This discussion is locked


Unanswered Question
Feb 23rd, 2010

Welcome to the Cisco Networking Professionals Ask the Expert conversation. This is an opportunity to learn more about embedded management technologies with Cisco expert Joe Clarke.  Joe serves as a distinguished engineer for network management in North Carolina. With Cisco since 1998, he  focuses on network management issues, particularly those pertaining to CiscoWorks, Tcl scripting, and embedded management technologies. He holds CCIE certification #5384 and is also a certified Java programmer, Solaris system admin, Solaris network admin, and Solaris security admin.

Remember to use the rating system to let Joe know if you have received an adequate response.

Joe might not be able to answer each question due to the volume expected during this event. Our moderators will post many of the unanswered questions in other discussion forums shortly after the event. This event lasts through March 12, 2010. Visit this forum often to view responses to your questions and the questions of other community members.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
devsharma Thu, 02/25/2010 - 12:45

Hi Joe,

How can I make use of EEM to minimize downtime? As I understand that EEM is capable of pro-active notifications. Could u please explain this?



Joe Clarke Thu, 02/25/2010 - 21:31

There is a lot you can do with EEM to minimize downtime.  Your info about pro-active notifications is correct.  EEM can detect when an event occurs (e.g. an interface goes down, an IP SLA collector times out, a route disappears, SNMP object value crosses a certain threshold, etc.), then send a syslog message, email, or SNMP trap with additional details.  One other thing EEM can do instead of simply sending out a notification, is to reconfigure the device to make sure connectivity stays up.  For example, say your primary uplink fails (maybe you are using IP SLA to test connectivity to a remote address).  When this happens, EEM can run the CLI commands necessary to bring up redundant interfaces, change the routing table, etc. to restore connectivity over a new path.

If you have a specific example in mind, let me know, and I'll provide you with some example code.

devsharma Mon, 03/01/2010 - 07:41

Thanks for the response. Is there a place on CCO which explains the usage of EEM

and also some example configs for common scenarios?



Joe Clarke Mon, 03/01/2010 - 09:08

You can find an overview of the feature as well as links to the config and programming guides at .  There is a great scripting repository with Cisco and customer-contributed scripts at .  We also have a new initiative at Cisco called Embedded Automation Systems which is aiming to make EEM easier to use.  You can get information on EASy at .

lchance Fri, 02/26/2010 - 14:16

Hello Joe,

Can you tell me which routers and IOS provide EEM?

Also, I'm curious about something you stated "...CLI commands necessary to bring up redundant interfaces, change the routing table, etc. to restore connectivity over a new path." It gives me an idea for something we are about to implement.

We're about to use an EIGRP MULTILINK (T1s) for a backup link. The primary is now BGP MPLS. But we want to use the MULTILINK while failover is not active, using it for some high-volume replication traffic. And then once there is failover we want to stop the subnets sending the high-volume replication traffic to allow EIGRP MULTILINK full bandwidth access. This may not be enough information to make a good judgment but do you see where EEM could be used to automate some of this. I assume it would involve TCL.



Joe Clarke Sat, 02/27/2010 - 10:19

EEM is now available in a wide variety of platforms an IOS versions.  The first truly usable version of EEM was introduced in 12.3(14)T, and has been merged to a large number of other platforms.  You can use the Feature Navigator at to find out what version of EEM your platform supports.  But based on your diagram, all these devices are EEM-capable.

Yes, the situation you describe would be a good fit for EEM.  No, I do not think Tcl will be required here.  I think applets will be able to accomplish what you want.

20vek Mon, 03/01/2010 - 10:56

Hi Joe. Is EEM supported on ACS1120 appliance?

Thank you,

Joe Clarke Mon, 03/01/2010 - 12:48

No.  EEM is currently only supported on IOS, IOS-XE, IOS-XR, and Nexus 7K devices.

the_ios_inquisition Tue, 03/02/2010 - 16:42


I have a question about documentation and suggested reading material. To familiarize ourselves with EEM's operation and caveats, have been primarily using the documentation located on Cisco's website. This includes all of the literature contained under the EMM section of the Management Instrumentation product page, as well as the information contained in the IOS Network Management Configuration Guide. We have also found the rough-cut release of the Cisco Press book “TCL Scripting for Cisco IOS” to be very useful. The primary issue I am running into is that I do not have a programming background. Much of the training material for this feature, particularly as it relates to TCL scripting, assumes the reader has some form of a scripting background. I would really like to become more familiar with TCL as a language. There seem to be a fair amount of websites and books on the subject, but I was hoping that you may be able to suggest some material that is the most pertinent to Cisco's specific implementation of TCL.

Thanks for all of your help.

Joe Clarke Tue, 03/02/2010 - 17:49

What you've found thus far is really the most Cisco-centric documentation available.  There really isn't much magic in terms of Tcl scripting on IOS (assuming you already know Tcl).  When it comes to Tcl scripting in EEM, the additional procs are all documented in guides such as .  One book I really like (and one I used to learn Tcl when we started making this available to customers) is  Practical Programming in Tcl and Tk (4th Edition) by Brent Welch.  It was very helpful in learning the language semantics.  Beyond that, it's all about knowing the Tcl functions (or procs) that are available, and how to use them.  The guides on do an okay job of explaining that.

There is also some built-in documentation if you're running a device with EEM 2.4 or higher.  Just run "show event manager detector DETECTOR detailed" from EXEC mode.  This will give you the syntax on how to configure a given event detector in both Tcl and applet modes.  It will also explain the applet environment variables and Tcl event_reqinfo array elements needed to get per-event details.  We are looking to do more of this kind of introspection documentation in the future.

GERARD PUOPLO Thu, 03/04/2010 - 13:14

I have one problem with trying to get an applet using the resource ED to trigger and one comment regarding using the set action to set variable to an empty string.

The problem I have at the moment is the following applet is not triggering for me.  I see the syslog messages from ERM but the EEM applet never triggers.  Is there a step I missed in regards to enabling ERM notifications to the ERM ED ?

resource policy

   policy highcpu global


      cpu total

                critical rising 90 falling 80 interval 60

                  major rising  70 falling 60 interval 60


           user global highcpu

event manager applet highcpu

  event resource policy highcpu

  action 1.0 ….

My comment is if you define in an applet    "action 1.0 set foo "" EEM will throw an error.   This is a bug in my opinion that the set action will not let you set a variable to an empty string. (It actually does it but not without issues.  You can set foo " and it assumes you meant a closing " but that is error ridden in itself.)

thanks in advance for your help

Joe Clarke Thu, 03/04/2010 - 13:57

What version of IOS is this?  ERM and EEM integration is broken in 15.0 due to CSCsu19243.

As for the empty string problem, that is a known issue.  What exactly are you trying to do (big picture-wise).  Maybe a workaround can be devised.

GERARD PUOPLO Thu, 03/04/2010 - 16:53

I am all set now that I know it's CSCsu19243 that is the problem.

As for the empty string problem, it's just a nit I was disappointed to find wasn't fixed in EEM 3.x.


20vek Fri, 03/05/2010 - 06:11

Hi Joe,

The "archive" applet in new version of the IOS for Catalist switches (12.2.33-SXI3) inserts a time stamp into the backup file name. Is there a way to change the applet policy to modify the format of this time stamp? Thank you.

Joe Clarke Fri, 03/05/2010 - 09:09

I'm not entirely sure to which applet you refer.  I know there is a config archive feature in IOS that allows one to take periodic snapshots of the config.  Those snapshot file names can contain the current timestamp.  This format is not configurable.  However, if there is an EEM applet that you are using, posting the applet may help me see what options are available.

the_ios_inquisition Fri, 03/05/2010 - 15:27


I would appreciate if you could help me understand how EEM handles multiple instances of policies running simultaneously. My current understanding is that it's default behavior allows one instance to occur and all other instances are queued. As an example, let's say we have an applet using the Interface Event Detector that is polling the interface every 10 seconds. Instance A of the applet is triggered and the applet runs exactly 15 seconds. 10 seconds after Instance A starts the applet is triggered again, Instance B. My understanding is that Instance B is queued until Instance A has completed. In this situation it would be queued for 5 seconds and then start as soon as Instance A has ended. Am I understanding this behavior correctly? If this is correct, how long will Instance B wait before it eventually times out? Also, is there a way to modify these defaults to allow multiple applets to run simultaneously or even the same applet to run multiple times simultaneously? Is there a way to weight applets differently so that one will have priority over the other if multiple ones are triggered together?

Thanks so much for your help.

Joe Clarke Sat, 03/06/2010 - 07:13

This is a tricky question because it will depend on the version of EEM you have.  In earlier versions of EEM, the scheduler allocated one thread for Tcl, and one thread for applet policies.  This meant that only one policy could run at a time, and others would queue up until that policy completed.  They would remain queued until the running policy finished.  Later versions of IOS granted 32 threads to applets, and still one thread to Tcl policies.  This meant that multiple applets (even instances of the same applet) could execute in parallel.

If you are running a more recent version of EEM, you can use the "show event manager scheduler thread" command to see how many threads have been allocated.  This can be adjusted with the "event manager scheduler applet" and "event manager scheduler script" commands.  You can even create your own customer thread classes, and assign policies to those classes.  This way, you could allow certain policies to execute simultaneously, while forcing others to queue up.

As for priority, you can also change a policies priority if you use Tcl.  When defining your event detector, specify the queue_priority {normal | low | high | last} keyword, and you can adjust that policy's priority in the run queue.  By default, all policies are queued with normal priority.

ahmedbishry Sun, 03/07/2010 - 07:32

/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin-top:0in; mso-para-margin-right:0in; mso-para-margin-bottom:10.0pt; mso-para-margin-left:0in; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:Arial; mso-bidi-theme-font:minor-bidi;}

Hi All,

I have a mesh network with LAP 1522 and WLC 4402 in main site.

I add a branch site to the mesh network, I used to branch site AP 1310 Bridge (WGB role) and behind the WGB there is a Cisco switch 2960 Catalyst, I tried to add a LAP 1130 on this branch but I notice in the monitor the WLC see the new LAP 1130 as a Wired client to WGB and not as a wireless AP, I tried everything I know to make the LAP register on the WLC from the branch site behind the WGB, but it didn’t work, when I bring the same LAP 1130 to main site and put it on the switch it register immediately with WLC, please if there is any one can help me.

Your quick response will be highly appreciated

meezanbank Thu, 03/11/2010 - 00:40

Dear Joe,

Its nice having you here.

My query is short and simple. in EEM when i am sending email using action mail command, can i specify which source address to use always ? or will it take the source address of interface facing the mail server ?

Can i change this to always use IP of my loopback interface or perhaps LAN interface ?

Thanks in advance

Joe Clarke Thu, 03/11/2010 - 09:38

The ability to specify a source IP or interface was added in EEM 3.0.  Prior to that, EEM used the routing table to pick the interface closest to the SMTP server.  In EEM 3.0 and higher, you can specify the source interface with the option "source-interface".  For example:

action X mail from [email protected] to [email protected] server subject Test body $_cli_result source-interface Loopback0

Joe, I am using the Composite Device Health EEM  that sends out an email notification once my interface or CRC errors reach a threshold.  The problem is-- I have to do a clear count to get these emails to stop. I would like for the script to execute, send the email, then clear count.

Something that I think can be done with some action commands, but I do not know where to put them in the script.  The script can be found here:

Any help with this would be appreciated.  

Thank you!


This Discussion