WEBVTT 00:00:00.000 --> 00:00:11.520 Alright folks, we are now going to begin our automation preparation for the ENCQOR certification 00:00:11.520 --> 00:00:12.520 exam. 00:00:12.520 --> 00:00:19.760 Let's go out to the exam objectives so we can have a better understanding of what we 00:00:19.760 --> 00:00:20.760 are going to cover here. 00:00:20.760 --> 00:00:29.960 So 15% of your exam is from these particular videos that we are going to present to you. 00:00:30.960 --> 00:00:41.040 So you have Python here, JSON here, YANG, DNA Center, APIs, REST APIs, EM, as well as 00:00:41.040 --> 00:00:43.080 Chef, Puppet, Ansible, and SaltStack. 00:00:43.080 --> 00:00:51.800 So 15% of your exam is approximately, how many questions would that be approximately? 00:00:51.800 --> 00:00:55.640 Let's open up our calculator and figure that out right now. 00:00:55.640 --> 00:01:05.880 So that's going to be approximately 87 multiple choice questions plus maybe 3, 4, or 5 simulations. 00:01:05.880 --> 00:01:11.000 So from just the multiple choice questions alone, 87 times, we are going to put times 00:01:11.000 --> 00:01:13.320 15% here. 00:01:13.320 --> 00:01:17.240 So about 13 questions, divide that by 7. 00:01:17.240 --> 00:01:23.640 So maybe like 2 questions per topic, so 1, 2, 3, maybe 4 questions per topic down here, 00:01:23.640 --> 00:01:24.640 but that's excessive. 00:01:24.640 --> 00:01:25.720 4 would be excessive. 00:01:25.720 --> 00:01:32.520 So your goal here is to ensure that you have the information and knowledge that is necessary 00:01:32.520 --> 00:01:35.120 to address those very specific types of questions on the exam. 00:01:35.120 --> 00:01:39.680 So like I've said before, I build my courses based on what? 00:01:39.680 --> 00:01:42.240 The exam objectives, but also my exam experience. 00:01:42.240 --> 00:01:49.640 So this ENCOR automation preparation is going to be focused on what we need to know specifically 00:01:49.640 --> 00:01:52.640 for each of these particular topics. 00:01:52.640 --> 00:01:58.400 So EEM, REST APIs, DNA Center, JSON, Python, and so on and so forth to help you get ready 00:01:58.400 --> 00:02:00.880 for the certification exam. 00:02:00.880 --> 00:02:02.720 All right. 00:02:02.720 --> 00:02:10.120 So with that said, let's dive into our discussion on EEM, Embedded Event Manager. 00:02:10.120 --> 00:02:13.400 So what is Embedded Event Manager, folks? 00:02:13.400 --> 00:02:21.200 Embedded Event Manager is a tool, a tool that is built into our Cisco iOS operating system 00:02:21.320 --> 00:02:31.960 that gives us the ability to automate event detection and event recovery or event responses. 00:02:31.960 --> 00:02:36.960 So what we create is we create these things called EEM policies, and these EEM policies 00:02:36.960 --> 00:02:42.000 could either be an EEM applet or an EEM script. 00:02:42.000 --> 00:02:45.280 So the applets are defined using the CLI, and the scripts would be defined using the 00:02:45.280 --> 00:02:48.080 TCL tool command language. 00:02:48.080 --> 00:02:52.000 So before the ENCOR certification exam, you're going to be tested on EEM applets. 00:02:52.000 --> 00:02:54.920 I'm going to repeat that, EEM applets. 00:02:54.920 --> 00:03:00.520 So we are not at all working with the TCL scripting in Cisco iOS. 00:03:00.520 --> 00:03:04.920 We're going to be dealing with the EEM applets instead. 00:03:04.920 --> 00:03:11.160 So the first thing I want to do is just give you a nice example of using EEM just for fun. 00:03:11.160 --> 00:03:15.440 It's a fun, silly little example, but it's going to show you how you could have some 00:03:15.440 --> 00:03:19.120 automation based on certain scenarios, certain situations that have happened. 00:03:19.120 --> 00:03:20.480 So an event is what? 00:03:20.480 --> 00:03:23.600 An event is a change of state on our device. 00:03:23.600 --> 00:03:26.560 So an interface going up, an interface going down, this happening, that happening, and 00:03:26.560 --> 00:03:27.560 so on and so forth. 00:03:27.560 --> 00:03:33.760 So based on those things happening, whatever it happens to be, we can define an event that 00:03:33.760 --> 00:03:38.620 then triggers an action based on that particular event happening. 00:03:38.620 --> 00:03:44.720 So I have pre-configured here one in Notepad that I'm just going to walk through with you. 00:03:44.720 --> 00:03:48.840 So it is going to be, do this right here. 00:03:48.840 --> 00:03:50.600 So this first one here. 00:03:50.600 --> 00:03:55.720 So configure terminal, and then I type an event manager applet to create my applet, 00:03:55.720 --> 00:03:56.720 and then I give it a name. 00:03:56.720 --> 00:04:00.440 So in this case, I'm giving it the name gigabit 0 slash 1 admin down. 00:04:00.440 --> 00:04:02.660 It's just a name, just for fun. 00:04:02.660 --> 00:04:07.080 And then here, we're specifically monitoring a syslog pattern. 00:04:07.080 --> 00:04:16.640 So if a syslog pattern or a syslog message is generated by our device, specifically one 00:04:16.640 --> 00:04:24.720 that says gigabit ethernet 0 slash 1, change state to administratively down, then we have 00:04:24.720 --> 00:04:26.940 these following actions that are going to happen. 00:04:26.940 --> 00:04:32.600 So what I had to do is I actually had to find out what is that syslog pattern that is going 00:04:32.600 --> 00:04:35.480 to be generated when my interface goes administratively down. 00:04:35.480 --> 00:04:36.760 So I went ahead and did that manually. 00:04:36.760 --> 00:04:41.400 I just brought down the interface, and that was the syslog message body or part of the 00:04:41.400 --> 00:04:46.160 syslog message body, and that is what I'm going to use now for my automation. 00:04:46.160 --> 00:04:51.560 So if this message is ever created at all or a message is created that has this information 00:04:51.560 --> 00:04:54.520 in it, then I want to perform the following action. 00:04:54.520 --> 00:04:59.320 So action number one is to generate an actual syslog message. 00:04:59.320 --> 00:05:04.660 So create a syslog message that says interface gigabit 0 slash 1 has been administratively 00:05:04.660 --> 00:05:06.420 shut down, re-enabling. 00:05:06.420 --> 00:05:13.740 So this is a syslog message that I am creating myself now to have generated based on this 00:05:13.740 --> 00:05:16.540 event occurring. 00:05:16.540 --> 00:05:19.660 Then I want the following commands to be executed. 00:05:19.660 --> 00:05:26.700 I want enable, configure terminal, interface gig 0 1, no shut, and then end, meaning that 00:05:26.700 --> 00:05:33.400 we are automating these commands so that way that we can bring the interface back up. 00:05:33.400 --> 00:05:35.720 That's what's happening in this particular case. 00:05:35.720 --> 00:05:39.440 So what we're going to do is I'm just going to copy this right now. 00:05:39.440 --> 00:05:43.360 So copy it, and I'm going to bring it over to my device. 00:05:43.360 --> 00:05:45.080 So R2 is an example. 00:05:45.080 --> 00:05:46.640 We'll type in configure terminal. 00:05:46.640 --> 00:05:52.480 I think we already had that copied though, and I'm going to go ahead and put it in here. 00:05:52.480 --> 00:05:53.480 Yep. 00:05:53.480 --> 00:05:55.000 All right. 00:05:55.000 --> 00:05:56.800 And I'll just go ahead and right click. 00:05:56.800 --> 00:05:57.800 I want all of that. 00:05:57.800 --> 00:05:58.800 All right. 00:05:58.800 --> 00:05:59.800 So there we go. 00:05:59.800 --> 00:06:02.360 So all those commands have been put in there now. 00:06:02.360 --> 00:06:11.320 So if we go to interface, for example, gigabitethernet 0 slash 1, and we type in shutdown, what's 00:06:11.320 --> 00:06:12.320 going to happen? 00:06:12.320 --> 00:06:16.160 Well, the interface is going to go down, and a syslog message is going to be generated. 00:06:16.160 --> 00:06:20.000 And that syslog message that is generated is going to match this one right here. 00:06:20.000 --> 00:06:21.000 And what was that one? 00:06:21.000 --> 00:06:22.760 Let me show you again. 00:06:22.760 --> 00:06:23.760 It's this one right here. 00:06:23.760 --> 00:06:26.440 It's going to match this. 00:06:26.440 --> 00:06:29.760 And then all of this is going to happen, all of these actions. 00:06:29.760 --> 00:06:30.760 Ready? 00:06:30.760 --> 00:06:31.760 Let's do it. 00:06:32.160 --> 00:06:38.120 So I'm going to shut down the interface, and so there is the syslog message that was generated 00:06:38.120 --> 00:06:40.400 from shutting down the interface. 00:06:40.400 --> 00:06:45.400 So gigabitethernet 0 slash 1, change state to administrative. 00:06:45.400 --> 00:06:46.480 So I have to match that. 00:06:46.480 --> 00:06:48.280 That is case sensitive. 00:06:48.280 --> 00:06:55.200 That had to be matched perfectly, perfectly, which it is, because I copied and pasted it 00:06:55.200 --> 00:06:57.880 right from the iOS when I created that script. 00:06:57.880 --> 00:07:04.960 And then you'll see here that this syslog message was generated by EEM. 00:07:04.960 --> 00:07:10.960 Interface gig 0 1 has been administratively shut down, dot, dot, dot, re-enabling. 00:07:10.960 --> 00:07:12.640 And where is that from? 00:07:12.640 --> 00:07:13.640 It's from this. 00:07:13.640 --> 00:07:17.540 Action number 1, create your own syslog message that states this. 00:07:17.540 --> 00:07:18.920 It did it for me. 00:07:18.920 --> 00:07:20.920 And then perform all these actions. 00:07:20.920 --> 00:07:22.600 So these actions occurred. 00:07:22.600 --> 00:07:28.680 You're not going to see the actions actually occurring, but you'll see what happened. 00:07:28.680 --> 00:07:31.080 Our interface went back to up, up. 00:07:31.080 --> 00:07:33.840 Why did our interface get re-enabled? 00:07:33.840 --> 00:07:38.960 Because those actions were executed behind the scenes. 00:07:38.960 --> 00:07:43.220 So enable, configure terminal, interface gig 0 1, no shut end. 00:07:43.220 --> 00:07:44.880 And here's the deal. 00:07:44.880 --> 00:07:46.760 You need to. 00:07:46.760 --> 00:07:56.800 You need to create your actions based on the fact that you are starting in user exec mode. 00:07:56.800 --> 00:07:58.280 That's right. 00:07:58.280 --> 00:08:00.920 That's exactly what happens here with EEM. 00:08:00.920 --> 00:08:05.040 So if you forget enable, you forget configure terminal, you forget the navigation in your 00:08:05.040 --> 00:08:07.040 script, it's not going to work. 00:08:07.040 --> 00:08:08.240 Keep that in mind. 00:08:08.240 --> 00:08:13.520 So it's possible, right, on an exam you could be tested on, oh, why isn't this working? 00:08:13.520 --> 00:08:14.520 What is missing? 00:08:15.160 --> 00:08:16.160 Think of the process. 00:08:16.160 --> 00:08:18.040 How would I enable an interface? 00:08:18.040 --> 00:08:19.240 How would I do this? 00:08:19.240 --> 00:08:20.680 How would I do that? 00:08:20.680 --> 00:08:25.560 You have to specify all those actions in the right order for it to work. 00:08:25.560 --> 00:08:28.160 Now you might be saying, well, what about authentication? 00:08:28.160 --> 00:08:29.160 What about user name? 00:08:29.160 --> 00:08:30.160 That's okay. 00:08:30.160 --> 00:08:32.120 Because that is not necessary when you're using EEM. 00:08:32.120 --> 00:08:37.240 Because it's being executed behind the scenes by the system, all these actions. 00:08:37.240 --> 00:08:39.400 It's automatically privileged level 15. 00:08:39.400 --> 00:08:42.360 So you type in enable, it's automatically authenticated. 00:08:42.360 --> 00:08:43.360 It's already there. 00:08:43.360 --> 00:08:44.360 Why? 00:08:44.400 --> 00:08:45.400 Because we created this. 00:08:45.400 --> 00:08:48.240 We needed to have the permissions to create this in the first place. 00:08:48.240 --> 00:08:53.480 So the system is now just essentially piggybacking on the fact that, hey, you were authenticated 00:08:53.480 --> 00:08:56.800 to create this in the first place, and you could do all of this in the first place, so 00:08:56.800 --> 00:08:58.240 we're just going to execute it now. 00:08:58.240 --> 00:09:01.520 So you don't have to worry about user names and passwords or anything like that. 00:09:01.520 --> 00:09:09.480 All right, so there is just an example of having a dynamic EEM applet. 00:09:09.480 --> 00:09:15.080 Something has occurred, an interface went down, and then we dynamically re-enabled it. 00:09:15.080 --> 00:09:17.440 All right, so let's have some fun with this one now. 00:09:17.440 --> 00:09:18.440 We're going to continue on. 00:09:18.440 --> 00:09:24.360 In this case, it says, event syslog pattern, so event manager applet, gig01 admin up. 00:09:24.360 --> 00:09:25.760 So the other one was called admin down. 00:09:25.760 --> 00:09:28.280 This one's called admin up. 00:09:28.280 --> 00:09:36.060 If we see the syslog pattern gig01 change state to up, then create a syslog message 00:09:36.220 --> 00:09:40.140 that says, interface gig01 has been restored. 00:09:40.140 --> 00:09:41.780 And then look at this action. 00:09:41.780 --> 00:09:48.700 We could email, so send a message to the mail server at 10.0.3.8 with the subject line, 00:09:48.700 --> 00:09:57.380 or not the subject line, with the recipient as itteam at stormwindlive.com from eemapplets 00:09:57.380 --> 00:09:58.380 at stormwindlive.com. 00:09:58.380 --> 00:10:03.220 So I would have to have a mailbox for eemapplets at stormwindlive.com, and then the subject 00:10:03.220 --> 00:10:08.580 line is gig01 up, down, up, body is gig01 was re-enabled because someone administratively 00:10:08.580 --> 00:10:09.580 shut it down. 00:10:09.580 --> 00:10:12.740 Find out who and take action, so that would be the email. 00:10:12.740 --> 00:10:14.900 So let's go ahead and just copy and paste that. 00:10:14.900 --> 00:10:19.100 And I don't have a mail server set up right now, so the mail aspect of it is not going 00:10:19.100 --> 00:10:30.820 to work, but you're still going to have the opportunity to see, in the end, the fact that 00:10:30.820 --> 00:10:32.860 we're trying to contact the mail server. 00:10:32.860 --> 00:10:35.620 All right, so there's the other event manager applet. 00:10:35.620 --> 00:10:40.100 So now we've got two event manager applets on our device. 00:10:40.100 --> 00:10:43.660 So let's go to interface gig01 and let's watch them get executed. 00:10:43.660 --> 00:10:47.140 So the first one's going to get executed because the interface is going down, but then when 00:10:47.140 --> 00:10:51.180 the interface gets re-enabled, this is what's going to show up. 00:10:51.180 --> 00:10:52.860 And we saw that earlier, right? 00:10:52.860 --> 00:10:56.940 Earlier it said gig01 changed state to up. 00:10:56.940 --> 00:11:00.520 Gig01 has, oh, sorry, gig01 changed state to up. 00:11:01.220 --> 00:11:05.880 So by the fact that the interface was re-enabled, then that is automatically going to trigger 00:11:05.880 --> 00:11:07.440 this one here. 00:11:07.440 --> 00:11:08.840 So both are going to get triggered. 00:11:08.840 --> 00:11:09.840 Watch. 00:11:09.840 --> 00:11:10.840 Here we go. 00:11:10.840 --> 00:11:11.840 So shut down. 00:11:11.840 --> 00:11:13.240 So the interface is shut down. 00:11:13.240 --> 00:11:14.240 It has now triggered. 00:11:14.240 --> 00:11:16.080 There's the syslog message. 00:11:16.080 --> 00:11:17.840 We are re-enabling. 00:11:17.840 --> 00:11:21.000 And then once it goes up, there's the other syslog message. 00:11:21.000 --> 00:11:22.800 Interface gig01 has been restored. 00:11:22.800 --> 00:11:29.360 All right, so now that it's been restored, the interface is back up and running. 00:11:29.360 --> 00:11:31.840 But there's the email. 00:11:31.840 --> 00:11:33.400 Now we're trying to contact the email server. 00:11:33.400 --> 00:11:37.320 So I'm getting these error messages all because the email server doesn't exist. 00:11:37.320 --> 00:11:42.080 But if the email server existed, we would have been able to successfully send that email 00:11:42.080 --> 00:11:45.440 to the mail server who could then give it to the IT team. 00:11:45.440 --> 00:11:50.040 So that way there they could take action, do whatever needs to be done, right? 00:11:50.040 --> 00:11:55.360 So that's just an example so far of EEM in action, folks, right? 00:11:55.360 --> 00:12:00.240 So we've created an applet, and we have defined an event. 00:12:00.240 --> 00:12:05.160 And then based on that event happening, we want these certain actions to take place. 00:12:05.160 --> 00:12:09.260 So when you create your EEM policy, you're going to name it like we did. 00:12:09.260 --> 00:12:15.000 The very first line was EEM or Event Manager Applet, I should say, and then gave it a name. 00:12:15.000 --> 00:12:16.000 Then select the event. 00:12:16.000 --> 00:12:21.580 You can only have one event per applet, OK, one event per applet. 00:12:21.580 --> 00:12:28.540 But you can have as many actions as you need in order to do whatever automation you need 00:12:28.540 --> 00:12:29.540 to have done. 00:12:29.540 --> 00:12:35.820 So for every single EEM applet, it's one event followed by many actions. 00:12:35.820 --> 00:12:40.540 Now when it comes to our EEM applet, what type of event detectors do we have? 00:12:40.540 --> 00:12:43.740 Well, it could be an application event, a CLI event. 00:12:43.740 --> 00:12:45.060 It could be counter events. 00:12:45.060 --> 00:12:47.940 It could be IPSLA events, NetFlow events. 00:12:47.940 --> 00:12:48.940 It could be none. 00:12:49.380 --> 00:12:52.420 Meaning you just manually trigger the applet whenever you need to. 00:12:52.420 --> 00:12:54.100 It could be based on SNMP. 00:12:54.100 --> 00:12:57.620 It could be based on syslog, as you've seen in my example so far. 00:12:57.620 --> 00:13:04.860 It can even be based on like a watchdog, a system monitor event, or a timer event, and so on and so forth. 00:13:04.860 --> 00:13:06.380 And then what are the actions you can take? 00:13:06.380 --> 00:13:14.300 Well, you've already seen actions like CLI actions, but you could also have email actions as we saw as well. 00:13:14.300 --> 00:13:17.620 You can manually have actions occur. 00:13:17.620 --> 00:13:20.220 You could generate an SNMP trap. 00:13:20.220 --> 00:13:25.620 You can even just print text to the terminal window if you want to. 00:13:25.620 --> 00:13:30.020 So for the certification exam, make sure you are well aware of what you see on this page, right? 00:13:30.020 --> 00:13:31.420 You name it. 00:13:31.420 --> 00:13:38.340 Then you have one event and then multiple actions in order to accomplish your objective. 00:13:38.340 --> 00:13:40.500 Very, very, very important. 00:13:40.500 --> 00:13:47.220 All right, so the example we just saw, those examples are really good examples that I did live for you. 00:13:47.220 --> 00:13:54.180 I also have them in the slide deck if you ever want to go back and review them in the slide deck as well. 00:13:54.180 --> 00:13:57.540 So for example, in this case, the event manager applet had been down. 00:13:57.540 --> 00:14:03.340 It's all listed right here for you to see if you want to review what we just did. 00:14:03.340 --> 00:14:05.980 But let me give you some other examples as well. 00:14:05.980 --> 00:14:08.820 So for example, manual example. 00:14:08.820 --> 00:14:17.020 First of all, how do you manually create an EAM, or not manually create one, but create an EAM applet that is not dynamic? 00:14:17.020 --> 00:14:24.940 It's manual in nature, meaning it does not get triggered unless you just simply manually start it, right? 00:14:24.940 --> 00:14:28.820 Your event type, take a peek at this, your event type is none. 00:14:28.820 --> 00:14:29.860 That's it. 00:14:29.860 --> 00:14:32.540 Event none means manual. 00:14:32.540 --> 00:14:33.300 That's right. 00:14:33.300 --> 00:14:42.300 So I type in event manager applet, give it a name, and then you type in event none, and event none means I will manually trigger it. 00:14:42.300 --> 00:14:44.340 And how do you manually trigger it? 00:14:44.380 --> 00:14:53.820 You manually trigger it from privilege exec mode, and you type in the command event manager run, and then the name of the policy, and that's how you would run it. 00:14:58.140 --> 00:15:07.100 So event none means it's a manual policy, and then you use the event manager run command in order to execute it. 00:15:07.100 --> 00:15:10.940 And so in this particular case, you'll see that it has run successfully. 00:15:10.940 --> 00:15:13.300 So let's read through our policy here. 00:15:13.300 --> 00:15:15.540 So event none, action one. 00:15:15.540 --> 00:15:21.020 So when I manually trigger this policy, action one says create a syslog message. 00:15:21.020 --> 00:15:24.220 My example manual policy has been triggered. 00:15:24.220 --> 00:15:29.660 So down here, interface gig01 is now disabled because someone ran the manual policy. 00:15:29.660 --> 00:15:33.580 Oh, my example manual policy has been triggered. 00:15:33.580 --> 00:15:35.260 There it is right there. 00:15:35.260 --> 00:15:36.700 Excellent. 00:15:36.700 --> 00:15:49.420 So when I trigger it, it's generate a syslog message, then the CLI command enable, configure terminal, interface gig01, shut down, shut down, and then end. 00:15:49.420 --> 00:15:59.500 And then in this example here, we're even showing you how you could copy the running config to a text file in Flash. 00:15:59.500 --> 00:16:06.660 So there is another CLI command, the copy command being executed dynamically, just an example as part of this. 00:16:06.660 --> 00:16:10.980 And then action eight says puts interface gig01, puts. 00:16:10.980 --> 00:16:12.980 What in the world is a put? 00:16:12.980 --> 00:16:14.900 What in the world is a put? 00:16:14.900 --> 00:16:20.820 Put means display the message to the console. 00:16:20.820 --> 00:16:21.220 That's it. 00:16:21.220 --> 00:16:22.780 So there it is. 00:16:22.780 --> 00:16:25.780 Notice it's not a syslog message, OK? 00:16:25.780 --> 00:16:34.100 So puts shows a message, but it's not a syslog message, so it's not treated as a syslog message. 00:16:34.100 --> 00:16:35.340 It's just a message. 00:16:35.340 --> 00:16:35.820 That's it. 00:16:35.820 --> 00:16:37.260 Keep that in mind. 00:16:37.260 --> 00:16:39.620 So you use the word syslog. 00:16:39.620 --> 00:16:47.860 If you want to generate a syslog message, as you can see, with dates and timestamps and facilities and mnemonics and severity levels. 00:16:47.860 --> 00:16:51.740 But if you just want to put a message, you used puts. 00:16:51.740 --> 00:16:53.740 Puts means put a message. 00:16:53.740 --> 00:16:54.900 That's the best way to think about it. 00:16:54.900 --> 00:16:56.260 Don't forget that. 00:16:56.260 --> 00:17:00.300 So as you can see, interface gig01 is now disabled because someone ran the manual policy. 00:17:00.300 --> 00:17:02.660 Interface gig01 is now disabled because someone ran it. 00:17:02.660 --> 00:17:03.580 That is put. 00:17:03.580 --> 00:17:08.060 Notice it's not a syslog message. 00:17:08.060 --> 00:17:09.940 So there's an example there. 00:17:09.940 --> 00:17:10.220 Right. 00:17:10.220 --> 00:17:14.500 Another example is just monitoring, like using something like SNMP. 00:17:14.500 --> 00:17:17.020 So in this case here, we have our event manager applet. 00:17:17.020 --> 00:17:23.620 I just called it Encore for my example, event SNMP, and then the object identifier for SNMP. 00:17:23.620 --> 00:17:25.940 So this is just a made-up object identifier, right? 00:17:25.940 --> 00:17:27.060 So don't even look it up. 00:17:27.060 --> 00:17:29.140 It's just made up. 00:17:29.140 --> 00:17:33.420 And in my case here, so I made it up here for this case. 00:17:33.420 --> 00:17:34.980 But in the real world, what do you want to do? 00:17:34.980 --> 00:17:40.540 You're going to want to make sure that you have the right object ID for exactly what you're trying to get from SNMP. 00:17:40.540 --> 00:17:42.100 And then in this case, it says get type. 00:17:42.100 --> 00:17:43.140 Get type is what? 00:17:43.140 --> 00:17:45.780 Exact, meaning I want this exact OID. 00:17:45.780 --> 00:17:47.060 Nothing more, nothing less. 00:17:47.060 --> 00:17:51.060 This exact OID and the information associated with it. 00:17:51.060 --> 00:17:52.940 And then the entry operator. 00:17:52.940 --> 00:17:54.620 So this is the operator. 00:17:54.620 --> 00:17:58.820 Greater than or equal to, greater than or equal to what particular value? 00:17:58.820 --> 00:17:59.420 80. 00:17:59.420 --> 00:18:01.340 So greater than or equal to 80. 00:18:01.340 --> 00:18:02.020 That's what that means. 00:18:02.020 --> 00:18:04.700 Entry op, entry value go together. 00:18:04.700 --> 00:18:06.260 So entry op is greater than or equal to. 00:18:06.260 --> 00:18:08.740 It could be less than or equal to. 00:18:08.740 --> 00:18:10.340 It could be equal to. 00:18:10.340 --> 00:18:13.380 But in my case, it says greater than or equal to 80. 00:18:13.380 --> 00:18:14.060 80 what? 00:18:14.060 --> 00:18:16.460 80%, right? 00:18:16.460 --> 00:18:18.900 Over some particular polling interval. 00:18:18.900 --> 00:18:21.660 The polling interval is 300, so five minutes. 00:18:21.660 --> 00:18:28.140 So in this case, this is just an example of our using or monitoring our CPU. 00:18:28.140 --> 00:18:31.020 That's what my example is in this particular case. 00:18:31.020 --> 00:18:34.540 So the five minute CPU threshold has been breached. 00:18:34.540 --> 00:18:36.020 My threshold is 80%. 00:18:36.020 --> 00:18:40.300 So greater than or equal to 80% over a five minute period. 00:18:40.300 --> 00:18:47.100 So if that SNMP variable is over 80% for a five minute period, 00:18:47.100 --> 00:18:49.060 then this gets triggered. 00:18:49.060 --> 00:18:50.140 Let me repeat that. 00:18:50.140 --> 00:18:59.220 If that OID, that SNMP variable, is over 80% for a five minute period, 00:18:59.300 --> 00:19:02.300 then the event gets triggered. 00:19:02.300 --> 00:19:04.540 So when the event gets triggered now, we 00:19:04.540 --> 00:19:08.340 get a syslog message that says, the five minute CPU threshold has been breached. 00:19:08.340 --> 00:19:09.820 It is now above 80%. 00:19:09.820 --> 00:19:12.620 It is time to panic, LOL. 00:19:12.620 --> 00:19:18.020 And then action 2.0 is a command that generates the show processes CPU command. 00:19:18.020 --> 00:19:21.300 So to let us know, hey, show processes CPU. 00:19:21.300 --> 00:19:24.340 And notice I have it sorted. 00:19:24.340 --> 00:19:28.540 And then append flash colon five minute CPU file. 00:19:28.540 --> 00:19:31.980 So what I'm showing you here as an example with the CLI command 00:19:31.980 --> 00:19:35.580 is that I can go ahead and I could execute the command show 00:19:35.580 --> 00:19:38.060 processes CPU as an action. 00:19:38.060 --> 00:19:42.260 And then what we can do is by using the pipe and append, 00:19:42.260 --> 00:19:47.500 so pipe and append, we can actually modify a file in flash 00:19:47.500 --> 00:19:49.300 all at the exact same time. 00:19:49.300 --> 00:19:51.460 So show process CPU sorted. 00:19:51.460 --> 00:19:55.900 And then take that information and add it 00:19:55.900 --> 00:20:01.500 to that file called five minute CPU file in flash. 00:20:01.500 --> 00:20:04.420 There's an example of how we could execute different things. 00:20:09.980 --> 00:20:13.540 Next, I've got an alarm example. 00:20:13.540 --> 00:20:16.420 So in this case here, this is just about alerting us, 00:20:16.420 --> 00:20:18.120 alerting us that something has happened. 00:20:18.120 --> 00:20:19.380 So it's a very simple one. 00:20:19.380 --> 00:20:22.980 It says event manager applet on core alert. 00:20:22.980 --> 00:20:25.220 The event is going to be a CLI event. 00:20:25.220 --> 00:20:28.580 So if somebody types something in, we want to know. 00:20:28.580 --> 00:20:31.500 So in this case, event CLI pattern conf t, 00:20:31.500 --> 00:20:33.700 so configure terminal. 00:20:33.700 --> 00:20:38.100 Any variation of configure terminal, that works. 00:20:38.100 --> 00:20:39.860 And then our action here you can see 00:20:39.860 --> 00:20:46.420 is an SNMP trap formatted as a string, string data. 00:20:46.420 --> 00:20:48.420 And it says alarm because someone entered 00:20:48.420 --> 00:20:51.260 global configuration mode. 00:20:51.260 --> 00:20:54.420 And then our action in this case is our priority critical 00:20:54.420 --> 00:20:57.820 message, possible configuration changes happening. 00:20:57.820 --> 00:21:01.260 So I have a syslog message and an SNMP trap in this example. 00:21:01.260 --> 00:21:02.700 And the syslog message, we actually 00:21:02.700 --> 00:21:04.700 set the priority to critical. 00:21:04.700 --> 00:21:08.980 And the message, the priority critical severity level, 00:21:08.980 --> 00:21:10.820 critical, they use the word priority here, 00:21:10.820 --> 00:21:14.220 but it's talking about the severity level of syslog. 00:21:14.220 --> 00:21:17.060 And then the message is possible configuration changes happening. 00:21:17.060 --> 00:21:19.740 So I'm just showing you examples here in case 00:21:19.740 --> 00:21:23.580 you need to know some of these. 00:21:23.580 --> 00:21:26.580 IPSLA and tracking objects, we said as well. 00:21:26.580 --> 00:21:29.340 So here I have an example of IPSLA. 00:21:29.340 --> 00:21:34.740 ICMP echo 8.8.8.8 frequency every five seconds. 00:21:34.740 --> 00:21:37.580 And then we have our IPSLA schedule one start time now, 00:21:37.580 --> 00:21:39.060 life forever. 00:21:39.060 --> 00:21:41.180 And then we have a tracking object keeping track 00:21:41.180 --> 00:21:43.820 of that SLA instance. 00:21:43.820 --> 00:21:47.380 So track 15 says keep track of the reachability of IPSLA 1. 00:21:47.380 --> 00:21:51.180 So in the end, if IPSLA 1 is successful, 00:21:51.180 --> 00:21:52.640 the tracking object is up. 00:21:52.640 --> 00:21:56.400 If IPSLA 1 is unsuccessful, then the tracking object goes down. 00:21:56.400 --> 00:21:59.240 So in this case, since it's a ping, if the ping is successful, 00:21:59.240 --> 00:22:00.560 the tracking object is up. 00:22:00.560 --> 00:22:03.200 If the ping fails, the tracking object is down. 00:22:03.200 --> 00:22:05.120 Now, my event manager applet, we're 00:22:05.120 --> 00:22:10.160 going to call it track IPSLA, it is event, event track 15 00:22:10.160 --> 00:22:11.200 state down. 00:22:11.200 --> 00:22:17.040 So we're only tracking the tracking object 15 if it's down. 00:22:17.040 --> 00:22:18.120 If it's up, we don't care. 00:22:18.120 --> 00:22:20.280 If it's down, we care. 00:22:20.280 --> 00:22:21.340 If it's down, we care. 00:22:21.340 --> 00:22:23.900 So you have the option, for example, with event track 00:22:23.900 --> 00:22:26.700 to do the state up, the state down, or the state both. 00:22:26.700 --> 00:22:30.540 So if it goes up, if you have up, then if it goes up, 00:22:30.540 --> 00:22:31.260 it triggers. 00:22:31.260 --> 00:22:33.260 If it's down, it's triggered. 00:22:33.260 --> 00:22:34.220 If you pick down. 00:22:34.220 --> 00:22:36.100 If it's both, then whether it's up or down, 00:22:36.100 --> 00:22:37.980 it's going to trigger it in that motion. 00:22:37.980 --> 00:22:40.380 So in this case, only if it goes to down 00:22:40.380 --> 00:22:42.900 do I want this event to get triggered. 00:22:42.900 --> 00:22:44.820 So event track 15 state down. 00:22:44.820 --> 00:22:46.580 So if we're up, everything's good. 00:22:46.580 --> 00:22:48.380 If we go down, then I want this to trigger. 00:22:48.380 --> 00:22:50.060 And the trigger is what? 00:22:50.060 --> 00:22:51.620 Or the action, I should say, is what? 00:22:51.620 --> 00:22:52.260 Syslog message. 00:22:52.260 --> 00:22:54.060 So again, just generating a syslog message. 00:22:54.060 --> 00:22:57.460 The IPSLA probe is broken. 00:22:57.460 --> 00:22:59.420 And I'm showing you here the priority of 1. 00:22:59.420 --> 00:23:01.380 So it's wrapped around the line. 00:23:01.380 --> 00:23:04.660 But syslog, syslog message, priority 1. 00:23:04.660 --> 00:23:06.340 We have that all part of it. 00:23:06.340 --> 00:23:07.940 So now, in this case here, I'm just 00:23:07.940 --> 00:23:11.940 showing you down the road, connectivity to 888 fails. 00:23:11.940 --> 00:23:13.460 So now that connectivity has failed, 00:23:13.460 --> 00:23:14.760 that means the probe goes down. 00:23:14.760 --> 00:23:17.100 The probe, or the IPSLA instate, goes down. 00:23:17.100 --> 00:23:18.100 Ping fails. 00:23:18.100 --> 00:23:18.780 Ping fails. 00:23:18.780 --> 00:23:19.900 Tracking object goes down. 00:23:19.900 --> 00:23:20.940 Tracking object goes down. 00:23:20.940 --> 00:23:21.740 This gets triggered. 00:23:21.740 --> 00:23:23.460 And you can see it just got triggered. 00:23:23.460 --> 00:23:26.180 Tracking state 15, IPSLA one reach 00:23:26.180 --> 00:23:27.660 really went from up to down. 00:23:27.660 --> 00:23:28.580 Boom. 00:23:28.580 --> 00:23:30.100 There is your EAM applet. 00:23:30.100 --> 00:23:31.180 What is the action? 00:23:31.180 --> 00:23:33.220 Generate a syslog message. 00:23:33.220 --> 00:23:36.300 The IPSLA probe is broken. 00:23:36.300 --> 00:23:37.900 Simple example, just to show you again 00:23:37.900 --> 00:23:40.020 how you can combine a lot of these different things 00:23:40.020 --> 00:23:42.300 together to get automation results that you need. 00:23:42.300 --> 00:23:45.420 Same thing with OSPF debugging example here I have. 00:23:45.420 --> 00:23:47.700 So in this case, I'm doing an OSPF debug. 00:23:47.700 --> 00:23:50.500 So I called my applet Encore OSPF debug. 00:23:50.500 --> 00:23:52.580 Event syslog pattern is what? 00:23:52.580 --> 00:23:56.660 OSPF-5-adjacency process one, neighbor, da, da, da, da, 00:23:56.660 --> 00:23:58.660 on gig zero one from full to down. 00:23:58.660 --> 00:24:06.620 So I explicitly looked up that particular pattern, 00:24:06.620 --> 00:24:10.660 that syslog message, by triggering the neighborship 00:24:10.660 --> 00:24:15.060 to fail on my device and seeing what shows up. 00:24:15.060 --> 00:24:17.580 And as a result of that, I know what it is. 00:24:17.660 --> 00:24:20.180 And I can put it as my pattern for syslog. 00:24:20.180 --> 00:24:23.540 And so if that ever shows up as a syslog message, 00:24:23.540 --> 00:24:24.540 then what do I want to do? 00:24:24.540 --> 00:24:25.780 Enable. 00:24:25.780 --> 00:24:29.620 Then I want to do logging buffered seven. 00:24:29.620 --> 00:24:32.140 I want to debug IPOSPF event. 00:24:32.140 --> 00:24:34.260 I want to debug IPOSPF adjacency. 00:24:34.260 --> 00:24:36.700 I want to debug IPOSPF hellos. 00:24:36.700 --> 00:24:38.620 And then all those debug messages 00:24:38.620 --> 00:24:41.380 are going to be generated behind the scenes 00:24:41.380 --> 00:24:42.700 and saved where? 00:24:42.700 --> 00:24:46.980 To my RAM, to my buffer logging in this particular case. 00:24:50.100 --> 00:24:53.660 So that way there, I can now go into the RAM 00:24:53.660 --> 00:24:56.220 and I can take a peek at what? 00:24:56.220 --> 00:25:00.140 I can take a peek at the debug messages that are showing up. 00:25:00.140 --> 00:25:02.380 So we might also want to generate another syslog 00:25:02.380 --> 00:25:05.860 message that notifies me or sends some sort of trap 00:25:05.860 --> 00:25:08.500 and just lets me know, or an email that lets me know, 00:25:08.500 --> 00:25:11.940 hey, we just had an OSPF failure. 00:25:11.940 --> 00:25:15.580 You might want to log into R2 and check out 00:25:15.580 --> 00:25:20.140 the debug information that's showing up there. 00:25:20.140 --> 00:25:23.260 So we can even make it more exciting than it already is. 00:25:23.260 --> 00:25:26.220 All right, so those are a bunch of different examples for EEM. 00:25:26.220 --> 00:25:29.740 So for the exam one, you got to know what EEM is. 00:25:29.740 --> 00:25:32.540 Make sure you know that your applet is going to be named. 00:25:32.540 --> 00:25:33.980 You're going to have one event. 00:25:33.980 --> 00:25:36.040 And then based on that one event, 00:25:36.040 --> 00:25:38.420 you are going to then have a multitude 00:25:38.420 --> 00:25:40.020 of different types of actions. 00:25:40.020 --> 00:25:47.900 Make sure you know for the exam, syslog, SNMP, 00:25:47.900 --> 00:25:51.100 what else, the puts example I gave you, 00:25:51.100 --> 00:25:54.940 the email example I gave you, the IPSLA and tracking object 00:25:54.940 --> 00:25:55.860 example I gave you. 00:25:55.860 --> 00:25:58.660 So there's a reason why I gave you these examples. 00:25:58.660 --> 00:26:00.460 So that way there, you have the opportunity 00:26:00.460 --> 00:26:03.180 to familiarize yourself with what 00:26:03.180 --> 00:26:06.420 is happening in relation to these different types of EEM 00:26:06.420 --> 00:26:06.940 applets. 00:26:06.940 --> 00:26:07.140 Why? 00:26:07.140 --> 00:26:08.020 The most important thing for you to do 00:26:08.020 --> 00:26:09.220 is be able to read them. 00:26:09.220 --> 00:26:11.980 Read them from top to bottom and understand what is it doing? 00:26:11.980 --> 00:26:12.580 What is it doing? 00:26:12.580 --> 00:26:13.300 What is it doing? 00:26:13.300 --> 00:26:14.380 What is it doing? 00:26:14.380 --> 00:26:17.260 And if you can do that, you're one step closer to success 00:26:17.260 --> 00:26:19.260 in the real world and on the certification exam 00:26:19.260 --> 00:26:21.900 when it comes to EEM. 00:26:21.900 --> 00:26:25.620 Knowing what puts is versus your message versus your email. 00:26:25.620 --> 00:26:29.300 If I showed it to you, it's a good thing to remember it 00:26:29.300 --> 00:26:30.580 and why it exists. 00:26:30.580 --> 00:26:32.580 So that way there, if it shows up, 00:26:32.580 --> 00:26:34.260 you're ready to go on the exam. 00:26:34.260 --> 00:26:36.300 All right, other than that, folks, 00:26:36.300 --> 00:26:39.140 there's so much more in relation to EEM 00:26:39.940 --> 00:26:43.380 It could possibly be a five-day course in itself, EEM, 00:26:43.380 --> 00:26:45.060 if you really wanted to cover everything. 00:26:45.060 --> 00:26:46.820 But we're not going into that much detail. 00:26:46.820 --> 00:26:49.580 You have what you need to be successful with EEM 00:26:49.580 --> 00:26:52.460 on the certification exam.