EEM Embedded Event Manager

EEM Embedded Event Manager 嵌入式事件管理器
之前的任何一种网络管理技术，如SNMP，RMON，在检测到事件发生后，并不能解决问题，这些传统的网管技术只有监测功能，却没有解决故障的功能，
为了更有效的管理网络，能够在事件发生时，便采用有效的动作来杜绝网络问题，Cisco推出更进一步的网管技术—Embedded Event Manager (EEM)。

EEM在正常工作时，能够定期监视指定的事件，当被监测的事件发生后，EEM可以产生指定的信息或指定的动作
EEM共有如下几个组件：
1.EEM server 相当于EEM主程序。
2.Core Event Publishers (Event Detectors) 事件探测器
也就是EEM用于检测事件的组件，负责检测各种定义好的事件，事件的检测可以基于其它网管技术，Event Detectors会在事件发生时向Server报告。
3.Event Subscribers (Policies)
当Event Detector检测到指定的事件发生后，Event Subscribers便执行指定的动作，动作包括产生特定的消息，或执行特定的命令。
EEM Applet
在配置Applet时，共有3种配置状态：Event， Action， Set。
Event 用于定义事件标准，当指定的要求发生或阀值触发时，则表示该事件产生。
Action 当事件发生后执行的动作。
Set 是设置变量的，目前只支持_exit_。
在EEM Applet配置中，**一个Policy策略只支持一个event，**也就是一个Policy只能检测一个事件，如果退出Policy配置时并没有event，则会有警告，表示Applet没有注册成功；但如果没有action，事件照样被检测，只是事件发生后不会执行任何动作，一个Policy中可以配置多个action。
EEM举例
Write a Cisco IOS EEM applet named “BOUNCEGIG” that automates the above task.
User the " %SYS-5-RESTART: " syslog pattern in order to trigger the script when R3 has restarted.
Ensure that the script bounces interface Gig0/0 first then bounces interface Gig0/1.
Test router solution and ensure that there is an entry in the EEM events history similar to the following output.

命令配置

event manager applet BOUNCEGIG
event syslog pattern "%SYS-5-RESTART:" 
 action 1.0 cli command "enable"
 action 2.0 cli command "conf t"
 action 3.0 cli command "int Gi0/0"
 action 4.0 cli command "shut" 
 action 5.0 cli command "no shut" 
 action 6.0 cli command "int Gi0/1"  
 action 7.0 cli command "shut" 
 action 8.0 cli command "no shut”
debug event manager action cli 查看事件执行过程

example-2 OSPF例子
Configure R3 with event manger applet “ENABLE_OSPF_DEBUG” when OSPF neighbor ship goes down with R5 , it should enable the Debug ip ospf events and Debug ip ospf adj
Configure another EEM applet “ DISABLE_OSPF_DEBUG” when OSPF neighbor ship comes up with R5. It should disable all the debug messages.
Make sure that each event generates a syslog message with a priority of 6 that shows the name of the event being activated.
These logs should be seen both in the console and in the log buffer.
You MUST be able to have these events run on R3 when R5 bounces it’s interface.
配置命令

event manager applet ENABLE_OSPF_DEBUG
 event syslog pattern ".*%OSPF-5-ADJCHG:.*Serial0/0/0.*FULL to DOWN.*"
 action 1.0 cli command "enable"
 action 2.0 cli command "debug ip ospf events"
 action 3.0 cli command "debug ip ospf adj"
 action 4.0 syslog priority informational msg "ENABLE_OSPF_DEBUG”
event manager applet DISABLE_OSPF_DEBUG
 event syslog pattern ".*%OSPF-5-ADJCHG:.*Serial0/0/0.*LOADING to FULL.*"
 action 1.0 cli command "enable"
 action 2.0 cli command "un all"
 action 3.0 syslog priority informational msg "DISABLE_OSPF_DEBUG"

example3
On R3 Configure an EEM applet name “Conf_Change” (without the quotes).
The EEM applet use show clock and append to flash:ConfSave.txt .
The EEM applet needs to activate every time someone makes changes to the config. Also, a syslog message has to be generated with the string “Configuration changed”
配置命令
event manager applet Conf_Change \创建EEM
event syslog pattern “%SYS-5-CONFIG_I” \设置按钮，触发EEM
action 1.0 cli command “enable” \创建动作
action 2.0 cli command “show clock | append flash:ConfSave.txt”
action 3.0 syslog msg " Configuration changed "