Consolidated Platform Configuration Guide, Cisco Ios Release 15.2(4)E (Catalyst 2960-X Switches - Cisco Catalyst 2960 series Configuration Manual

CLI Event Detector
The following example shows how to specify an EEM applet to run when the Cisco IOS write memory CLI
command is run. The applet provides a notification that this event has occurred via a syslog message. In the
example, the sync keyword is configured with the yes argument, and this means that the event detector is
notified when this policy completes running. The exit status of the policy determines whether the CLI command
will be executed. In this example, the policy exit status is set to one and the CLI command runs.
event manager applet cli-match
event cli pattern "write mem.*" sync yes
action 1.0 syslog msg "$_cli_msg Command Executed"
set 2.0 _exit_status 1
The following example shows an applet which matches the cli pattern with the test argument. When show
access-list test is entered, the CLI event detector matches the test argument, and the applet is triggered. The
debug event manager detector cli output is added to show num_matches is set to one.
!
event manager applet EEM-PIPE-TEST
event cli pattern "test" sync yes
action 1.0 syslog msg "Pattern matched!"
!
*Aug 23 23:19:59.827: check_eem_cli_policy_handler: command_string=show access-lists test
*Aug 23 23:19:59.827: check_eem_cli_policy_handler: num_matches = 1, response_code = 4
*Aug 23 23:19:59.843: %HA_EM-6-LOG: EEM-PIPE-TEST: Pattern matched!
The functionality provided in the CLI event detector only allows a regular expression pattern match on a
Note
valid IOS CLI command itself. This does not include text after a pipe (|) character when redirection is
used.
The following example shows that when show version | include test is entered, the applet fails to trigger
because the CLI event detector does not match on characters entered after the pipe (|) character and the debug
event manager detector cli output shows num_matches is set to zero.
*Aug 23 23:20:16.827: check_eem_cli_policy_handler: command_string=show version
*Aug 23 23:20:16.827: check_eem_cli_policy_handler: num_matches = 0, response_code = 1
Counter Event Detector and Timer Event Detector
The following example shows that the EventCounter_A policy is configured to run once a minute and to
increment a well-known counter called critical_errors. A second policy--EventCounter_B--is registered to be
triggered when the well-known counter called critical_errors exceeds a threshold of 3. When the
EventCounter_B policy runs, it resets the counter to 0.
event manager applet EventCounter_A
event timer watchdog time 60.0
action 1.0 syslog msg "EventCounter_A"
action 2.0 counter name critical_errors op inc value 1
exit
event manager applet EventCounter_B
event counter name critical_errors entry-op gt entry-val 3 exit-op lt exit-val 3
action 1.0 syslog msg "EventCounter_B"
action 2.0 counter name critical_errors op set value 0

Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)

Configuration Examples for Writing Embedded Event Manager Policies Using Tcl
1745