300-410 Embedded Event Manager (EEM) — 10 Questions

Question 1

A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?

Accepted Answer

The EEM applet is clearing the BGP session as part of its configured action.. The EEM applet is the root cause because it is configured to clear the BGP session upon a specific syslog event. The engineer should review the applet's trigger condition and action to identify why it is being triggered incorrectly or unnecessarily.

Answer

The BGP session is failing due to a physical layer issue.

Answer

The BGP session is failing due to a routing loop.

Answer

The EEM applet is causing a memory leak that crashes the BGP process.

Question 2

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

Accepted Answer

Modify the EEM applet trigger to match only the specific interfaces of interest.. The EEM applet is too broadly triggered, causing unnecessary syslog messages that may be interpreted as traps. The engineer should narrow the trigger condition to match only specific interfaces or use a more specific event filter.

Answer

Remove the EEM applet entirely.

Answer

Increase the debounce timer on the interface to reduce flapping.

Answer

Disable SNMP traps for interface state changes.

Question 3

A network engineer is troubleshooting a router that fails to apply a specific configuration change after a reload. The engineer has an EEM applet that runs at boot time to apply a set of commands. After a reload, the engineer checks the configuration and finds that the commands were not applied. The applet is configured with event syslog pattern 'SYS-5-RESTART' and action cli command 'configure terminal'. What is the most likely cause of the failure?

Accepted Answer

The EEM applet runs before the router is fully booted, so the CLI commands fail.. The EEM applet uses the wrong event trigger. The 'SYS-5-RESTART' syslog message may not be generated or may be generated too early before the router is fully ready for configuration commands. The engineer should use 'event none' with a manual trigger or use 'event timer' to delay execution.

Answer

The EEM applet is not enabled globally.

Answer

The syslog pattern 'SYS-5-RESTART' is misspelled.

Answer

The EEM applet requires a 'event manager directory user' command to be configured.

Question 4

A network engineer is troubleshooting a router that is experiencing high CPU utilization. The engineer checks the process list and sees that the 'EEM Server' process is consuming a significant amount of CPU. The engineer reviews the EEM configuration and finds multiple applets that are triggered by syslog events. What should the engineer do first to reduce CPU utilization?

Accepted Answer

Use the 'show event manager statistics' command to see which applets are triggered most often.. High CPU from EEM is often due to excessive syslog triggers. The engineer should first identify which applets are being triggered most frequently and either optimize their conditions or reduce the number of applets.

Answer

Disable all EEM applets.

Answer

Increase the router's CPU priority for the EEM process.

Answer

Change the syslog trigger to use a less frequent pattern.

Question 5

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

Accepted Answer

The SNMP trap destination is not configured globally.. The EEM applet is triggered by a syslog message, but the syslog message may not be generated for that specific interface, or the SNMP trap action may require additional configuration such as an SNMP community or target host.

Answer

The syslog pattern 'LINK-3-UPDOWN' is incorrect; the correct pattern is 'LINK-5-CHANGED'.

Answer

The EEM applet is not registered with the SNMP agent.

Answer

The SNMP trap action requires an SNMP community string to be specified in the applet.

Question 6

A network engineer is troubleshooting a router that is not executing an EEM applet that is supposed to run when a specific interface goes down. The applet is configured with event syslog pattern 'LINK-3-UPDOWN' and matches the interface with a regex. The engineer checks the syslog and sees the message 'LINK-3-UPDOWN: GigabitEthernet0/1, changed state to down' but the applet does not run. What is the most likely cause?

Accepted Answer

The regex pattern in the applet does not match the syslog message.. The EEM applet may have a regex that does not match the actual syslog message format. The engineer should verify the regex pattern using 'show event manager policy' or test the pattern.

Answer

The EEM applet is disabled.

Answer

The syslog message is not being sent to the EEM server due to logging level restrictions.

Answer

The interface is not being monitored because it is a subinterface.

Question 7

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Accepted Answer

Remove one of the duplicate EEM applets.. The duplicate traps are caused by two applets performing the same action. The engineer should remove one of the applets or combine them into one.

Answer

Disable syslog logging for interface state changes.

Answer

Change the SNMP trap destination to a different host for one applet.

Answer

Increase the SNMP trap queue size.

Question 8

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

Accepted Answer

The EEM applets are not registered due to a syntax error in the configuration.. Even if the EEM server is running, the applets may not be registered if they have syntax errors or if the 'event manager applet' command is missing. The engineer should use 'show event manager policy available' or 'show event manager policy registered' to verify if the applets are registered.

Answer

The EEM server is not listening for syslog events.

Answer

The router's logging level is set to emergencies only.

Answer

The EEM applets are configured with 'event none' and need manual triggering.

Question 9

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Accepted Answer

Temporarily disable the EEM applet and monitor the packet loss.. To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor the network for any improvement in packet loss.

Answer

Check the EEM applet's script for errors.

Answer

Use the 'show event manager statistics' command to see how often the applet is triggered.

Answer

Increase the logging level to debug to see more details.

Question 10

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down
2    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Flap

Based on this output, which statement is correct?

Accepted Answer

Two EEM applet policies are registered and active.. The 'show event manager policy registered' command lists all EEM policies registered on the device. The output shows two applet policies registered, but no trigger events are shown. The correct answer is that two EEM applet policies are registered, but the output does not indicate whether they are enabled or disabled; registration means they are loaded and ready to trigger.

Answer

Two EEM applet policies are registered but disabled.

Answer

Only one EEM applet policy is registered.

Answer

The EEM applet policies are triggered by syslog events.