Manager (EEM) uses software programs known as
to determine when an EEM event occurs. Event detectors are separate systems
that provide an interface between the agent being monitored, for example Simple
Network Management Protocol (SNMP), and the EEM policies where an action can be
implemented. Some event detectors are available on every Cisco IOS release, but
most event detectors have been introduced in a specific release. For details of
which event detector is supported in each Cisco IOS release, see the EEM Event
Detectors Available by Cisco IOS Release concept in the “Writing Embedded Event
Manager Policies Using the Cisco IOS CLI” or the “Writing Embedded Event
Manager Policies Using Tcl” modules. EEM contains the following event
application-specific event detector allows any Embedded Event Manager policy to
publish an event. When an EEM policy publishes an event it must use an EEM
subsystem number of 798 with any event type. If an existing policy is
registered for subsystem 798 and a specified event type, a second policy of the
same event type will trigger the first policy to run when the specified event
CLI Event Detector
The CLI event
detector screens command-line interface (CLI) commands for a regular expression
match. When a match is found, an event is published. The match logic is
performed on the fully expanded CLI command after the command is successfully
parsed and before it is executed. The CLI event detector supports three publish
publishing of CLI events--The CLI command is not executed until the EEM policy
exits, and the EEM policy can control whether the command is executed. The
read/write variable, _exit_status, allows you to set the exit status at policy
exit for policies triggered from synchronous events. If _exit_status is 0, the
command is skipped, if _exit_status is 1, the command is run.
publishing of CLI events--The CLI event is published, and then the CLI command
publishing of CLI events with command skipping--The CLI event is published, but
the CLI command is not executed.
The counter event
detector publishes an event when a named counter crosses a specified threshold.
There are two or more participants that affect counter processing. The counter
event detector can modify the counter, and one or more subscribers define the
criteria that cause the event to be published. After a counter event has been
published, the counter monitoring logic can be reset to start monitoring the
counter immediately or it can be reset when a second threshold--called an exit
Custom CLI Event
The custom CLI
event detector publishes an event to add and enhance existing CLI command
syntax. When the special parser characters Tab, ? (question mark), and Enter
are entered, the parser sends the input to the custom CLI event detector for
processing. The custom CLI event detector then compares this input against
registered strings to determine if this is a new or enhanced CLI command. Upon
a match the custom CLI event detector takes appropriate actions, such as
displaying help for the command if ? is entered, displaying the entire command
if Tab is entered, or executing the command if Enter was entered. If a match
does not occur, the parser regains control and processes the information as
Enhanced Object Tracking
The enhanced object
tracking (EOT) event detector publishes an event when the status of a tracked
object changes. Object tracking was first introduced into the Hot Standby
Router Protocol (HSRP) as a simple tracking mechanism that allowed you to track
the interface line-protocol state only. If the line-protocol state of the
interface went down, the HSRP priority of the device was reduced, allowing
another HSRP device with a higher priority to become active.
Object tracking was
enhanced to provide complete separation between the objects to be tracked and
the action to be taken by a client when a tracked object changes. Thus, several
clients such as HSRP, VRRP, or GLBP can register their interest with the
tracking process, track the same object, and each take different action when
the object changes. Each tracked object is identified by a unique number that
is specified on the tracking command-line interface (CLI). Client processes use
this number to track a specific object. The tracking process periodically polls
the tracked objects and notes any change of value. The changes in the tracked
object are communicated to interested client processes, either immediately or
after a specified delay. The object values are reported as either up or down.
tracking is now integrated with EEM to allow EEM to report on a status change
of a tracked object and to allow enhanced object tracking to track EEM objects.
A new type of tracking object--a stub object--is created. The stub object can
be manipulated using the existing CLI commands that already allow tracked
objects to be manipulated.
GOLD Event Detector
The GOLD event
detector publishes an event when a GOLD failure event is detected on a
specified card and subcard.
Interface Counter Event
counter event detector publishes an event when a generic Cisco IOS interface
counter for a specified interface crosses a defined threshold. A threshold can
be specified as an absolute value or an incremental value. If the incremental
value is set to 50, for example, an event would be published when the interface
counter increases by 50.
After an interface
counter event has been published, the interface counter monitoring logic is
reset using two methods. The interface counter is reset either when a second
threshold--called an exit value--is crossed or when an elapsed period of time
IP SLA Event Detector
The IP SLA event
detector publishes an event when an IP SLA reaction is triggered.
The NetFlow event
detector publishes an event when a NetFlow event is triggered.
None Event Detector
The none event
detector publishes an event when the Cisco IOS
run CLI command executes an EEM policy. EEM
schedules and runs policies on the basis of an event specification that is
contained within the policy itself. An EEM policy must be identified and
registered to be permitted to run manually before the
run command will execute.
OIR Event Detector
insertion and removal (OIR) event detector publishes an event when one of the
following hardware insertion or removal event occurs:
A card is
A card is
(RPs), line cards, or feature cards can be monitored for OIR events.
The resource event
detector publishes an event when the Embedded Resource Manager (ERM) reports an
event for the specified policy. The ERM infrastructure tracks resource
depletion and resource dependencies across processes and within a system to
handle various error conditions. The error conditions are handled by providing
an equitable sharing of resources between various applications. The ERM
framework provides a communication mechanism for resource entities and allows
communication between these resource entities from numerous locations. The ERM
framework also helps in debugging CPU and memory-related issues. The ERM
monitors system resource usage to better understand scalability needs by
allowing you to configure threshold values for resources such as the CPU,
buffers, and memory. The ERM event detector is the preferred method for
monitoring resources in Cisco software but the ERM event detector is not
supported in Software Modularity images. For more details about ERM, go to
“Embedded Resource Manager” module.
RF Event Detector
framework (RF) event detector publishes an event when one or more RF events
occur during synchronization in a dual Route Processor (RP) system. The RF
event detector can also detect an event when a dual RP system continuously
switches from one RP to another RP (referred to as a ping-pong situation).
RPC Event Detector
procedure call (RPC) event detector provides the ability to invoke EEM policies
from outside the device over an encrypted connection using Secure Shell (SSH).
The RPC event detector uses Simple Object Access Protocol (SOAP) data encoding
for exchanging XML-based messages. This event detector can be used to run EEM
policies and then receive output in a SOAP XML-formatted reply.
The routing event
detector publishes an event when a route entry changes in the Routing
Information Base (RIB).
SNMP Event Detector
The SNMP event
detector allows a standard SNMP MIB object to be monitored and an event to be
generated when the object matches specified values or crosses specified
SNMP Notification Event
notification event detector provides the ability to intercept SNMP trap and
inform messages coming into or going out of the device. An SNMP notification
event is generated when an incoming or outgoing SNMP trap or inform message
matches specified values or crosses specified thresholds. The SNMP event
detector can wait and intercept the outgoing SNMP traps and informs.
SNMP Object Event
The Simple Network
Management Protocol (SNMP) object trap event detector provides an extension to
replace the value when an SNMP trap with the specified SNMP object ID (OID) is
encountered on a specific interface or address.
Syslog Event Detector
The syslog event
detector allows for screening syslog messages for a regular expression pattern
match. The selected messages can be further qualified, requiring that a
specific number of occurrences be logged within a specified time. A match on a
specified event criteria triggers a configured policy action.
System Manager Event
The system manager
event detector generates events for Cisco IOS Software Modularity process
start, normal or abnormal stop, and restart events. The events generated by the
system manager allows policies to change the default behavior of the process
Timer Event Detector
The timer event
detector publishes events for the following four different types of timers:
absolute-time-of-day timer publishes an event when a specified absolute date
and time occurs.
timer publishes an event when a timer counts down to zero.
timer publishes an event when a timer counts down to zero and then the timer
automatically resets itself to its initial value and starts to count down
A CRON timer
publishes an event using a UNIX standard CRON specification to indicate when
the event is to be published. A CRON timer never publishes events more than
once per minute.
Watchdog System Monitor
(IOSWDSysMon) Event Detector for Cisco IOS
The Cisco IOS
watchdog system monitor event detector publishes an event when one of the
processes are now referred to as tasks to distinguish them from Cisco IOS
Software Modularity processes.
Two events may be
monitored at the same time, and the event publishing criteria can be specified
to require one event or both events to cross their specified thresholds.
Watchdog System Monitor
(WDSysMon) Event Detector for Cisco IOS Software Modularity
The Cisco IOS
Software Modularity watchdog system monitor event detector detects infinite
loops, deadlocks, and memory leaks in Cisco IOS Software Modularity processes.