elmerfud wrote: > Ok, after doing some more research I've come to the conclusion that Zenoss > can't do the type of snmp trap correlation that's needed to understand > linkup/linkdown traps. It appears to be a limitation in how things are > handled in the event class and it not being able to understand that > linkup/down traps have an index number associated with them and that port 1's > up message can't clear port 2's down message. > > If I'm incorrect in my understanding of this problem and how to correlate > these traps together I would like some guidance. > > Other than this limitation that I've run in to, I find Zenoss to be an > excellent monitoring system. Unfortunately, my company's needs rely heavily > on the ability to process and correlate traps. Unless I can figure out how > to make this happen in Zenoss I'll have to look to the purchase of another > product.
What you could do is what I did: Extract a unique part of the details to correlate traps and change it tot the component: To give you an idea: I have a bigIP which sends traps for Up/Down service events. To correlate them I have in the details bigipNotifyObjNode and bigipNotifyObjPort These are ofcourse unique per trap because its the IP adress and the port that went down. So what I did is created an event mapping for the Up trap and an event for the down trap. The down trap has a severity of critical and the up trap a clear one. Then I added this in both mappings in the event transform section: evt.component = "%s:%s" % (evt.bigipNotifyObjNode, evt.bigipNotifyObjPort) this makes the component look like: 10.1.249.1:8080 Since the component is part of the clearing method and since the component is unique for this event mapping only events with the same component will be cleared, and this is what you whant I guess. I think the same can apply for up/down events for a port, since there is port number in de details I guess. Hope this helped -------------------- m2f -------------------- Read this topic online here: http://community.zenoss.com/forums/viewtopic.php?p=15438#15438 -------------------- m2f -------------------- _______________________________________________ zenoss-users mailing list [email protected] http://lists.zenoss.org/mailman/listinfo/zenoss-users
