On Mar 14, 2008, at 2:56 PM, James Alspach wrote:
I know that this should be easy but I just can not seem to figure it
out. I would like to take a new event (in this case a when an
interface exceeds the 75% threshold) and allow it to be at the
default severity until count is , lets say, 5 then bump it up to
the next severity and keep doing this until it becomes critical.
Even better would be to have different counts between jumps. For
instance, 10 moves it up from info to warning, 5 more from warning
up to error…
My overall feeling is that I should be able to set a mapping rule to
be evt.priorty=2 AND evt.count=10 and then a regex to find the
threshold warning then use a transform to add one to the priority.
I have 3 problems with the above
Unfortunately this isn't possible using event mapping rules at the
moment. The reason for this is that at "mapping time" the count is
unknown. Zenoss has no idea what the count on the event is because you
could easily affect the event's dedupid within the mapping rule
(zProperties or Transform) and thus entirely change the count.
Basically the count value only exists once the event has already been
inserted into the database. So doing this kind of thing would require
post-processing on the events._______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
