I'm not really sure how to do this, is this something I should do via a
transform? I've tried:
if evt.component == "OUT" or evt.component == "IN":
evt.component = "LOG"
with no luck...
I don't actually need in/out anywhere as long as I can get IN to clear
OUT - then if I see the event, it's in the OUT state...
Or should I be trying to change the syslog messages (and hence go to
their forums).
--
James Pulver
Information Technology Area Supervisor
LEPP Computer Group
Cornell University
Chet Luther wrote, On 12/17/2008 8:11 AM:
> On Dec 15, 2008, at 8:27 AM, James Pulver wrote:
>> I've done some more investigation, and what's even weirder is that
>> ZenSyslog and ZenHub (with log severity set to 10) both show the
>> event,
>> they show it being inserted, but it's just not in the event console,
>> nor
>> does it work to clear the out event...
>
> I think the problem is the component. If the component on the clearing
> event doesn't match the component on the original event the original
> event will not be cleared. The following fields have to match for the
> auto-clear correlation to happen.
>
> device
> component
> eventClass (unless zEventClearClasses is used instead)
> eventKey (summary is used if eventKey is blank)
>
> So I would recommend stuffing the IN/OUT in the summary and generating
> a matching eventKey for these events instead to properly do the auto-
> clear.
> _______________________________________________
> zenoss-users mailing list
> [email protected]
> http://lists.zenoss.org/mailman/listinfo/zenoss-users
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
