CCNP ENCOR reference
IOS EEM Applets Quick Reference
On-device, event-driven automation with no external dependency — tested in ENCOR objective 6.9.
Why EEM specifically
Runs entirely on-device — no external connectivity, controller, or scripting infrastructure needed. Genuinely valuable for fast, local, device-autonomous remediation where waiting for an external system would be too slow, or connectivity to one can't be assumed.
Applet structure
event manager applet <name> — names it and enters its config sub-mode.
event syslog pattern "<exact match>" (or event track, and other detector types) — defines the trigger. Pattern matching requires PRECISE format matching against the device's actual syslog output; a plausible-looking abbreviation (Gi0/1 vs. GigabitEthernet0/1) silently fails to match.
action <seq> cli command "..." / action <seq> syslog msg "..." — actions execute in numbered sequence. Enter privileged EXEC ('enable') before any action requiring that privilege level.
Scope EEM appropriately
Best for fast, local, well-defined remediation on a single device. Complex, multi-device, or business-logic-heavy automation is generally better suited to external tools with broader network visibility.