Yes, you can do this which is sort of like the default mapping (and
should work maybe better), but what I think is key, is to my knowledge
the current Zenoss versions only apply ONE mapping / transform to an event.
So you can do this, but you aren't then going to get the transform that
you're trying to put in /my/event/class ... You have to do the whole
transform here.
--
James Pulver
Information Technology Area Supervisor
LEPP Computer Group
Cornell University
webpass wrote, On 5/22/2009 1:02 PM:
> Here's what I do, it may not be the best technique but it works fine for me:
>
> Events that don't get assigned an event class key end up in /Events/Unknown.
> So if you create a Transform (click on arrow->More->Transform) you can do
> anything to these events, including assigning an event class, event class
> key, etc.
>
> So for example I have the following in Transform:
> Code:
> import re
>
> match = re.search('(?<=ETHERNET_INTERFACE:)([a-z0-9A-Z\-\/
> ]*)([0-9*]\/[0-9]*)(.*)', evt.message)
> if match and device:
> evt.severity = 1
> evt.eventClassKey = "ETHERNET_INTERFACE"
> evt.eventClass = "/Net/Link"
> evt.summary = match.group(0)
> evt.component = match.group(1)+match.group(2)
>
>
>
> That takes everything that matches the regex, sets a new severity,
> eventclasskey, class, etc. Then you just create a new "match = " rule for
> each unknown event and it will parse through each new event and transform it
> accordingly. Good way to develop your regex skills too :)
>
>
>
>
> -------------------- m2f --------------------
>
> Read this topic online here:
> http://forums.zenoss.com/viewtopic.php?p=35148#35148
>
> -------------------- m2f --------------------
>
>
>
> _______________________________________________
> zenoss-users mailing list
> [email protected]
> http://lists.zenoss.org/mailman/listinfo/zenoss-users
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
