> Message: 7 > Date: Sat, 10 May 2008 18:16:52 -0400 > From: Chet Luther <[EMAIL PROTECTED]> > Subject: Re: [zenoss-users] event class mapping > To: General discussion of using zenoss system > <[email protected]> > Message-ID: <[EMAIL PROTECTED]> > Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes > > On May 10, 2008, at 1:24 PM, Shane Corbin wrote: >> I am trying to map syslog events to an event class. No matter how I >> set up the >> regex it does not catch the events and classify them as it should. >> When I go to >> the event browser and try to select a checkbox and map to event >> class, it returns >> with "1 event does not have an event class key. Created 0 event >> mappings." Is >> there something I am missing? It seems that all syslog events from >> all hosts >> have no event class key. Is this the problem? > > Yes, the missing eventClassKey is the problem. Zenoss comes with some > generic parsers that extract an eventClassKey for most common types of > devices, but it would appear that yours is not being parsed. > > Could you look in your $ZENHOME/log/zensyslog.log for any lines that > include "parseTag failed" ? This will show us logs that zensyslog > wasn't able to parse anything from, and should match the events you're > seeing with no eventClassKey. If they don't include sensitive data, > please post some examples to the list along with the type of device > that is sending them. We should be able to build a proper parser and > include it in future releases of Zenoss. > > >
As you expected there many of these errors in the $ZENHOME/log/zensyslog.log These are merely standard installs of debian etch and ubuntu hardy running net-snmp. I can cleanse the log entries if you'd like, but every log entry is missing the eventclasskey. Zenoss seems to be thorough as far as linux monitoring goes, should general log messages from standard linux distros be covered by these parsers. I mean is there a possibility that my parsers have been corrupted somehow, and how would I check this. If this is not standard functionality I can send examples of log entries. Depending on the code set I would be interested in developing parsers for zenoss. If you could provide me with some sort of documentation or point me in the right direction I would be happy to take a look. -- Shane Corbin Independant Computer Consultant [EMAIL PROTECTED] _______________________________________________ zenoss-users mailing list [email protected] http://lists.zenoss.org/mailman/listinfo/zenoss-users
