ENCOR (350-401) Topic 6.6 - Embedded Event Manager (EEM)

[Music] hey welcome back to the channel everybody this is kevin and in this week's video we're going to take a look at a topic from the encore exam specifically we're going to be checking out the embedded event manager or the eem feature and as an example of what the embedded event manager can do for us it can watch a router for a specific event and if that event occurs that can trigger an action or set of actions in this video we're going to take a look at the theory of eem as well as take a look at a demonstration and as always if you enjoy this video please do me a favor give me a like down below and subscribe so you don't miss any of our weekly content now enjoy this encore training on the embedded event manager let's take a look at cisco's embedded event manager feature or we say eem for short eem you can think of it sort of like an event statement if this event occurs then do this or then perform this set of actions and that if then statement if you want to think of it like that makes up an eem policy and there are two main types of embedded event manager policies we have applets and scripts between the two applets is the simpler one to configure scripts they're going to use a programming language called tcl or tickle scripts and that's a fairly simple programming language but it's still something we would have to learn and it's not specifically designed for eem so the good news is on the encore exam blueprint cisco tells us that we are only responsible for knowing how to use applets and eem is going to be using event detectors to determine when something noteworthy happens as a few examples an event detector could monitor snmp messages syslog messages counters timers the status of an ipsla configuration or netflow and when an event is detected an action or actions can be performed and when i say we're going to perform an action or a set of actions that's going to be determined by the applet or the scripts and since applets are written in the cli of your cisco ios device the actions that you can take that's going to vary based on what version or flavor of cisco ios that you're running at the moment and the structure in which all of this is contained is called an eem policy also known as an event subscriber specifically an eem policy defines what we're wanting to monitor which event detector we're using for that monitoring and what we do if a specific event is detected now let's take a high level graphical view of all these different pieces and parts at the top level we have embedded event manager applets and scripts and we could use either one of those or both of those to create an eem policy now remember that an embedded event manager policy defines what is classified as an event and what action or actions we should take in response to that event and this policy is contained within the embedded event manager also connected to our eem are event detectors and here we see a few examples of event detectors including syslog timers the command line interface and in these examples syslog is going to get its data from the syslog message queue and the timer options that's going to use hardware timers the cli detectors they're going to get their information from the cisco ios parser now again these are just a few examples of some possible event detectors that we could select from but to demonstrate this let's go out to an interface and configure the embedded event manager all right let's configure the embedded event manager and i created a really simple topology and by the way i'm doing this inside of boson's netsim product their network simulator and if you want to check it out i've got a link in the description it's an affiliate link so i get a few bucks if you end up buying it but it's really cool for labbing up your own topologies not to mention they have a plethora of pre-built labs with tasks that you're challenged with and then complete walk-through solutions so it is a great way to get hands-on experience again check out that link in the description but what we're going to do in this basic demonstration is we're going to assume r1 is going to go to r2 to get to the internet and we want to say if anybody goes in and administratively shuts down that link going over to r2 which by the way is interface gigabit zero slash zero if anybody shuts that down we want to bring it right back up because they just killed our internet access so the event we're looking for is a syslog message on screen saying this interface went down and the action we want to take is to bring that interface back up let's start this little simulation that i built and here we are on r1 and when we started the simulation you saw that the interface changed state to up well it's going to change state to administratively down when we shut it down but let's make sure we know exactly what it's going to do let's go into interface gigabit 0 0 and let's do a shutdown and we want to make a note of this this is the syslog message that we're looking for if that ever pops up in a syslog message ding ding ding that's going to be a match and we're going to take an action in response to that event now let me bring this back up i'll do a no shut to bring this back up and now let's configure eem remembering that the encore exam blueprint says we are only responsible for applets not scripts so we'll say event manager let's do some context sensitive help and we're going to specify an applet let's name it auto hyphen no hyphen shut and we can monitor for different types of events we want to monitor for a syslog event specifically we want to monitor for a syslog pattern and i'm going to put this in quotes interface gigabit ethernet 0 0 comma changed state to administratively down close quote that's the event we're looking for now what actions are we going to take in response to that event and if we have multiple actions we can number them so they're executed sequentially i'm going to start off with action 1.0 and the action is going to be to issue a cli command i'll say action 1.0 is to issue a cli command of i'll put this in quotes enable because i want to go into privilege mode then i'll say action 1.1 cli command configure terminal action 1.2 cli command let's go into interface gigabit 0 0 and finally action 1.3 is the cli command to do a no shutdown so if it ever goes down administratively notice we are looking for administratively shut down not something that just happened to the wire and shut it down but if it's administratively shut down we're going to bring it right back up and we're done how about we test it now to test it let's go into interface gigabit zero slash zero and i'm gonna do a shutdown and when i do this it should come up on screen and say interface gigabit ethernet zero slices zero changed state to administratively down and that's going to be the syslog event that we're waiting for when eem sees that it's going to say ding ding ding we've got a match i need to execute these actions specified in this applet let's go into privilege mode let's go into global configuration mode into interface gig zero slice zero and then we'll do a no shutdown so let's see what happens we press enter oh look at that almost instantly it goes down and then it comes right back up again the reason it came back up was because of our embedded event manager applet and i hope you enjoyed this look at a topic from the encore exam blueprint and boson they have an entire collection of encore labs with specific tasks so if you want to get some hands-on experience check out my affiliate link down below i highly recommend it to get your hands-on experience with your ccna studies your encore studies and your narcy studies again link down below thanks for joining me we'll see you next time

Channel: Kevin Wallace Training, LLC

Views: 3,796

Keywords: eem, embedded event manager, CCNA, CCNP, CCIE, 200-301, 350-401, 300-410, cisco, cisco networking, cisco cert, encor, enarsi, #kwtrain

Id: 32VZDHCrU-4

Length: 8min 38sec (518 seconds)

Published: Wed Apr 14 2021