I tried this method:
# Create the dedup id; This is what zenoss normally does to the event to ascertain if
# it is a duplicate (another occurance) of an existing event. We are doing it in this
# transform to be able to reference the count variable, which does not come with an
# incoming event.
dedupfields = [
evt.device, evt.component, evt.eventClass, evt.eventKey, evt.severity]
if not evt.eventKey:
dedupfields += [evt.summary]
mydedupid = '|'.join(map(str, dedupfields))
# Get the event details (including count) from the existing event that is in the mysql database
em = dmd.Events.getEventManager()
ed = em.getEventDetail(dedupid=mydedupid)
mycount = ed.count
mycount = 0
# Do what you like with the count and event;
# In this example we up the severity to CRITICAL if the count is > 3
if mycount > 3:
evt.severity = 5
With no sucess.
I believe it has alot to do with getEventManager being crippled in 4.x Any help is appreciated.
You'll need to use zep to get count.
Here's an example that escalates SNMP downs.
intTrigger = 4
zep = getFacade('zep')
if hasattr(evt, 'count') and 'SNMP agent down' in str(evt.sumamry) and evt.severity !=5:
zep_filter = zep.createEventFilter(severity=4, event_summary='SNMP agent down - no response received')
for e in zep.getEventSummariesGenerator(filter=zep_filter):
if e['count'] > int(intTrigger):
evt.severity = 5
Here is a script which supports escalation similar to the previous method (using de-dup fields to generate the fingerprint of an event, and bumping the severity accordingly):
Follow Us On Twitter »
||Latest from the Zenoss Blog »||Community||Products||Services||Customers||About Us|
Copyright © 2005-2011 Zenoss, Inc.