automate behavior in Cisco IOS, IOS-XR, and NX-OS. Within EEM, you can use either applets or scripts. Applets are simple, routerbased “mini-automations” built from CLI commands, while scripts are more advanced programs written in the Tcl (Tool Command Language) scripting language and stored on the device. In both cases, EEM uses event detectors to watch for specific conditions (such as syslog messages or CLI commands), and when a match occurs, the defined actions (in the applet or script) are run to respond to the event.

Note: Tcl scripts are not used in this lab.

The table lists some of the common event detectors.

Detector	Details
SNMP	Monitoring SNMP objects
Syslog	Responds to various syslog messages, allowing for matching on regular expressions
Counter	Monitoring and responding to interface counter when cross threshold settings
CLI events	Screening CLI input for a regular expression match
None	This event detector is used to test the EEM script/applet using "event manager run" command
Timers	(Countdown, watchdog and CRON)

Actions that can be used are:

Send an email message
Execute a Cisco command
Generate an SNMP trap
Reload the device
Generate prioritized syslog messages
Change to a secondary processor in a redundant platform
Request system information when the event occurs (examples: show tech, show process, CPU history)

EEM scripts have two purposes:

To help troubleshoot an issue - When you need to troubleshoot problems of an intermittent nature, EEM scripts can be particularly useful. They allow you to automate the collection process of show command outputs and debug commands which allows you to capture data that would otherwise be extremely hard to gather.
To help provide a solution - In cases where a temporary workaround is required while the Technical Assistance Center (TAC) does a root cause analysis. For example, a situation where the problem is intermittent, but the reset of an interface fixes the problem. EEM scripts can be used to trigger this action when the problem begins.

In this lab, you will get hands-on practice using Cisco IOS EEM to automatically respond to three specific situations on a router.

Note: This lab is an exercise in configuring options available for Cisco IOS EEM and does not necessarily reflect network troubleshooting best practices.

Note: The router used with this CCNP hands-on lab is a Cisco 8200L and the switch is a Cisco 9300L. Other routers and switches and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in the lab.

Note: Ensure that the router and switch have been erased and have no start-up configurations. If you are unsure, contact your instructor.

Required Resources

1 Router (Cisco 8200L with Cisco IOS XE Release 17.12.05c universal image or comparable)
1 Switch (any IOS switch)
Console cables to configure the Cisco IOS devices via the console ports
Ethernet cables as shown in the topology

Instructions

Part 1: Build the Network, Configure Basic Device Settings and Routing

In Part 1, you will set up the network topology and configure basic settings and interface addressing on the devices. You will then verify connectivity between R1 and D1.

Step 1: Configure basic settings for the routers.

a. Console into each device, enter global configuration mode, and apply the basic settings. A command list for each router is provided below for initial configurations.

Router R1

hostname R1
no ip domain lookup
username admin secret cisco123
line con 0
exec-timeout 0 0
logging synchronous
exit
line vty 0 4
privilege level 15
password cisco123
exec-timeout 0 0
logging synchronous
login
exit
banner motd # This is R1, Configure Cisco IOS EEM Lab #
interface g0/0/1
ip address 192.168.1.1 255.255.255.0
no shutdown
end

Switch D1

hostname D1
no ip domain lookup
username admin secret cisco123
line con 0
exec-timeout 0 0
logging synchronous
exit
line vty 0 4
privilege level 15
password cisco123
exec-timeout 0 0
logging synchronous
login local
exit
banner motd # This is D1, Configure Cisco IOS EEM Lab #
interface range g1/0/1-24, g1/1/1-4, g0/0
shutdown
exit
interface range g1/0/11
no shutdown
interface vlan 1
ip address 192.168.1.2 255.255.255.0
no shutdown
exit
ip default-gateway 192.168.1.1
end

b. Save the running configurations to startup-config.

Step 2: Cable the network as shown in the topology.

Attach the devices as shown in the topology diagram and cable as necessary.

Step 3: Verify end-to-end connectivity.

From D1, ping R1.

D1# ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms

Part 2: Configure, Verify, and Test Cisco IOS EEM Applets

In this part, you will configure and test several Cisco IOS EEM applets on R1. You’ll start by creating an applet that automatically brings an interface back up and logs user information when it is shut down. You will then verify its operation using debugging output. You will add and validate two more applets: one that blocks debug commands while logging who attempted them and when, and another that enforces a standard interface description whenever someone tries to change it.

Step 1: Implement an EEM script on R1 to monitor for an interface shutdown.

a. On R1, configure the EEM script.

R1# config t
R1(config)# event manager applet interface_Shutdown
R1(config)# event syslog pattern "Interface GigabitEthernet0/0/1, changed
state to administratively down"
R1(config)# action 1.0 cli command "enable"
R1(config)# action 1.5 cli command "config t"
R1(config)# action 2.0 cli command "interface g0/0/1"
R1(config)# action 2.5 cli command "no shutdown"
R1(config)# action 3.0 cli command "end"
R1(config)# action 3.5 cli command "who"
R1(config)# action 4.0 mail server "192.168.1.1" to "[email protected]."
from "[email protected]." subject ".ISP1_Interface_GigabitEthernet0/0/1_SHUT."
body "Current users $_cli_result"
R1(config)# end

Note: The end or exit command is required to finalize the applet.

The applet you are creating is called interface_Shutdown. It monitors the router’s syslog messages for the following text:

Interface GigabitEthernet0/0/1, changed state to administratively down

When a syslog message containing this exact pattern appears, the applet is triggered and runs its list of actions in order. Those actions automatically enter interface configuration mode, run the no shutdown command to bring the interface back up, and then send an email to a monitoring address that includes information about what happened.

Note: No email will be sent the lab does not have a configured email server.

b. Use the show event manager policy registered command to verify that the script has been created successfully in the EEM policy. If you see no output, make sure you entered end in Step 1a.

R1# show event manager policy registered
No.  Class   Type    Event Type       Trap   Time Registered          Name
1    applet  user    syslog           Off    Wed Dec 17 12:24:51 2025
interface_Shutdown
pattern {Interface GigabitEthernet0/0/1, changed state to administratively down}
maxrun 20.000
action 1.0 cli command "enable"
action 1.5 cli command "config t"
action 2.0 cli command "interface g1/0/0"
action 2.5 cli command "no shutdown"
action 3.0 cli command "end"
action 3.5 cli command "who"
action 4.0 mail server "192.168.1.1" to "[email protected]." from "[email protected]."
subject ".ISP1_Interface_Ethernet0/0_SHUT." body "Current users $_cli_result"

Step 2: Test the interface_Shutdown applet.

a. From the R1 console, enable EEM CLI debugging and trigger the EEM event by shutting down the GigabitEthernet 1/0/0 interface.

R1# debug event manager action cli
Debug EEM action cli debugging is on
R1# config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# int g0/0/1
R1(config-if)# shutdown

b. Evaluate the debug output to see where the actions you defined in the applet where implemented.

*Dec 17 12:35:48.594: %LINK-5-CHANGED: Interface GigabitEthernet0/0/1, changed state
to administratively down
*Dec 17 12:35:48.700: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : CTL :
cli_open called.
*Dec 17 12:35:48.735: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
This is R1, Configure Cisco IOS EEM Lab
*Dec 17 12:35:48.735: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1>
*Dec 17 12:35:48.735: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN :
R1>enable
*Dec 17 12:35:48.746: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1#
*Dec 17 12:35:48.746: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN :
R1#config t
*Dec 17 12:35:48.857: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
Enter configuration commands, one per line. End with CNTL/Z.
*Dec 17 12:35:48.857: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
*Dec 17 12:35:48.857: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN :
R1(config)#interface g0/0/1
*Dec 17 12:35:48.868: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
*Dec 17 12:35:48.868: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN :
R1(config-if)#no shutdown
*Dec 17 12:35:48.885: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet0/0/1, changed state to down
*Dec 17 12:35:48.979: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
*Dec 17 12:35:48.979: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN :
R1(config-if)#end
*Dec 17 12:35:48.980: %SYS-5-CONFIG_I: Configured from console by on vty0
(EEM:interface_Shutdown)
*Dec 17 12:35:48.989: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1#
*Dec 17 12:35:48.989: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : IN :
R1#who
*Dec 17 12:35:49.026: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
Line User Host(s) Idle Location
*Dec 17 12:35:49.026: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : 0
con 0 idle 00:00:02
*Dec 17 12:35:49.026: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : *866
vty 0 idle 00:00:00 EEM:interface_Shutdown
*Dec 17 12:35:49.026: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
*Dec 17 12:35:49.026: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
Interface User Mode Idle Peer Address
*Dec 17 12:35:49.026: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT :
*Dec 17 12:35:49.026: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : OUT : R1#
*Dec 17 12:35:56.788: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed state to
up
*Dec 17 12:35:57.788: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet0/0/1, changed state to up
*Dec 17 12:36:01.088: %HA_EM-3-FMPD_SMTP: Error occurred when sending mail to SMTP
server: 192.168.1.1 : error in connecting to SMTP server
*Dec 17 12:36:01.088: %HA_EM-3-FMPD_ERROR: Error executing applet interface_Shutdown
statement 4.0
*Dec 17 12:36:01.088: %HA_EM-6-LOG: interface_Shutdown : DEBUG(cli_lib) : : CTL :
cli_close called.
*Dec 17 12:36:01.169:
*Dec 17 12:36:01.169: tty is now going through its death sequence
R1(config-if)#

Note: The who command shows that it was Con 0 that issued the shutdown command. The email action 4.0 failed, as expected, because there is no SMTP server configured.

c. Disable all debugging with the undebug all command.

R1(config-if)# end
R1# undebug all
All possible debugging has been turned off
R1#

Step 3: Implement an EEM script on R1 to monitor for the debug command.

a. On R1, configure the EEM script.

R1# conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# event manager applet Stop_Debug
R1(config-applet)# event cli pattern "debug" sync no skip yes
R1(config-applet)# action 1.0 cli command "enable"
R1(config-applet)# action 2.0 cli command "sh users | append flash:Debug"
R1(config-applet)# action 3.0 cli command "sh clock | append
flash:Debug_clock"
R1(config-applet)# end
R1#

This EEM applet watches all CLI commands entered on the router for the word debug. When a user tries to run any debug command, the applet intercepts it and prevents the debug from running (skip yes). Instead, it first ensures it is in privileged mode, appends the output of show users to a file called Debug in flash (recording who is logged in), and appends the current time from show clock to a second file called Debug_clock. This gives you a simple log of who attempted to use debug and when they did it, without allowing debugging to be enabled.

b. Use the show event manager policy registered command to verify that the script has been created successfully in the EEM policy. If you see no output, make sure you entered end in Step 3a.

R1# show event manager policy registered

No.  Class   Type    Event Type  Trap  Time Registered           Name
---- ------- ------- ----------- ----- -------------------------- ----------------
1    applet  user    syslog      Off   Wed Dec 17 12:34:08 2025
<output omitted>
2    applet  user    cli         Off   Wed Dec 17 12:47:34 2025  Stop_Debug
      pattern {debug} sync no skip yes
      maxrun 20.000
      action 1.0 cli command "enable"
      action 2.0 cli command "sh users | append flash:Debug"
      action 3.0 cli command "sh clock | append flash:Debug_clock"

Step 4: Test the Stop_Debug applet.

a. From the R1 console, trigger the EEM script by entering the debug all command.

R1# debug all
!Note that nothing happens

b. Use the dir command to show the new files created in flash.

R1# dir flash: | include Debug

27   -rw-        36  Dec 17 2025 12:48:12 +00:00  Debug_clock
26   -rw-       269  Dec 17 2025 12:48:12 +00:00  Debug

c. Use the more command to view the contents of the files created in flash.

R1# more flash:Debug

Line  User  Host(s)  Idle      Location
----  ----  -------- --------- ----------------
0     con   0        idle 00:00:00
*866  vty   0        idle 00:00:00  EEM:Stop_Debug

Interface  User  Mode  Idle  Peer Address

R1# more flash:Debug_clock

*12:48:12.165 UTC Wed Dec 17 2025

Step 5: Clean up

a. When you are finished testing the applet, remove the files flash:Debug and flash:Debug_clock.

R1# delete flash:Debug*
Delete filename [Debug]? <Enter>
Delete bootflash:/Debug? [confirm] <Enter>

R1# delete flash:Debug_clock
Delete filename [Debug_clock]? <Enter>
Delete bootflash:/Debug_clock? [confirm] <Enter>

b. Configure the files have deleted.

R1# dir flash: | in Debug
R1#

Lab - Configure Cisco IOS EEM (Answers)