Command or Action
Step 4
event [tag event-tag] cli pattern regular-expression sync {yes
| no skip {yes | no}} [occurs num-occurrences] [period
period-value] [maxrun maxruntime-number]
Example:
Device(config-applet)# event tag 1.0 cli pattern
"show bgp all"
sync yes occurs 32 period 60 maxrun 60
Step 5
trigger [occurs occurs-value] [period period-value]
[period-start period-start-value] [delay delay-value]
Example:
Device(config-applet)# trigger occurs 1 period-start
"0 8 * * 1-5" period 60
Step 6
correlate {event event-tag | track object-number}
[boolean-operator event event-tag]
Example:
Device(config-applet)# correlate event 1.0 or event
2.0
Step 7
attribute tag event-tag [occurs occurs-value]
Example:
Device(config-applet)# attribute tag 1.0 occurs 1
Step 8
action label cli command cli-string
Example:
Device(config-applet)# action 1.0 cli command "show
pattern"
Examples
In the following example, applet is run if the show bgp all CLI command and any syslog message that contains
the string "COUNT" occurred within a period 60 seconds.
event manager applet delay_50
event tag 1.0 cli pattern "show bgp all" sync yes occurs 32 period 60 maxrun 60
event tag 2.0 syslog pattern "COUNT"
trigger occurs 1 delay 50
correlate event 1.0 or event 2.0
attribute tag 1.0 occurs 1
attribute tag 2.0 occurs 1
action 1.0 cli command "show pattern"
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
How to Write EEM Policies Using the Cisco IOS CLI
Purpose
Specifies the event criteria for an EEM applet that is
run by matching a Cisco IOS command-line interface
(CLI) command.
Specifies the complex event configuration parameters
for an EEM applet.
Specifies a complex event correlation in the trigger
mode for an EEM applet.
Note
When "and" is used to group events such as
traps or syslog messages, then the default
trigger occurrence window is three minutes.
Specifies up to eight attribute statements to build a
complex event for an EEM applet.
Specifies the action of executing a CLI command when
an EEM applet is triggered.
1711