The confusion you're having is that in general, you *don't* set the EventClassKey, Zenoss does, and then your entries in the mappings tell Zenoss to take events set to that EventClassKey and use that mapping(sort of). So you need to work in /Unknown as that's where your events are going. Have you seen Jane Curry's event management paper yet?
http://www.zenoss.com/Members/jcurry/zenoss_event_management_paper.pdf/view -- James Pulver Information Technology Area Supervisor LEPP Computer Group Cornell University dranch wrote, On 5/22/2009 3:04 PM: > Ok, to sum up, I assume that even though I previously configured Events --> > Net --(subclass)--> Netscaler and I see the following configured: > > Classes Tab: > status: <green> > SubClass count: 0 > Instance count: 1 > > under EventClass Mappings I see: > > ID: EVENT STATECHANGE > EventClassKey: EVENT_STATECHANGE > Evaluation: <it's empty> > Events: 0 > > > This won't work? Sure seems like a bug to me since it shows a configured > "EventClassKey" but eh.. ok. > > > > Moving forward with webpass's recommendation, I've put the following together > but I'm not sure if it's correct (I'm still grappling with Zenoss's powerful > but rather complicated setup). > > > How does the following look to parse a SYSLOG message that says: > -- > 05/11/2009:17:31:32 GMT sv-ns3 : EVENT STATECHANGE : Device "remote node > 10.0.30.9" - State PARTIAL_FAIL > -- > > > I'm not sure *where* I should configure this transform so I'm making an > assumption here. Goto Events --> Unknown --> Click on the down-arrow --> > more --> Transform > > > -- > import map.netscaler.statechange > > match = map.netscaler.statechange('(?<=EVENT STATECHANGE:)', evt.message) > if match and device: > evt.severity = 1 > evt.eventClassKey = "EVENT_STATECHANGE" > evt.eventClass = "/Net/Netscaler" > evt.summary = match.group(0) > evt.component = match.group(1)+match.group(2) > -- > > note: > > 1. I assume that the original 'import re' line is only an object reference so > I've renamed it to be clearer > > > Now webpass said that once configured, I need to add a "MATCH =" rule but > where am I supposed to configure that? Maybe he meant to say under > Events --> Net --> Netscaler --> EVENT STATECHANGE --> Rule? > > > If so, maybe the transform should go here too? Gahh.. too many questions I > suppose but I do appreciate everyone's help! > > > --David > > > > > -------------------- m2f -------------------- > > Read this topic online here: > http://forums.zenoss.com/viewtopic.php?p=35150#35150 > > -------------------- m2f -------------------- > > > > _______________________________________________ > zenoss-users mailing list > [email protected] > http://lists.zenoss.org/mailman/listinfo/zenoss-users _______________________________________________ zenoss-users mailing list [email protected] http://lists.zenoss.org/mailman/listinfo/zenoss-users
