event manager applet
Automate router responses to events without external scripting — run CLI commands automatically when specific conditions occur.
Definition: event manager applet is a Cisco IOS global config command. Creates an Embedded Event Manager (EEM) applet that triggers automated CLI actions in response to system events such as syslog messages, interface state changes, timers, or CLI commands.
Overview
The 'event manager applet [name]' command is the cornerstone of Cisco's Embedded Event Manager (EEM) feature, which allows network administrators to automate responses to network events directly on the device. This command creates or modifies an EEM applet—a script-like construct that defines a trigger (event) and a set of actions to execute when that trigger occurs. EEM is a powerful tool for network automation and self-healing, enabling the device to react to conditions such as interface state changes, syslog messages, SNMP traps, or even custom timers without external intervention.
It is particularly valuable in environments where rapid response is critical, such as reducing downtime by automatically restarting a failed process or sending an alert when a threshold is exceeded. Unlike traditional scripting or external automation tools (e.g., Ansible, Python scripts), EEM runs natively on the IOS device, offering low-latency responses and independence from external servers. It fits into the broader network configuration workflow as a means to implement proactive monitoring and remediation, often complementing SNMP-based monitoring systems.
Important IOS behaviors include: EEM applets are stored in the running configuration and can be saved to startup-config; they execute with the privilege level of the user who triggered them (unless overridden); output from actions like 'puts' or 'syslog' is buffered and may appear in the console or log; and applets can be disabled without deletion using 'no event manager applet [name]'. Understanding EEM is essential for CCNA and CCNP candidates as it represents a shift toward programmable networks and is frequently tested in automation topics.
event manager applet <applet-name> [authorization bypass]When to Use This Command
- Auto-clear interface error counters when an interface flaps
- Send a syslog alert and save config when OSPF adjacency drops
- Disable a port automatically when a specific MAC address is detected
- Run show commands automatically and log output when CPU spikes above a threshold
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| name | WORD (applet name) | Specifies the name of the EEM applet. The name must be unique within the device and can contain alphanumeric characters, hyphens, and underscores. Common mistakes include using spaces or special characters, or reusing a name that already exists (which modifies the existing applet). |
Command Examples
EEM applet to save config on interface down event
Router(config)# event manager applet SAVE-ON-LINK-DOWN Router(config-applet)# event syslog pattern "LINK-3-UPDOWN.*down" Router(config-applet)# action 1.0 syslog msg "Link down detected, saving config" Router(config-applet)# action 2.0 cli command "enable" Router(config-applet)# action 3.0 cli command "write memory" Router(config-applet)# end
Understanding the Output
Each action line has a sequence number (1.0, 2.0...) and a keyword (syslog, cli command, wait, set). Actions execute in sequence number order. event syslog pattern uses regex matching against syslog messages. Use show event manager policy registered to see configured applets.
Configuration Scenarios
Automatically restart a failed interface using EEM
A network engineer wants to automatically recover a critical interface that goes down unexpectedly. Instead of manual intervention, an EEM applet monitors the interface state and issues a 'shutdown' followed by 'no shutdown' when the interface goes down.
Topology
R1(Gi0/1)---10.0.12.0/30---(Gi0/1)R2Steps
- 1.Step 1: Enter global configuration mode: Router> enable then Router# configure terminal
- 2.Step 2: Create the EEM applet: Router(config)# event manager applet Auto-Restart-Gi0/1
- 3.Step 3: Define the event: Router(config-applet)# event syslog pattern "%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down"
- 4.Step 4: Define the action: Router(config-applet)# action 1.0 cli command "enable"
- 5.Step 5: Add action to shutdown and no shutdown: Router(config-applet)# action 2.0 cli command "configure terminal" then action 3.0 cli command "interface GigabitEthernet0/1" then action 4.0 cli command "shutdown" then action 5.0 cli command "no shutdown"
- 6.Step 6: Exit applet configuration: Router(config-applet)# exit
! Full IOS config block event manager applet Auto-Restart-Gi0/1 event syslog pattern "%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down" action 1.0 cli command "enable" action 2.0 cli command "configure terminal" action 3.0 cli command "interface GigabitEthernet0/1" action 4.0 cli command "shutdown" action 5.0 cli command "no shutdown" !
Verify: Use 'show event manager policy available' to see registered applets. Use 'show event manager history events' to see triggered events. Expected: The applet appears in the list and when the interface goes down, the applet executes and the interface comes back up.
Watch out: The syslog pattern must exactly match the message generated by the device. If the interface name or message format differs (e.g., on different IOS versions), the applet will not trigger. Always test the pattern by generating the event and checking the syslog.
Send an SNMP trap when CPU exceeds 90%
An administrator wants to be alerted when CPU utilization on a router exceeds 90% for more than 10 seconds. An EEM applet monitors the CPU and sends an SNMP trap to the NMS.
Topology
R1---Management Network---SNMP Server (192.168.1.100)Steps
- 1.Step 1: Enter global configuration mode: Router> enable then Router# configure terminal
- 2.Step 2: Create the EEM applet: Router(config)# event manager applet High-CPU-Alert
- 3.Step 3: Define the event: Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 90 poll-interval 10
- 4.Step 4: Define the action to send a syslog: Router(config-applet)# action 1.0 syslog msg "CPU utilization exceeded 90%"
- 5.Step 5: Define the action to send an SNMP trap: Router(config-applet)# action 2.0 snmp-trap strdata "CPU high"
- 6.Step 6: Exit applet configuration: Router(config-applet)# exit
! Full IOS config block event manager applet High-CPU-Alert event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 90 poll-interval 10 action 1.0 syslog msg "CPU utilization exceeded 90%" action 2.0 snmp-trap strdata "CPU high" !
Verify: Use 'show event manager policy available' to see the applet. Use 'show event manager history events' to see when it triggered. On the SNMP server, verify receipt of the trap. Expected: The applet triggers every 10 seconds while CPU > 90%.
Watch out: The OID for CPU utilization may vary by platform and IOS version. Always verify the correct OID using 'show snmp mib walk' or documentation. Also, ensure SNMP is configured on the device with appropriate community strings and trap destinations.
Troubleshooting with This Command
When troubleshooting EEM applets, the first step is to verify that the applet is registered and enabled. Use 'show event manager policy available' to list all applets; a healthy output shows the applet name, event type, and status as 'registered'. If the applet is missing, check the running configuration with 'show running-config | section event manager'.
Common problem indicators include applets that never trigger or trigger unexpectedly. For a non-triggering applet, examine the event definition: ensure the pattern or OID matches exactly. For syslog events, use 'show log' to see recent messages and compare the pattern.
For SNMP events, use 'debug event manager action cli' to see if the applet fires but actions fail. Focus on the 'event manager history events' output: it shows each trigger with timestamp, applet name, and result (success/failure). If an action fails, the result shows 'error' and the specific action number.
Common symptoms include: applet triggers but interface does not recover—check the CLI commands in actions; they must be valid and may require privilege escalation (action cli command 'enable'). Another symptom is excessive triggering—use 'event manager applet [name] event none' to temporarily disable. Correlate with 'show clock' to verify timestamps.
For debugging, 'debug event manager action cli' shows CLI output, and 'debug event manager tcl' for Tcl applets. A step-by-step diagnostic flow: 1) Verify applet exists and is registered. 2) Generate the event manually (e.g., shut/no shut interface). 3) Check 'show event manager history events' for trigger. 4) If triggered, check action results. 5) If not triggered, verify event criteria (pattern, OID, timer). 6) Use debug commands cautiously in production. Remember that EEM applets run with the privilege level of the event trigger; if triggered by a low-privilege user, actions requiring higher privilege may fail.
Also, applets can be nested or call other applets, which complicates troubleshooting. Always test in a lab before deploying.
CCNA Exam Tips
CCNA exam rarely tests EEM deeply but may reference it in the context of automation
Know that EEM is Cisco's on-box automation tool — no external server needed
The authorization bypass keyword allows the applet to run without an enable password prompt
Common Mistakes
Forgetting that cli command actions need to first issue enable to get privilege level
Action sequence numbers must be unique — duplicate numbers overwrite previous actions
Regex in event syslog pattern is case-sensitive
event manager applet vs banner motd
Both event manager applet and banner motd are configured in global configuration mode and affect user interaction with the device, but they serve fundamentally different purposes. They are sometimes considered together because both can generate output (syslog vs. display), yet one is dynamic and event-driven while the other is static and login-based.
| Aspect | event manager applet | banner motd |
|---|---|---|
| Scope | Entire device; applies to all system events | All login sessions; displayed before authentication |
| Configuration Mode | Global configuration (configure terminal) | Global configuration (configure terminal) |
| Trigger | Event-driven (syslog, interface change, timer, CLI, etc.) | On each new connection (SSH, Telnet, console) before login |
| Lifecycle | Persists in running config; active until removed or disabled | Persists in running config; displayed on every login until removed |
| Typical Use | Automating responses to network events, troubleshooting, or policy enforcement | Displaying legal warnings, maintenance notices, or welcome messages |
Use event manager applet when you need to automate actions triggered by specific system events, such as sending a syslog when an interface goes down.
Use banner motd when you need to display a legal or informational message to all users upon connecting to the device, before authentication.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the 'event manager applet' command syntax is identical to classic IOS, but the underlying EEM engine is more robust. However, some event types (like 'event snmp') may have slightly different OID behavior. The output of 'show event manager history events' includes additional fields like 'Event Type' and 'Time Zone'.
In NX-OS (e.g., Nexus 9000), the equivalent command is 'event manager applet [name]' as well, but the event and action syntax differs significantly. For example, NX-OS uses 'event syslog pattern' but the pattern matching is case-sensitive and requires exact match. Also, NX-OS does not support 'event snmp' directly; instead, use 'event snmp-notification'.
For ASA firewalls, EEM is not available; instead, use 'event manager' in ASA 9.7+ with limited functionality (only syslog events). In IOS-XR (e.g., ASR 9000), EEM is not supported; the equivalent is 'event manager' with a different syntax (e.g., 'event manager applet' is not used; instead, use 'event manager policy' with Tcl or Python scripts). Between IOS versions, the 'event manager applet' command has been stable since 12.4(20)T, but newer versions (15.x, 16.x) added more event types like 'event cli' and 'event none'.
Always check the specific IOS version documentation for supported events and actions.
Related Commands
banner motd
Configures a Message of the Day banner that is displayed to all users who connect to the device before authentication. Used for legal warnings about unauthorized access.
hostname
Sets the hostname of a Cisco router or switch. The hostname appears in the CLI prompt, is used in SSH key generation (hostname.domain-name), and is advertised via CDP to neighbour devices.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions