As I understand it (and this may be guessing a little) you use the rule
or regex to match if the event mapping applies to an event.
So if you used a rule to match on NOT NETLOGON (in the proper syntax of
course), then any event that *was* NETLOGON would "fall through" that
mapping, and not be affected by it. If you didn't have another mapping
to "catch" it, the event would end up in /Unknown...
Instead, you'd want the event mapping to match *on* NETLOGON, and then
have the transform to change the event state to whatever you wanted.
Empty fields for rule and regex seem to be * ... that is match anything.
So you can map all apps failing to /App/Fail, but have the transform
only do something if it's component = NETLOGON via the TALES expression.
Why can you do that? So you can have more control over Events really.
The Rule or Regex is to change the class of the event so you can get
stuff out of /Unknown. You could just do all your transforms in
/Unknown, but I'll bet you do want NETLOGON failures classified, even if
you only want it to be an info level event (or even direct to history).
So you *DO* Want it mapped, but you don't want it to have the default
severity or whatever.
So, where people have posted about wanting the events to be in a
*different* mapping than /mapping/here (whatever other than /Unknown)
and people say to use a transform, well, they could re-architect the
existing mappings with rules, but it's usually easier to create an
exception via the transform than to try and recatch everything Zenoss
does OOTB with mappings *save* the one you want to go somewhere else.
You could try and mess with Event Mapping priorities and like your
example use regex to match only on a particular (or python in the Rule)
mapping and therefore "catch" the event before it "fell through" to the
Zenoss mappings... But again, that's a lot more work and prone to odd
effects than just transforming the mapping you want to "move"...
I think that's how it all works, but I could be very wrong.
--
James Pulver
Information Technology Area Supervisor
LEPP Computer Group
Cornell University
martonem wrote:
I guess I'm dense...
I bought the Zenoss book (by Badger) and while I like it a lot, this chapter
(Event Mgt) needs to be more informative - maybe more examples...
It is still vague what these fields are for, example:
"Rule: Expression that evaluates the current even using the evt environment
variable."
OK - after it evaluates it what does it do? If the evaluation is false does it discard the event altogether?
"Regex: regular expression used to match the current event details"
No kidding - then what happens? What does it do with the matches? What would
happen to the event if the REGEX wasnt there?
Can I have a Transform and a Rule and a REGEX for one event definition or is it
just 1 of the 3?
Let me see an example with one of each if possible.....
Here is an example: I have an /App/Fail for NETLOGON component that I want out of the event console (ie dropped) for certain systems.
Do I use Transform to change the event state to 2 if component = NETLOGON?
Do I use Rule to match on NOT (Component=NETLOGON)?
Do I need REGEX at all?
I guess I just don't get it yet....
Thanks for the help though
-------------------- m2f --------------------
Read this topic online here:
http://community.zenoss.com/forums/viewtopic.php?p=23415#23415
-------------------- m2f --------------------
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
