I receive a large amount of events that don't get classified by zenoss. I have seen two different methods to classifying them so far during the course of my research: 1- an event transform: evt.eventKey = "agentKey" 2- populating zproperties via regex eg: (P?<agentKey>[some pattern])
Unfortunately I have been unsuccessful in using these methods to classify events. I've tried a lot of things, so I've distilled it down to the most simple procedure I could think of. Steps taken: 1- Create event mapping placed in /Unknown with the following attributes A- id & event class key are test B- Regex - (?P<eventKey>test) 2- Creates a generic event with no information ./zensendevent -s Critical test 3- This results in an event with the following attributes: message and summary = 'test' eventkey = '' eventClass = '/Unknown' And other attributes which may or may not be important. As far as I understand, if there's no event key then zenoss should be scanning the summary. In this case I seem to have been unsuccessful in replicating this behaviour. I can only assume that I'm doing something wrong. Could anyone provide me with a similar procedure that will yield the expected behaviour from zenoss? Best, Hugo -------------------- m2f -------------------- Read this topic online here: http://community.zenoss.com/forums/viewtopic.php?p=21045#21045 -------------------- m2f -------------------- _______________________________________________ zenoss-users mailing list [email protected] http://lists.zenoss.org/mailman/listinfo/zenoss-users
