Skip navigation
5734 Views 7 Replies Latest reply: Oct 7, 2011 6:41 PM by jskeane RSS
jskeane Rank: Green Belt 67 posts since
Sep 15, 2010
Currently Being Moderated

Dec 17, 2010 1:28 PM

Having Trouble with a Simple Event Transform

I'm making my first attempt at a simple event transform, and it's not working.  I've read Jane Curry's primer on event processing, but I feel like I don't really grasp how it all fits together (my fault, not Jane's.).  I'm sure I'm missing something obvious. Any help would be appreciated.  I'm running Zenoss Core 3.0.3 on RHEL5u4 64-bit.

 

My servers all have an ethernet interface that is not connected to anything, so I get event log messages that say "threshold of status exceeded: current status other".  I would like to drop these messages, but only if they come from that one specific interface.  Examinig the details of the events shows that the Component is always cpqNicIfPhysAdapter0_3, and the Event Class is /Change/Set/Status.

 

I went to Events | Event Classes | Classes, then drilled my way down to /Change/Set/Status.  There, I added a mapping called IgnoreEth2StatusOther, and clicked OK.  I then double-clicked on this new mapping, and clicked on Edit on the left side.  This shows me that the EventClassKey is IgnoreEth2StatusOther.  Is that bad?  Will anything ever match it?  Anyway, I set the mapping as follows:

 

Rule:  evt.component=='cpqNicIfPhysAdapter0_3'

Regex:  threshold of status exceeded: current status other

Example:  threshold of status exceeded: current status other

Transform:  evt.severity = 2

 

To see if the transform works, I decided to try to make the severity an error instead of a warning.  If that worked, I would set the Transform to "evt._action='drop'" and be done.  But is doesn't work.

 

Am I making a mistake by creating a mapping instead of a transform?  If so, how do I just add a transform to the /Change/Set/Status class so that events with component equal to cpqNicPhysAdatper0_3 and a summary message of 'threshold of status exceeded: current status other' get dropped?  I feel like I'm missing something basic.

 

Regards,

 

jskeane

  • artifact Rank: Green Belt 303 posts since
    Mar 11, 2008
    Currently Being Moderated
    1. Dec 17, 2010 2:04 PM (in response to jskeane)
    Re: Having Trouble with a Simple Event Transform

    I've found that the 'rule' and 'regex' fields are kind of janky. Just create a mapping, and use python in the Transform field to achieve what you want with a simple boolean operation matching a regular expression.

     

    Something like this should work :

     

    import re
    match = re.search('cpqNicIfPhysAdapter0_3', evt.component)
    if match and device:
        evt._action = 'drop'
    

     

    Of course, you could always just turn off monitoring of those interfaces and lock them.

     

    --Blake

  • jmp242 ZenossMaster 4,060 posts since
    Mar 7, 2007
    Currently Being Moderated
    2. Dec 17, 2010 2:07 PM (in response to jskeane)
    Re: Having Trouble with a Simple Event Transform

    This isn't going to work. You can't re-map something that’s already mapped. Instead, go to the event class /Change/Set/Status and create a transform there - don't create a new mapping.

     

    --

    James Pulver

    Information Technology Area Supervisor

    LEPP Computer Group

    Cornell University

  • jmp242 ZenossMaster 4,060 posts since
    Mar 7, 2007
    Currently Being Moderated
    3. Dec 17, 2010 2:11 PM (in response to artifact)
    Re: Having Trouble with a Simple Event Transform

    I don't think he needs a mapping, just put the transform in the existing class. Look at the little gear icon in the lower part of the left hand pane and that gives the option I think. The new 3.0 GUI is pretty hard to find these things IMO vs 2.x...

     

    --

    James Pulver

    Information Technology Area Supervisor

    LEPP Computer Group

    Cornell University

  • artifact Rank: Green Belt 303 posts since
    Mar 11, 2008
    Currently Being Moderated
    4. Dec 17, 2010 2:13 PM (in response to jmp242)
    Re: Having Trouble with a Simple Event Transform

    Oops, yep, he already has a mapping, my bad. Does it matter whether he applies the transform to the mapping or the event class?

  • jmp242 ZenossMaster 4,060 posts since
    Mar 7, 2007
    Currently Being Moderated
    5. Dec 17, 2010 2:23 PM (in response to artifact)
    Re: Having Trouble with a Simple Event Transform

    Well, probably not, if they're actually hitting a mapping. I think it's actually just ending up in the event class, so the transform should go there.

     

    --

    James Pulver

    Information Technology Area Supervisor

    LEPP Computer Group

    Cornell University

  • geom Newbie 6 posts since
    Jul 20, 2011
    Currently Being Moderated
    6. Oct 7, 2011 4:15 PM (in response to jskeane)
    Re: Having Trouble with a Simple Event Transform

    Just saying thank you for explaining in precise detail where to create the new transform.  I have spent like 3 days trying to figure out how you 'just create a transform' instead of a doing it in a event class mapping.  For some reason my brain just ignored the gear icon in the lower left hand corner.  OMG I feel dumb, but thanks for explaining anyhow.

More Like This

  • Retrieving data ...

Legend

  • Correct Answers - 4 points
  • Helpful Answers - 2 points