event manager applet [name]
Creates or modifies an Embedded Event Manager (EEM) applet that triggers automated actions when a specified event occurs, enabling network automation and self-healing.
event manager applet [name]When to Use This Command
- Automatically send a syslog message and reload a router when a critical interface goes down.
- Monitor CPU usage and generate a tech-support snapshot if it exceeds 90% for more than 30 seconds.
- Automatically disable a port when excessive CRC errors are detected to prevent network degradation.
- Trigger a custom script to update DNS records when an interface IP address changes.
Command Examples
Basic EEM Applet to Log Interface Down Event
event manager applet LOG_INTERFACE_DOWN
event syslog pattern "%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down"
action 1.0 syslog msg "Interface GigabitEthernet0/1 went down at [event.priority]"
action 2.0 cli command "show interface GigabitEthernet0/1"Router(config)# event manager applet LOG_INTERFACE_DOWN
Router(config-applet)# event syslog pattern "%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down"
Router(config-applet)# action 1.0 syslog msg "Interface GigabitEthernet0/1 went down at [event.priority]"
Router(config-applet)# action 2.0 cli command "show interface GigabitEthernet0/1"
Router(config-applet)# end
Router#
*Mar 1 00:05:23.123: %HA_EM-6-LOG: LOG_INTERFACE_DOWN: Interface GigabitEthernet0/1 went down at 5
*Mar 1 00:05:23.124: GigabitEthernet0/1 is down, line protocol is down
Hardware is ISR4321-2x1GE, address is aabb.cc00.0100 (bia aabb.cc00.0100)
Internet address is 192.168.1.1/24
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is RJ45
input errors 0, CRC 0, frame 0, overrun 0, ignored 0
output errors 0, collisions 0, interface resets 0The first line shows entering EEM applet configuration mode. The event syslog command defines the trigger: a syslog message matching the pattern. The action 1.0 sends a custom syslog message with the event priority. Action 2.0 executes a CLI command to show interface status. The output after 'end' shows the triggered syslog and the output of the show command, confirming the interface is down.
EEM Applet to Monitor High CPU and Collect Data
event manager applet HIGH_CPU
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 90 poll-interval 10
action 1.0 syslog msg "High CPU detected: [event.oid-value]%"
action 2.0 cli command "show process cpu sorted | include 5 sec"
action 3.0 cli command "show ip route"Router(config)# event manager applet HIGH_CPU
Router(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 90 poll-interval 10
Router(config-applet)# action 1.0 syslog msg "High CPU detected: [event.oid-value]%"
Router(config-applet)# action 2.0 cli command "show process cpu sorted | include 5 sec"
Router(config-applet)# action 3.0 cli command "show ip route"
Router(config-applet)# end
Router#
*Mar 1 00:10:45.678: %HA_EM-6-LOG: HIGH_CPU: High CPU detected: 95%
*Mar 1 00:10:45.679: CPU utilization for five seconds: 95%/0%; one minute: 80%; five minutes: 70%
*Mar 1 00:10:45.680: Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0.2 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 10.0.0.2
C 10.0.0.0/8 is directly connected, GigabitEthernet0/0
C 192.168.1.0/24 is directly connected, GigabitEthernet0/1The event snmp command monitors a specific OID (CPU busy percentage) every 10 seconds, triggering when the value exceeds 90. Action 1.0 logs the CPU percentage. Action 2.0 captures the top CPU processes. Action 3.0 shows the routing table. The output shows the triggered syslog with 95% CPU, the CPU utilization line, and the routing table, which helps diagnose the cause of high CPU.
Understanding the Output
The output of an EEM applet is not a single command output but rather the result of actions triggered by the event. When an applet triggers, it executes actions sequentially, and the output appears in the console or syslog. Key fields to interpret: syslog messages from action 1.0 show the applet name and custom message; CLI command outputs (from action cli command) show the results of those commands. In a real network, you would monitor syslog for these messages or use 'show event manager history events' to see triggered events. Good values: actions complete without errors. Bad values: actions fail due to syntax errors or missing commands. Watch for: applets not triggering due to incorrect event patterns or SNMP OIDs; ensure the event is properly defined and the applet is enabled (no shutdown).
CCNA Exam Tips
CCNA 200-301: EEM applets are configured in global config mode using 'event manager applet [name]' and then defining event and action statements.
Common exam scenario: You need to automate a response to an interface flapping — use event syslog pattern matching the interface up/down message.
The exam may test that actions are numbered (e.g., action 1.0, action 2.0) and executed in order; you cannot skip numbers.
Remember that EEM applets can use environment variables like [event.priority] and [event.oid-value] to insert dynamic values.
Common Mistakes
Mistake 1: Forgetting to exit EEM applet configuration mode with 'exit' or 'end' before testing, causing the applet to be incomplete.
Mistake 2: Using incorrect event syslog pattern syntax — the pattern must match exactly, including spaces and special characters; use quotes for patterns with spaces.
Mistake 3: Not enabling the applet with 'event manager applet [name]' and then 'no shutdown' (though by default applets are enabled after creation).
Practice for the CCNA 200-301
Test your knowledge with hundreds of CCNA practice questions covering all exam domains.
Practice CCNA Questions