|
0:00:13
|
Our last topic here in system management is the Embedded
|
|
0:00:16
|
Event Manager or EEM scripting
|
|
0:00:19
|
which as I mentioned before is used for automation of the router
|
|
0:00:25
|
but it's unlikely that this is going to be a highly tested on in the exam.
|
|
0:00:30
|
The reason why is that along with TCL, it's basically a full
|
|
0:00:33
|
programming language
|
|
0:00:35
|
so unless you're already familiar with network scripting to begin with
|
|
0:00:39
|
then it's going to be kind of a stretch to get into the EEM.
|
|
0:00:44
|
Now there's a lot of great resources on Cisco's website that
|
|
0:00:47
|
talk about EEM, there's also a lot of prebuilt scripts that you can
|
|
0:00:51
|
download for free, the problem is just like in any of the other
|
|
0:00:55
|
topics on Cisco's website, you're not going to have access to this
|
|
0:00:59
|
stuff in the documentation.
|
|
0:01:01
|
So if they were to test you on this, it's very very likely that the
|
|
0:01:06
|
scenarios are going to be very similar to the configuration
|
|
0:01:09
|
examples in the documentation
|
|
0:01:11
|
so we'll talk about what are some of the different options that we
|
|
0:01:15
|
can configure the applets for, what are the different variables
|
|
0:01:18
|
for looking at the command line, the command line output, the
|
|
0:01:22
|
SNMP MIBs, but mainly if you look at the documentation
|
|
0:01:25
|
examples, you should be able to piece together anything that you
|
|
0:01:29
|
need at least within the scope of the lab exam.
|
|
0:01:33
|
Now for a real implementation if you go to Cisco's website
|
|
0:01:38
|
and search for the Cisco Beyond Community which is for the Embedded
|
|
0:01:46
|
Event Manager.
|
|
0:01:48
|
Specifically what this is, is a collection of scripts that
|
|
0:01:52
|
people have written and then uploaded to Cisco's database.
|
|
0:02:00
|
So some of these are really useful in production if you look at like the
|
|
0:02:06
|
let's say network management
|
|
0:02:08
|
one of these that I have used before that's very useful is the
|
|
0:02:14
|
Catalyst 6500 green script.
|
|
0:02:19
|
It says, 'In an attempt to conserve power, these two scripts will shut down
|
|
0:02:24
|
inline powered devices at 9 pm and then start them back at 6 am.
|
|
0:02:28
|
The aim is to conserve power overnight when no one is using inline powered devices.
|
|
0:02:34
|
So let's say if for example you have a lot of IP phones that are using
|
|
0:02:37
|
inline power on your 6500s or 4500s, you can configure the
|
|
0:02:43
|
EEM script to basically go into the command line, go to the link
|
|
0:02:49
|
level and say no power inline, then once the scheduler starts
|
|
0:02:54
|
again at 6:00 in the morning, it goes into global config,
|
|
0:02:57
|
goes into the interface and says power inline.
|
|
0:03:01
|
So it's essentially turning your phone on and off or turning
|
|
0:03:03
|
maybe your access point on and off.
|
|
0:03:08
|
So if you are interested in EEM, I definitely recommend to
|
|
0:03:12
|
look through these. Some of these are really interesting that they can
|
|
0:03:15
|
be used to send you a text message on your phone or
|
|
0:03:19
|
some advanced formatting for e-mail messages.
|
|
0:03:25
|
You can see some of these are for XML formatting as well.
|
|
0:03:30
|
But within the scope of the lab exam, pretty much any of the stuff
|
|
0:03:33
|
is just going to be based on the configuration guide examples.
|
|
0:03:38
|
So specifically this is going to be under the network management
|
|
0:03:42
|
configuration guide
|
|
0:03:45
|
then under the embedded event manager.
|
|
0:03:51
|
So if we look at the EEM overview
|
|
0:03:57
|
then specifically towards the end
|
|
0:04:03
|
and it actually may be in the next document which is the
|
|
0:04:09
|
writing embedded event manager policies using the IOS CLI
|
|
0:04:17
|
configuration examples.
|
|
0:04:30
|
Now specifically the different types that EEM supports
|
|
0:04:34
|
are based on these different event handlers
|
|
0:04:37
|
that are based on different events occurring in the
|
|
0:04:42
|
the router whether this is things like a timer going off
|
|
0:04:45
|
or some sort of syslog message coming up or some sort of manual
|
|
0:04:49
|
command line keywords that were entered into the exec process
|
|
0:04:54
|
that's going to trigger what the applet watches before it actually runs.
|
|
0:05:00
|
Now we can also tell the applet to run manually
|
|
0:05:03
|
which means that it has no event associated with it.
|
|
0:05:06
|
But generally for automation, this is going to be watching some
|
|
0:05:11
|
for some sort of event to occur before it actually triggers.
|
|
0:05:16
|
Now the EEM scripting, this is going to be based on TCL
|
|
0:05:21
|
which again is that full blown open source scripting language.
|
|
0:05:24
|
So it's very unlikely that they're going to test on this in the exam.
|
|
0:05:30
|
For the applets those are the ones that will have the configuration
|
|
0:05:33
|
examples in the documentation.
|
|
0:05:36
|
Now the first one that we have is the command line detector
|
|
0:05:40
|
which uses the different variables CLI message, CLI message count
|
|
0:05:44
|
and CLI result
|
|
0:05:49
|
where in this particular case it says we have an applet that is called
|
|
0:05:52
|
the show run filter, it's going to look for any one
|
|
0:05:55
|
issue in the command show run, but it's going to replace this
|
|
0:06:01
|
with show run excluding the keyword user name.
|
|
0:06:07
|
Then it's going to put the result of that basically echo that
|
|
0:06:10
|
to the command line and then exit.
|
|
0:06:13
|
So if we were to actually try this out on the command line
|
|
0:06:19
|
let's say we go to Router 5 here
|
|
0:06:26
|
and let's put this into Notepad here
|
|
0:06:31
|
and the syntax does have to be exact because just like
|
|
0:06:34
|
TCL, it's going to be exact programming syntax
|
|
0:06:40
|
so most of this from the context sensitive help, it's really not going
|
|
0:06:43
|
to help you out that much. You're better off using the examples that
|
|
0:06:47
|
they show in the documentation and then changing that around to
|
|
0:06:50
|
meet whatever specific requirements you need.
|
|
0:06:53
|
So the applet's name is show_run_filter
|
|
0:07:00
|
The actions 1.0, 2.0, 3.0 those are essentially the line numbers.
|
|
0:07:06
|
So now the applet is running in the background.
|
|
0:07:09
|
If I were to say show run
|
|
0:07:12
|
it's going to give me that output,
|
|
0:07:15
|
but it's not including the user names.
|
|
0:07:19
|
So if we were to -- let me make this a little more obvious
|
|
0:07:21
|
let's say show run exclude interface.
|
|
0:07:27
|
So now it should not show us the interface names
|
|
0:07:38
|
so let's delete it and then reapply it.
|
|
0:07:49
|
So it's looking for the CLI pattern
|
|
0:07:51
|
which is show run
|
|
0:07:56
|
it found it now and notice it's excluding the interface names.
|
|
0:08:04
|
So essentially anything that you can match in the command line
|
|
0:08:07
|
you can then call it from EEM
|
|
0:08:10
|
the problem is that you would have to know the syntax exactly.
|
|
0:08:14
|
So when you look at the documentation and there's
|
|
0:08:17
|
some pretty good examples of how to do this. This next one
|
|
0:08:21
|
is using a watchdog timer which basically means it's checking every
|
|
0:08:25
|
20 seconds. It says, 'The following example shows a policy named
|
|
0:08:30
|
EventPublish_A runs every 20 seconds.'
|
|
0:08:34
|
'Publishes an event numbered 1 to an EEM subsystem numbered 798.'
|
|
0:08:41
|
'A second policy is registered to run when EEM event 1 occurs.'
|
|
0:08:47
|
'It sends a message to syslog containing the data passed as an argument.'
|
|
0:08:55
|
So we should basically see every 20 seconds if we were to try this
|
|
0:09:01
|
that this is going to run.
|
|
0:09:14
|
We can see these are generated as severity number 6 logs
|
|
0:09:18
|
for EM which is the event manager, then this is the
|
|
0:09:22
|
specific string that they've specified in the script.
|
|
0:09:27
|
So essentially, this is just running a log every 20 seconds.
|
|
0:09:30
|
But we could change this to run whatever particular
|
|
0:09:34
|
event that we want. Run whatever action we want every
|
|
0:09:38
|
20 seconds. Ok, this one here, the CLI event detector,
|
|
0:09:44
|
which is what I was showing with our previous example
|
|
0:09:47
|
their example says, 'Look for the write mem'
|
|
0:09:50
|
and then generate the output command executed.
|
|
0:10:05
|
Now what's interesting about this is that I don't need to
|
|
0:10:08
|
say the entire string 'write mem'
|
|
0:10:11
|
If I were to say rw m
|
|
0:10:15
|
or actually rw... wr mem
|
|
0:10:25
|
it caught that as well.
|
|
0:10:27
|
So as long as the command is not ambiguous, then the CLI
|
|
0:10:32
|
detector should be able to find it
|
|
0:10:34
|
which is the event CLI pattern.
|
|
0:10:41
|
Another one would be to issue CLI commands.
|
|
0:10:47
|
So based on a particular event, we could say every
|
|
0:10:50
|
60 seconds I want to make sure that the router saves its config.
|
|
0:10:55
|
In this case, they're saying, 'clear the counters'
|
|
0:10:58
|
on Fast Ethernet0/1
|
|
0:11:01
|
then wait for it to say 'confirm'
|
|
0:11:04
|
and then issue the command 'y' which means 'yes'
|
|
0:11:07
|
so it's going to clear the counters.
|
|
0:11:09
|
For the timer events their example there on the documentation
|
|
0:11:12
|
was using the watchdog timer which is periodically.
|
|
0:11:16
|
We could also say to do this at an absolute timer.
|
|
0:11:20
|
So every -- or once in three hours from now, we could run
|
|
0:11:25
|
the script. Ok, we're at the countdown timer.
|
|
0:11:30
|
In this particular example, it says, 'issue the write terminal.'
|
|
0:11:35
|
or show run
|
|
0:11:37
|
and then e-mail it to me every five minutes.
|
|
0:11:40
|
So action mail server is specific syntax that's telling
|
|
0:11:44
|
us who is the SMTP server.
|
|
0:11:47
|
Who is the destination address in this case noc@INE.com
|
|
0:11:51
|
the from address, the subject then the body is the $_cli_result
|
|
0:11:58
|
so that's the output from when I issued the command 'write terminal'
|
|
0:12:03
|
so that variable $_cli_result is changing every time you
|
|
0:12:09
|
issue a CLI command.
|
|
0:12:11
|
It also supports a KRON timer for scheduling
|
|
0:12:16
|
where it's saying the particular minute that you want to run
|
|
0:12:20
|
the event followed by the hour in 24-hour format
|
|
0:12:25
|
the month -- or the day of the month and the day of the week
|
|
0:12:29
|
where zero is Sunday. In this particular example it says
|
|
0:12:34
|
on minutes 15 and 16 of 13:00 hours, so 1 pm, I don't care what day of the
|
|
0:12:45
|
month is and I don't care what month of the year it is
|
|
0:12:52
|
as long as it's days 1 through 5 which is Monday through Friday.
|
|
0:12:57
|
So it says at 1:15 and 1:16 every Monday, Tuesday, Wednesday,
|
|
0:13:02
|
Thursday, Friday it's going to run that event.
|
|
0:13:07
|
So you can schedule it as to whatever you want.
|
|
0:13:10
|
So this would be maybe I wanted backup my config every 5 am
|
|
0:13:14
|
Monday through Friday.
|
|
0:13:16
|
We could tell it to match on syslog patterns.
|
|
0:13:20
|
In this case it's saying look for the syslog message that says
|
|
0:13:25
|
interface serial 0/0/0.* which is regex syntax that says
|
|
0:13:31
|
dot is any character, asterisk is zero or more instances
|
|
0:13:37
|
so basically it's saying look for the string that is interface serial 0/0/0
|
|
0:13:45
|
followed by anything, then it says changed, it has anything
|
|
0:13:53
|
and then it says down
|
|
0:13:58
|
once that happens, it's going to go into global config, it's going to
|
|
0:14:01
|
go to the interface level, then say no shut down
|
|
0:14:07
|
go back to exec mode look at the users and then output that
|
|
0:14:10
|
syslog message, so let's try this one out and again,
|
|
0:14:13
|
the problem with this is, is that the syntax has to be exact
|
|
0:14:15
|
so unless you're already really good at programming a syntax to begin with
|
|
0:14:19
|
then most of this you're going to have to figure out based on the
|
|
0:14:23
|
examples in the documentation.
|
|
0:14:25
|
So as you could probably guess, they're not going to expect that you're
|
|
0:14:29
|
an expert in this. If they are testing you on anything
|
|
0:14:35
|
you just need to know where to reference this in the configuration guide
|
|
0:14:37
|
and then how to piece their examples together.
|
|
0:14:50
|
This says at changed there was a syntax error.
|
|
0:15:04
|
There we go. It had an extra line.
|
|
0:15:14
|
So now if I go to interface s0/0 and shut it down
|
|
0:15:26
|
it went to the interface and it brought it back up.
|
|
0:15:29
|
Then it generated a log message that says, 'EEM: interface_shut down'
|
|
0:15:33
|
which was the event that was triggered.
|
|
0:15:37
|
So you could see there's a lot of cool stuff you can do with this
|
|
0:15:40
|
but the problem is, it's a full blown scripting language.
|
|
0:15:43
|
So unless you're really good with this stuff to begin with
|
|
0:15:46
|
it's going to be hard to figure out how to piece this together.
|
|
0:15:48
|
Ok, this one is for tracking interface counters
|
|
0:15:53
|
which would mean that you have to know exactly what the
|
|
0:15:56
|
interface parameters are. In this case, it's saying
|
|
0:15:58
|
look at the received load of the link. If it's greater than
|
|
0:16:05
|
this particular value, and we're polling it every 30 seconds
|
|
0:16:10
|
then it's going to shut the interface down.
|
|
0:16:13
|
We can also track SNMP objects
|
|
0:16:16
|
just like I mentioned before, the issue with SNMP is that
|
|
0:16:19
|
you would need to know exactly what the MIB is
|
|
0:16:22
|
where in this case, this is the MIB's name
|
|
0:16:26
|
in that OID format.
|
|
0:16:30
|
Specifically that's based on the CPU utilization.
|
|
0:16:34
|
Now I believe there is an example of this in that particular document.
|
|
0:16:40
|
Configuring EEM if you look for CPU
|
|
0:16:47
|
this says, 'The following example shows how to specify the event
|
|
0:16:50
|
criteria based on an embedded resource manager event.'
|
|
0:16:58
|
So there's also a feature that is the ERM
|
|
0:17:03
|
and the EMM and ESM
|
|
0:17:08
|
so these three are also related to the embedded event manager
|
|
0:17:11
|
we're at the resource manager
|
|
0:17:17
|
we'll look for CPU here
|
|
0:17:23
|
CPU resource owner it says, 'ERM feature
|
|
0:17:25
|
uses the existing loadometer process to calculate load information
|
|
0:17:29
|
displayed by the show proc CPU.'
|
|
0:17:32
|
'This method generates a report of extended load statistics and adds
|
|
0:17:35
|
it to a circular buffer every five seconds.'
|
|
0:17:39
|
Well let's see if they have an example of this.
|
|
0:17:46
|
So you could just search through this document for CPU
|
|
0:18:02
|
but as you can see again, a lot of the syntax is not really straightforward.
|
|
0:18:05
|
So it is a real neat feature, there's a lot of flexibility this gives you
|
|
0:18:09
|
as to not have to do this scripting externally because
|
|
0:18:14
|
typically you would write something like this in PERL or
|
|
0:18:16
|
Expect in some sort external Unix or Linux machine
|
|
0:18:19
|
and then run the scripting from there, but with the EEM
|
|
0:18:22
|
it's then giving you the flexibility to do it right from the routers
|
|
0:18:25
|
and the switches themselves.
|
|
0:18:27
|
Ok, another thing that's really useful is to track objects.
|
|
0:18:32
|
So if based on HSRP or based on my IP routing
|
|
0:18:36
|
I'm tracking some enhanced objects to reroute the network
|
|
0:18:41
|
or change my active status for HSRP. Once the object
|
|
0:18:46
|
state changes, maybe I want to generate some sort of action.
|
|
0:18:51
|
So if my HSRP router goes to the standby state,
|
|
0:18:56
|
then I'm going to tell the router to send me an e-mail.
|
|
0:18:58
|
Then you can see in this output you can get into complex logic loops
|
|
0:19:03
|
if, then, else, for loops
|
|
0:19:07
|
this one's also matching a regular expression.
|
|
0:19:10
|
It says that the regular expression result is
|
|
0:19:12
|
equal to true, then continue, if not go to enable
|
|
0:19:16
|
say clear counter on the interface and say yes. But again, the key for
|
|
0:19:20
|
a lot of this is going to be the documentation.
|
|
0:19:24
|
So don't overly worry about these different system management
|
|
0:19:27
|
and IP services topics. As long as you know where this stuff is located
|
|
0:19:32
|
in the documentation, that's really going to be the key.
|
|
0:19:36
|
If you try EEM out once or twice based on the examples
|
|
0:19:40
|
that they're giving you in the documentation, you should be fine.
|
|
0:19:43
|
The other thing that you would want to know about this
|
|
0:19:45
|
is to trigger the event manually
|
|
0:19:51
|
which if we go back to network management
|
|
0:19:55
|
then EEM
|
|
0:20:01
|
and let's look at their configuration examples
|
|
0:20:08
|
which is the event manager run command
|
|
0:20:20
|
which they had an example of it here
|
|
0:20:23
|
let's see event manager run.
|
|
0:20:31
|
So essentially this example just generates a syslog message
|
|
0:20:35
|
but the key is that you're manually executing it
|
|
0:20:37
|
by saying event manager run policy.
|
|
0:20:43
|
So the applet's name is manual-policy
|
|
0:20:47
|
every time I say event manager run
|
|
0:20:50
|
then it's going to issue that.
|
|
0:20:52
|
Ok, the other thing that you would want to know is what are
|
|
0:20:55
|
the particular events that are registered.
|
|
0:20:58
|
If you look at the particular show command here event
|
|
0:21:03
|
show event manager policy registered
|
|
0:21:09
|
this shows the current applets that are running
|
|
0:21:17
|
so it's not outside of the troubleshooting scope that they
|
|
0:21:20
|
have some sort of event running in the background
|
|
0:21:23
|
that's interfering with what's going on
|
|
0:21:25
|
so maybe every time you go to the interface and try to
|
|
0:21:28
|
say no shut down, it goes in there and says shut down for you again.
|
|
0:21:34
|
But you can see this based on show event manager policy
|
|
0:21:38
|
registered that's going to show you what the current
|
|
0:21:40
|
running events are, but again we looked at the network management
|
|
0:21:44
|
and the configuration fundamentals document. Configuration fundamentals
|
|
0:21:48
|
is going to show you a lot of other minor features
|
|
0:21:50
|
that may not be a 100 percent obvious to begin with
|
|
0:21:57
|
so things like the menus of the router.
|
|
0:22:03
|
Some of these are really useful in production like the
|
|
0:22:07
|
configuration replace and rollback or the config diff utility.
|
|
0:22:12
|
This can be used to take snapshots of the configuration
|
|
0:22:16
|
then if you run into a problem, you can roll back to your last known
|
|
0:22:20
|
working configuration
|
|
0:22:23
|
and this goes along with the configuration change notification
|
|
0:22:25
|
and logging.
|
|
0:22:27
|
Specifically the syntax for this on the command line is the
|
|
0:22:31
|
archive
|
|
0:22:37
|
and log config.
|
|
0:22:41
|
And you could specify I want to turn logging on
|
|
0:22:47
|
the number of commands that I'm going to log let's say the maximum a thousand.
|
|
0:22:54
|
So now every time I make a change if I look at the show archive
|
|
0:23:01
|
show archive config
|
|
0:23:06
|
or show archive log
|
|
0:23:13
|
let's say all
|
|
0:23:15
|
so the console issued logging enable
|
|
0:23:18
|
and the logging size.
|
|
0:23:20
|
If I say logging console 7
|
|
0:23:26
|
we see now that in the archive.
|
|
0:23:28
|
So again, the key for a lot of these management features
|
|
0:23:32
|
you simply need to read through the documentation.
|
|
0:23:36
|
Once you know that these features are available, you can
|
|
0:23:38
|
always come back to this at the exam time
|
|
0:23:41
|
but the problem is in the exam if you don't know about this to
|
|
0:23:43
|
begin with, you're not going to have enough time to read through
|
|
0:23:46
|
the documentation to figure this stuff out.
|
|
0:23:49
|
So make sure you always know the path of these different
|
|
0:23:52
|
documents because you will not be able to use the search engine
|
|
0:23:56
|
and the quicker you can get into the documentation and out and move on
|
|
0:24:00
|
then the more time it's going to give you for troubleshooting
|
|
0:24:03
|
your real core portions of the network.
|
|
0:24:07
|
So these type of features, they're really going to be peripheral
|
|
0:24:10
|
and you want to kind of think of these as easy points in the exam.
|
|
0:24:14
|
Things like OSPF, BGP, redistribution, MPLF, MPLS that's the stuff that's
|
|
0:24:20
|
typically going to be very time consuming in the exam
|
|
0:24:23
|
that you need to make sure that you can the other stuff
|
|
0:24:25
|
out of the way as quickly as possible, so you can really
|
|
0:24:29
|
focus on at those core design problems of routing and of switching.
|
