March 11, 2010

Real-Time Event Detection and Response

  • Real-Time Event Detection and Response and Task Automation Using Cisco IOS Embedded Event Manager
  • Cisco Systems

This document provides an introduction to Cisco IOS Embedded Event Manager (EEM) and describes some potential use cases.

Cisco IOS EEM is a robust tool available to customers and is a significant differentiator for Cisco. Cisco IOS EEM is a value-added feature that is included at no cost (on most Cisco routing and switching platforms) and can reduce customer operating expenses (OpEx) by automating tasks, providing real-time alerts with automated responses, and facilitating troubleshooting. It is essentially a full-time network agent that allows devices to monitor and detect events and immediately take action.

Cisco IOS EEM is embedded in Cisco IOS Software and is enabled by default. There is no requirement or dependency on a centralized management system. Cisco IOS EEM capability is therefore distributed across the network, and Cisco IOS EEM can identify a problem and take action at the point closest to the problem.

This document describes Cisco IOS EEM and provides a technical overview. It also discusses event detectors, policies (using applets and scripts), and use cases.

The appendix provides additional technical details. It discusses multiple event detection, how to gather information using the event_reqinfo command, and decision logic. It also presents script action examples, Tool Command Language (TCL) code snippets, and helpful commands and URLs and steps through execution of a sample script.

Download Paper
(Webtorials registration required. Click here if you forgot your username/password.)


This is an excellent, detailed paper that's chock full of great information - exactly what the Webtorials community loves.  It's very nicely laid out with an intro to the Embedded Events Manager (EEM), and then has a load of examples and sample cases where the EEM could be used.

As noted in the paper, "Cisco IOS EEM allows customers to:

  • Use the intelligence in Cisco IOS Software to detect specific events and respond or alert network administrators to those events
  • Automate routine tasks and create custom commands
  • Respond to detected events with immediate action, which may include:
  • Making an automated change to the device configuration
  • Gathering information and sending an email
  • Implementing a custom syslog or Simple Network Management Protocol (SNMP) trap"
As always, regardless of your exact choice of provider, this provides an excellent benchmark for the current levels of proactive and reactive management.

Great document, but I'm curious... Why does the EEM subsystem use TCL as a scripting language rather than something more powerful like Perl or Python?

Great question Steve. Early on in the development of EEM a number of scripting languages were evaluated for use with EEM. The decision to go with TCL at that time was made because of the low space footprint that TCL would incur in IOS. That being said, with many Cisco networking products now having more memory than in the past, the footprint issue has been somewhat alleviated. Since then, there have been a number of customers who have made requests of Cisco to look to support other scripting languages. The good news is that investigation is now being done to look at the feasibility of bringing alternative scripting options to EEM.

There is one additional point that is pertinent to make regarding TCL. For some users, TCL scripting can often be a barrier to really making effective use of EEM. For that reason, Cisco has created a EEM TCL script portal on that provides a set of TCL scripts that users can download and use as-is or as a template to expand and modify to their own requirements. Its certainly a great way to both get an appreciation for how other users are using EEM and also to get a handle on how TCL scripts are built. In addition to downloading, users are also welcome to upload their own scripts to share with the greater EEM user community.

This portal can be accessed at this URL:

Search Webtorials

Get E-News and Notices via Email




I accept Webtorials' Terms and Conditions.

Trending Discussions

See more discussions...

Featured Sponsor Microsites



Please note: By downloading this information, you acknowledge that the sponsor(s) of this information may contact you, providing that they give you the option of opting out of further communications from them concerning this information.  Also, by your downloading this information, you agree that the information is for your personal use only and that this information may not be retransmitted to others or reposted on another web site.  Continuing past this point indicates your acceptance of our terms of use as specified at Terms of Use.

Webtorial® is a registered servicemark of Distributed Networking Associates. The Webtorial logo is a servicemark of Distributed Networking Associates. Copyright 1999-2018, Distributed Networking Associates, Inc.