On May 10, 2008, at 1:24 PM, Shane Corbin wrote:
I am trying to map syslog events to an event class. No matter how I
set up the
regex it does not catch the events and classify them as it should.
When I go to
the event browser and try to select a checkbox and map to event
class, it returns
with "1 event does not have an event class key. Created 0 event
mappings." Is
there something I am missing? It seems that all syslog events from
all hosts
have no event class key. Is this the problem?
Yes, the missing eventClassKey is the problem. Zenoss comes with some
generic parsers that extract an eventClassKey for most common types of
devices, but it would appear that yours is not being parsed.
Could you look in your $ZENHOME/log/zensyslog.log for any lines that
include "parseTag failed" ? This will show us logs that zensyslog
wasn't able to parse anything from, and should match the events you're
seeing with no eventClassKey. If they don't include sensitive data,
please post some examples to the list along with the type of device
that is sending them. We should be able to build a proper parser and
include it in future releases of Zenoss.
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
