Cisco ASR 9000 Serie

When System Manager Event Detector abnormal process termination events occur, the default action restarts
the process according to the built-in rules of the System Manager.
The relationship between the EEM and System Manager is strictly through the private API provided by the
EEM to the System Manager for the purpose of receiving process start and termination notifications. When
the System Manager calls the API, reliability metric data is collected and screening is performed for an EEM
event match. If a match occurs, a message is sent to the System Manager Event Detector. In the case of
abnormal process terminations, a return is made indicating that the EEM handles process restart. If a match
does not occur, a return is made indicating that the System Manager should apply the default action.
Timer Services Event Detector
The Timer Services Event Detector implements time-related EEM events. These events are identified through
user-defined identifiers so that multiple processes can await notification for the same EEM event.
The Timer Services Event Detector handles EEM event monitoring requests for the Date/Time Passed EEM
event. This event occurs when the current date or time passes the specified date or time requested by an
application.
Syslog Event Detector
The syslog Event Detector implements syslog message screening for syslog EEM events. This routine interfaces
with the syslog daemon through a private API. To minimize overhead, a portion of the API resides within the
syslog daemon process.
Screening is provided for the message severity code or the message text fields. POSIX regular expression
pattern support is provided for the message text field.
The Syslog Event Detector handles EEM event monitoring requests for the events are shown in this table.
Table 7: Syslog Event Detector Event Monitoring Requests
DescriptionEmbedded Event Manager Event
Occurs for a just-logged message. It occurs when
there is a match for either the syslog message severity
code or the syslog message text pattern. Both can be
specified when an application requests a syslog
message EEM event.
Syslog message EEM event
Occurs when the event-processed count for a specified
process is either greater than or equal to a specified
maximum or is less than or equal to a specified
minimum.
Process event manager EEM event—built in
None Event Detector
The None Event Detector publishes an event when the Cisco IOS XR Software event manager run CLI
command executes an EEM policy. EEM schedules and runs policies on the basis of an event specification
that is contained within the policy itself. An EEM policy must be identified and registered to be permitted to
run manually before the event manager run command will execute.
Cisco ASR 9000 Series Aggregation Services Router System Monitoring Configuration Guide, Release 4.2.x
51
Configuring and Managing Embedded Event Manager Policies
Event Detection and Recovery