On 4/27/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
Hi, Chet:
Thanks for the quick response.
>This escalation is being done by Zenoss, and is easy to setup.
>However, it is only available on performance thresholds (such as
>cpuPercentProcessorTime.) To get some of this functionality for ping
>events you'd want to look into setting the "delay" on your alert rule
>to 300 seconds. This way the ping failures would still impact the
>device's availablity reports, but you wouldn't get emailed/paged
>about them.
I see. So I would:
o Change my base alert so it doesn't fire when event class is
"/Status/Ping".
o Add a second alert (delay == 0) that fires when event class is
"/Status/Ping" and device class is *not* "/Server/Windows".
o Add a third alert (delay == 300) that fires when event class is
"/Status/Ping" and device class is "/Server/Windows".
Does that look right? How do the clear events work with delay? I
assume they are sent immediately?
That's right. Clear events are not affected by the delay settings and
are setting and are sent immediately.
Could the same effect be had by adding a filter on "count" (say,
"count > 4")? I guess then if I change the ping frequency I also
change my alert behaviour, which isn't desirable. Also, how would the
clear events work in this case (since count for them would never
be > 4)?
You're right on this one too. Clears would never be sent.
This approach (updating the alerts) seems a bit awkward, but it looks
like it will work (thanks again!). If I wanted to enhance
/Status/Ping with this behaviour, where would I start? Should I take
this to zenoss-dev?
Another way you could handle this that would potentially be less
awkward would be to structure your alerts so that you never receive
/Status/Ping events from the /Server/Windows device class. You could
then setup a performance template that included a ping check (via a
nagios-style plugin) and alert on this. Because it would be in a
performance template you could use the escalation feature. I think I'd
still prefer the solution that only involved alerting rules just
because it wouldn't tax your Zenoss system with the more expensive
plugin checks. However, if you aren't monitoring a lot of Windows
devices this wouldn't be a concern.
zenoss-dev is for discussion of the development branch, not for
feature requests. This would be the right mailing list for talking
about feature requests.
>Just FYI, the escalation behavior for performance thresholds can be
>configured by going to a device's PerfConf tab then to the data
>source you're interested in. On the data source's tab you would set
>the severity to the starting severity, then the escalate count to how
>many of these events have to happen before the severity is bumper up
>one value.
I would like to do this. However, when I go to a device's PerfConf
tab, I see the data sources listed, but they aren't hyperlinks. For
instance, on my Windows box, the following data sources are listed:
cpuPercentProcessorTime
memoryAvailableKBytes
memoryPagesPerSec
sysUpTime
However, I can't click on any of them. I'm using Zenoss 1.1.1.
They aren't links because you're only looking at an inherited
performance template. At the top of the page you'll see something like
"RRDTemplate @ /Devices/..." that shows you were in the tree this
template is defined. If you click on the link, it'll take you to the
definition where you can make changes. Or, if you only want to change
it for this one device you can click the "Local Copy" button then edit
the local copy that it creates.
--
Chet Luther
[EMAIL PROTECTED]
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
