Ok, to sum up, I assume that even though I previously configured Events --> Net
--(subclass)--> Netscaler and I see the following configured:
Classes Tab:
status: <green>
SubClass count: 0
Instance count: 1
under EventClass Mappings I see:
ID: EVENT STATECHANGE
EventClassKey: EVENT_STATECHANGE
Evaluation: <it's empty>
Events: 0
This won't work? Sure seems like a bug to me since it shows a configured
"EventClassKey" but eh.. ok.
Moving forward with webpass's recommendation, I've put the following together
but I'm not sure if it's correct (I'm still grappling with Zenoss's powerful
but rather complicated setup).
How does the following look to parse a SYSLOG message that says:
--
05/11/2009:17:31:32 GMT sv-ns3 : EVENT STATECHANGE : Device "remote node
10.0.30.9" - State PARTIAL_FAIL
--
I'm not sure *where* I should configure this transform so I'm making an
assumption here. Goto Events --> Unknown --> Click on the down-arrow --> more
--> Transform
--
import map.netscaler.statechange
match = map.netscaler.statechange('(?<=EVENT STATECHANGE:)', evt.message)
if match and device:
evt.severity = 1
evt.eventClassKey = "EVENT_STATECHANGE"
evt.eventClass = "/Net/Netscaler"
evt.summary = match.group(0)
evt.component = match.group(1)+match.group(2)
--
note:
1. I assume that the original 'import re' line is only an object reference so
I've renamed it to be clearer
Now webpass said that once configured, I need to add a "MATCH =" rule but where
am I supposed to configure that? Maybe he meant to say under
Events --> Net --> Netscaler --> EVENT STATECHANGE --> Rule?
If so, maybe the transform should go here too? Gahh.. too many questions I
suppose but I do appreciate everyone's help!
--David
-------------------- m2f --------------------
Read this topic online here:
http://forums.zenoss.com/viewtopic.php?p=35150#35150
-------------------- m2f --------------------
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
