Cisco EEM on NXOS

1. cli match to trigger a syslog msg: (tested on N9K 9.3(10))

event manager applet 1
event cli match “show clock” <—-must enter full command instead of shortened ones
action 1.0 syslog priority critical msg SHOW CLOCK FIRED

Then for this to be triggered, you need to allow eem command to run by bypassing terminal:

terminal event-manager bypass

Actually you need to first trigger the error message: % Command blocked by event manager policy then execute the above bypass command, for the event to be triggered. If for example the bypass is already enabled, then you execute the show command, the event won’t be triggered. You have to first disable it:

terminal no event by

then run the show command to trigger the error “% Command blocked by event manager policy”

then re-enable the bypass, then the event will be triggered.

Not sure if it’s a bug or not.

If you want it to work without having to disable bypass then hit the error then re-enable the bypass, add an action for event-default, then disable terminal bypass:

event manager applet 1
event cli match “show clock”
action 1.0 event-default <–add this
action 1.1 syslog priority critical msg SHOW CLOCK FIRED

2. cli match to trigger a cli command action:

event manager applet 1
event cli match “show clock”
action 0.5 event-default
action 2 cli sh ip int bri vrf all

After this event is triggered, there’s nothing shown on the screen. However, when showing the eem log:

show event manager events action-log policy 1

I see that the command was executed successfully:

IP Interface Status for VRF “default”(1)
Interface IP Address Interface Status

IP Interface Status for VRF “management”(2)
Interface IP Address Interface Status
mgmt0 10.82.138.248 protocol-up/link-up/admin-up
Executing the following commands succeeded:
sh ip int bri vrf all