EEM Cisco IOS Embedded Event Manager

Hi All,

Preparation for the CCIE lab is not an easy journey and we all know it. For the past 4-5 weeks I have been revising all core and “not core” topics to make sure that there’s literally nothing that can surprise me.

Cisco IOS has plenty of little IOS tricks we can execute and watch the console for hours but without any doubt if you’re up for a proper breaking/fixing and having fun the Embedded Event Manager is the best.emm

Not longer then two weeks ago I spoke to one of my CCIE colleague who have passed V4 lab exam after fourth attempt and he told me one thing , “watch out for EEM cause it is highly unlikely you wont get it in your lab” and to make things worse , on his second attempt he actually got it twice , in the TS section and then in the CONF section so the point is that if you know where it is located in the DOC CD which by the way the path is

Products –>
Cisco IOS and NX-OS Software –>
Cisco IOS –>
Cisco IOS Software Release 12.4 Family –> 
Cisco IOS Software Release 12.4T –>
Configuration Guides –>
Embedded Management –>
Embedded Event Manager Configuration Guide, Cisco IOS Release 12.4T

you then will most likely be able to pass the CONF section cause you can simply look it up in the DOC CD during your exam and piece it all together in order to create a script based on what they are asking for in the question but the problem becomes when you’re being asked to fix the EEM script in the TS section when you are not suppose to spend more then 10mins on each question cause you will most likely fail your lab what obviously makes sense cause in your company’s network when there’s a some sort of major outage your management expects you to fix it asap and not in 2 , 7 or 10 hours so the idea is that if you’re not familiar with the EEM there is a huge possibility that you will fail your lab , don’t hate me for it 🙂 it is simply what I have been told very recently !

The funny thing with EEMs is that they make “kind of” sense if you break them down but then when you start configuring your own it just gets messy so practise and repetition is the only key. I have created and gathered some of example that are not available on Cisco website and which are likely to be asked on your lab !


event manager applet NO-EIGRP-or-OSPF
event cli pattern “router [eEoO].*” sync no skip yes
action 01.0 syslog msg “No EIGRP or OSPF please”
action 02.0 mail server “” to “” from “” subject “Someone is trying to enable EIGRP or OSPF on me” body “message is in the subject line”


event manager applet DODAMAGE
event cli pattern “interface [Ll].*” sync no skip no
action 01.0 syslog msg “Messing with the router”
action 02.0 cli command “enable”
action 03.0 cli command “config term”
action 04.0 cli command “hostname Messed-up”
action 05.0 cli command “interface et0/0”
action 06.0 cli command “shut”
action 07.0 cli command “no ip add”
action 08.0 syslog msg “Your router is messed up”
action 09.0 syslog msg “You may want to reload or do some recovery etc… :)”


event manager applet INT-DOWN
event syslog pattern “Interface Et.*changed.*down”
action 01.0 syslog msg “I believe that an interface has just gone down!”


event manager applet INTERFACE
event syslog pattern “changed state to administratively down”
action 01.1 cli command “enable”
action 02.1 cli command “configure terminal”
action 03.1 cli command “interface loo 0”
action 04.1 cli command “ip add”
action 05.1 cli command “no shut”
action 06.1 syslog msg “all sorted Loopback 0 is now up on your router”


event manager applet RESTORE
event tag 1 cli patter “help” sync no skip yes
action 01.0 syslog msg “Cool let me help you restore the router”
action 02.0 cli command “enable”
action 03.0 cli command “configure replace nvram:startup-config force”


event manager applet DisableReload
event cli pattern “reload” sync no skip yes occurs 1
action 1.0 syslog msg “$_cli_msg has been disabled.”


Now although there are endless number of options within EEM (as seen in below output)


and under each option there are more options and suboptions and menus etc …above I’ve created based on the information I’ve gathered from people who have passed the LAB. The biggest confusion is most definitely the sync/skip parameter so I thought I’d allow myself to paste this table from Cisco website in case you have not seen it or not been able to find it !



Once again to configure the script should be relatively easy if you get it in your TS section and you don’t know how to create in the first place then you’re in trouble 🙂

Enjoy your EEM and good luck with your preparation !




About ccie4all
Hello, and welcome to the first post of my CCIE blog This blog has got one simple goal and that is to improve our skills in Cisco Networking field so we can become best engineers on a job market. Wordpress Blog information about the changes made to Gns3 BGP , MPLS and R&S CCIE labs. In order to access and download all provided materials and receive important updates from Gns3 BGP , MPLS and R&S CCIE labs under GNS3 tab in the main header please go ahead and subscribe to ! All other posts have not been affected and can be accessed at any given time. Enjoy ! Tom

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: