Jason,
Thanks very kindly. I think i understand it better now. I implemented
scenario #2 for my second question and i think its working. My up
events are being set to green and my down events are being marked as
red. I still need to do some testing to see if the green event will
clear the red event though.
Thanks again,
-Daniel
Jason Stevens wrote:
Daniel,
<clip>
Which is great. And i can even understand this by looking at the
/Events/Net/Cisco/LINK-3-UPDOWN class and looking at the Regex field
and it displays the following:
Interface (?P<component>\S+), changed state to (up|down)
So I have a couple of specific scenarios to ask about.
1) I click on an "Interface FastEthernet0/8, changed state to down"
event and look at the eventClassKey and it states LINK-3-UPDOWN.
* I go look at that Class Mapping and it shows the text above as
the Regex line.
* How did the component column of the event get propagated with
the FastEthernet0/8? Did it take the event and extract the
Interface portion and stick it into the component field?
* Or, did some other rules processing i cant find take the
Interface portion of the alert and fill in the component column?
The component value for the event was slurped out of the regex you
mentioned above. The (?P<component>\S+) is an example of the
python-specific named group syntax. Basically it lets you assign a
name to part of the matched text. In zenoss event mapping regex
fields you can use this syntax to assign values to event fields.
2) Second part is, the "changed to state down" and "changed to state
up" events both come in as as a severity of Major(orange). I would
like to make the up events a severity of Clear(green). And the best
situation would be to have the green event clear the orange event,
but i will work in stages.
* Is there any control as to what eventClassKey an event comes
across as?
* If there is not, if all of my link events are coming across as
LINK-3-UPDOWN, how can i peel it apart to make the up events a
severity of green and keep the down events an orange severity?
I don't think there's any easy way to control which eventClassKey the
event comes in as, but event mappings should allow you to accomplish
what you want here. There are a couple ways of doing what you want:
1) Use at event mapping to identify the "state up" events, set them to
the same event class as the "state down" events and set the severity
to 0 (clear.)
or
2) Have "state up" and "state down" come in as different event
classes. Use the zEventClearClasses property of the "state down"
event class to specify that it is cleared by the "state up" event class.
In either case you should end up with the "state down" events being
cleared by the "state up" events.
If you run into problems then post details (eventKey, msg, etc) of the
two types of events and we can probably help you out.
-jason
------------------------------------------------------------------------
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
