In a recent forum post, user ccole shared a event transform to create unique thresholds per filesystem monitored. He reported thatMy management is very interested in Zenoss, but we’ve got a few challenges. The first challenge is that we have a number of Windows machines that have large shadow copy volumes. Those are intended to fill up, and alerting for those isn’t particularly useful. The second challenge is that a one-size-fits-all threshold doesn’t actually fit all.
The solution we’ve fixed upon is to put a custom threshold into the volume name and work off that. Here’s the code used in the /Perf/Filesystem event transform (based off another user’s change that made for more understandable messages)
Zenoss guru Chet Luther added a couple of minor fixes and here’s the result:
import re
fs_id = device.prepId(evt.component)
for f in device.os.filesystems():
if f.id != fs_id: continue
# Extract the percent and free from the summary
m = re.search("threshold of [^:]+: current value ([\d\.]+)", evt.summary)
if not m: continue
usedBlocks = float(m.groups()[0])
p = (usedBlocks / f.totalBlocks) * 100
freeAmtGB = ((f.totalBlocks - usedBlocks) * f.blockSize) / 1073741824
# Make a nicer summary
evt.summary = "Disk space low: %3.1f%% used (%3.2f GB free)" % (p,freeAmtGB)
# This is where we change to a per device threshold
perDeviceThreshold = 95.0
m = re.search("zz(\d{3})", f.id)
perDeviceThreshold = m and float(m.groups()[0]) or 95.0
if p >= perDeviceThreshold: evt.severity = 5
break
UPDATE: fixed the indentation
This transform should have been marked up as code to properly preserve the formatting. I recommend that no one try to use this code until you see it has been fixed.
You'll know it's fixed when you see some indentation.