You can configure snmpd.conf (or snmpd.local.conf) on the host being monitored
by adding the following lines:
NOTE: Change all occurrences of <procname> below to a process you can
stop/start, e.g: httpd. <procname> is the process name as listed by "ps -e"!
Code:
# sink
trapcommunity public
informsink <zenossHost> public
# user settings
rouser userX noauth
agentSecName userX
# monitors
monitor -u userX -r 1 -D -S -o prErrorFlag -o prNames -o prMin -o prMax -o
prCount -o prErrMessage "procWatch" prErrorFlag != 0
# Processes
proc <procname> 1 1
Valid examples for the process thresholds are:
Code:
proc <procname> At least 1 process is running
proc <procname> 0 0 At least 1 process is running
proc <procname> MAX Between 0 and MAX processes running (no more
than Max)
proc <procname> MIN MAX Between MIN & MAX processes running
NOTE:
Restart the snmpd daemon and stop the process matching <procname> and you'll
get a trap in Zenoss. You then need to map the event twice in Zenoss - once for
a down event and once for a clear event, I've found the following rules work
although it's not pretty - I have asked Zenoss if there's an easier way to
write the rule (it doesn't accept more than 1 line or variables!):
down event:
Code:
str(getattr(evt, '1.3.6.1.2.1.88.2.1.1.0')) == 'procWatch' and
str(getattr(evt,'1.3.6.1.4.1.2021.2.1.101.' +
str(getattr(evt,'1.3.6.1.2.1.88.2.1.4.0')).replace('(1, 3, 6, 1, 4, 1, 2021, 2,
1, 100, ', '').replace(')', ''))) != '' and
str(getattr(evt,'1.3.6.1.4.1.2021.2.1.2.' +
str(getattr(evt,'1.3.6.1.2.1.88.2.1.4.0')).replace('(1, 3, 6, 1, 4, 1, 2021, 2,
1, 100, ', '').replace(')', ''))) == '<procname>'
clear event:
Code:
str(getattr(evt, '1.3.6.1.2.1.88.2.1.1.0')) == 'procWatch' and
str(getattr(evt,'1.3.6.1.4.1.2021.2.1.101.' +
str(getattr(evt,'1.3.6.1.2.1.88.2.1.4.0')).replace('(1, 3, 6, 1, 4, 1, 2021, 2,
1, 100, ', '').replace(')', ''))) == '' and
str(getattr(evt,'1.3.6.1.4.1.2021.2.1.2.' +
str(getattr(evt,'1.3.6.1.2.1.88.2.1.4.0')).replace('(1, 3, 6, 1, 4, 1, 2021, 2,
1, 100, ', '').replace(')', ''))) == '<procname>'
Using this method is quite nice as the events are alerted very quickly.
-------------------- m2f --------------------
Read this topic online here:
http://community.zenoss.com/forums/viewtopic.php?p=22233#22233
-------------------- m2f --------------------
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
