Lab 16 — EEM Applets & Guest Shell Python

Network Topology

Prerequisites

›Basic IOS XE CLI familiarity
›Python 3 basics helpful
›Understand syslog message format

Task Sheet — CCIE Exam Format

Task 1Medium

Create EEM applet 'EEM-INTF-DOWN-ALERT' triggered by syslog pattern for interface state change. Log a custom message and run 'show interfaces summary'.

✓ Verify: event manager policy EEM-INTF-DOWN-ALERT

Task 2Medium

Create EEM applet 'EEM-CONFIG-CHANGE-LOG' triggered by CLI pattern 'configure terminal'. Log username and source IP using built-in variables.

✓ Verify: show event manager policy registered

Task 3Hard

Create EEM watchdog timer applet running every 300 seconds to check OSPF neighbor count. Alert via syslog if count drops below expected.

✓ Verify: event manager run EEM-OSPF-HEALTH-CHECK

Task 4Hard

Enable Guest Shell on IOS XE. Verify Linux environment with 'guestshell run python3 --version'.

✓ Verify: show app-hosting detail appid guestshell

Task 5Hard

Write a Python script in Guest Shell using the CLI module to collect 'show version' and 'show ip interface brief'. Save output to /flash/health-report.txt.

✓ Verify: guestshell run python3 /flash/collect_health.py

Task 6Expert

Configure SNMP-triggered EEM: alert when CPU exceeds 80% using SNMP OID poll.

✓ Verify: show event manager policy registered detail

Key Concepts

EEM (Embedded Event Manager) provides an event-driven framework built into IOS XE. Events can be syslog patterns, CLI commands, SNMP OID thresholds, timers, or interface state changes. Actions include CLI commands, syslog messages, email notifications, and Tcl/Python script execution. EEM runs in the router process space — no external server needed.

Guest Shell is a Linux container (based on CentOS) running inside IOS XE. It provides a full Python 3 environment with the 'cli' module for executing IOS XE commands programmatically. Guest Shell has access to the management VRF and can make API calls, run scripts, and access the Linux filesystem — bridging IOS CLI automation with Python programmability.

EEM variables like $_cli_username, $_cli_remote_host, and $_syslog_msg allow dynamic responses based on event context. The 'action cli command' sends CLI to the exec prompt; 'action syslog' writes to the syslog buffer. Complex logic is possible with if/elseif/else/end constructs and set/string operations.

Verification Commands

show event manager policy registered

All applets listed with event type and action count

show event manager history events

Triggered events log with timestamps

guestshell run python3 --version

Python 3.x.x (version inside Guest Shell)

show app-hosting detail appid guestshell

State: RUNNING

Common Mistakes & Troubleshooting

EEM applet not triggering on syslog

Syslog pattern matching is case-sensitive and uses regex. Test with 'debug event manager' and trigger the event. Verify 'logging buffered' includes the message level you're matching.

Guest Shell not starting

Requires 'iox' command and sufficient memory/storage. Check 'show app-hosting list'. If install fails, ensure IOS XE 16.8+ and IOx enabled in 'show iox-service'.

CLI module not available in Python

Guest Shell Python CLI module path: 'from cli import cli, execute'. Some IOS XE versions need 'import subprocess' instead. Check with 'guestshell run python3 -c "import cli; print(cli.__file__)"'.

Solution Configs

Attempt the tasks yourself before viewing solutions.
Type SOLUTION to unlock.

CORE-1 EEM Config

! See solution-configs/CORE-1.cfg

Python Script

! See netconf_restconf_example.py for Python examples

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.