Your help is invaluable as always Chet. My whole problem was fixating on why an event didn't show up after mapping, but who cares at this point as I've got it working now with the full "set" of mappings.
You were right on the eventclasskey - and the transform was right also, but what I forgot was what I'm calling "scope of event transforms", which is, event transforms in /App/Log won't apply if an event mapping drops it into /App/Log/IN lets say, I have to put the transform *in* the event mapping, and not the class (it doesn't seem to inherit it which I keep expecting it to). -- James Pulver Information Technology Area Supervisor LEPP Computer Group Cornell University Chet Luther wrote, On 12/17/2008 9:34 PM: > On Dec 17, 2008, at 8:31 AM, James Pulver wrote: >> I'm not really sure how to do this, is this something I should do >> via a >> transform? I've tried: >> if evt.component == "OUT" or evt.component == "IN": >> evt.component = "LOG" >> with no luck... >> >> I don't actually need in/out anywhere as long as I can get IN to clear >> OUT - then if I see the event, it's in the OUT state... >> >> Or should I be trying to change the syslog messages (and hence go to >> their forums). > > You can change the component using a transform, and what you have > above is the right way to do it. I don't have a ready explanation of > why it isn't working for you. I'd suggest watching the zenhub.log file > as matching events come in to see if your transform is generating any > errors. > _______________________________________________ > zenoss-users mailing list > [email protected] > http://lists.zenoss.org/mailman/listinfo/zenoss-users _______________________________________________ zenoss-users mailing list [email protected] http://lists.zenoss.org/mailman/listinfo/zenoss-users
