Embedded Event Manager Actions - Cisco IE-4000 Software Configuration Manual

Configuring Embedded Event Manager
Information About Embedded Event Manager

Interface counter event detector—Publishes an event when a generic Cisco IOS interface counter for a specified
interface crosses a defined threshold. A threshold can be specified as an absolute value or an incremental value. For
example, if the incremental value is set to 50, an event would be published when the interface counter increases by
50.
This detector also publishes an event about an interface based on the rate of change for the entry and exit values.

None event detector—Publishes an event when the event manager run CLI command executes an EEM policy. EEM
schedules and runs policies on the basis on an event specification within the policy itself. An EEM policy must be
manually identified and registered before the event manager run command executes.

Online insertion and removal event detector—Publishes an event when a hardware insertion or removal (OIR) event
occurs.

Remote procedure call (RPC) event detector—Invokes EEM policies from outside the switch over an encrypted
connecting using Secure Shell (SSH) and uses Simple Object Access Protocol (SOAP) data encoding for exchanging
XML-based messages. It also runs EEM policies and then gets the output in a SOAP XML-formatted reply.

SNMP event detector—Allows a standard SNMP MIB object to be monitored and an event to be generated when
— The object matches specified values or crosses specified thresholds.
— The SNMP delta value, the difference between the monitored Object Identifier (OID) value at the beginning the
period and the actual OID value when the event is published, matches a specified value.

SNMP notification event detector—Intercepts SNMP trap and inform messages received by the switch. The event is
generated when an incoming message matches a specified value or crosses a defined threshold.

Syslog event detector—Allows for screening syslog messages for a regular expression pattern match. The selected
messages can be further qualified, requiring that a specific number of occurrences be logged within a specified time.
A match on a specified event criteria triggers a configured policy action.

Timer event detector—Publishes events for the following different types of timers:
— An absolute-time-of-day timer publishes an event when a specified absolute date and time occurs.
— A countdown timer publishes an event when a timer counts down to zero.
— A watchdog timer publishes an event when a timer counts down to zero. The timer automatically resets itself to
its initial value and starts to count down again.
— A CRON timer publishes an event by using a UNIX standard CRON specification to define when the event is to
be published. A CRON timer never publishes events more than once per minute.

Watchdog event detector (IOSWDSysMon)— Publishes an event when one of these events occurs:
— CPU utilization for a Cisco IOS process crosses a threshold.
— Memory utilization for a Cisco IOS process crosses a threshold.
Two events can be monitored at the same time, and the event publishing criteria requires that one or both events
cross their specified thresholds.

Embedded Event Manager Actions

These actions occur in response to an event:

Modifying a named counter.

Publishing an application-specific event.
791