I'm trying to understand how Zenoss events work, specifically how it deals with snmp linkup/down trap events.
It may be my setup but it doesn't seem to handle event correlation. For example on a cisco switch with port 1 oper down and port 2 oper up. If I oper down port 2 I see the event register as expected telling me the switch port is down. Now if I oper up port 1 the event correlates, clears and both are moved to history. Another example is if take a port thats been in an oper down state when the system was last modeled and then oper it up I see no event, not even in history. If I then down that same port the event is registered as down and a few seconds later the previous up event is suddenly registered and the events are moved to history. This is most bizarre as it appears the up event is held in some type of limbo, and then gives a false clear when the interface is downed. I'm just using the basic included event snmp_linkUp and snmp_linkDown rules, so perhaps there is something lacking in these rules. Or perhaps the deduplication engine is causing this behavior and the uniqueness of these events needs to be greater. I've gone over the Admin Guild specifically chapter 15, but I still don't get some of the basics about events. When defining an event what is the Rule section for? Also the Transform section, what am I transforming? Any help or guidance would be appreciated. -------------------- m2f -------------------- Read this topic online here: http://community.zenoss.com/forums/viewtopic.php?p=15366#15366 -------------------- m2f -------------------- _______________________________________________ zenoss-users mailing list [email protected] http://lists.zenoss.org/mailman/listinfo/zenoss-users
