On Aug 28, 2009, at 11:29 AM, phonegi wrote:
> The following logs indicate that the maintenance window was entered,
> the trap was received, but then an event was logged. Notice that the
> prodState in the event is 1000, not -1. Something is wrong.
>
> Excerpt from zenactions.log:
> 2009-08-23 03:00:00 INFO zen.MaintenanceWindows: Mainenance window
> Routine Diagnostics starting
> 2009-08-23 03:00:00 INFO zen.MaintenanceWindows: MW Routine
> Diagnostics changes Phone System - Standby's production state from
> 1000 to -1
> ...
> 2009-08-23 03:09:59 INFO zen.MaintenanceWindows: Mainenance window
> Routine Diagnostics ending
> 2009-08-23 03:09:59 INFO zen.MaintenanceWindows: MW Routine
> Diagnostics changes Phone System - Standby's production state from
> -1 to 1000
>
> Excerpt from zentrap.log:
> 2009-08-23 03:05:58 DEBUG zen.ZenTrap: Received packet from
> 10.7.101.22 at port 50928
> 2009-08-23 03:05:58 DEBUG zen.ZenTrap: snmp trap snmp_coldStart
> 2009-08-23 03:05:58 DEBUG zen.ZenTrap: Queueing event {'firstTime':
> 1251011158.688993, 'severity': 3, 'eventClassKey': 'snmp_coldStart',
> 'oid': '1.3.6.1.4.1.119.2.3.76.2.0', 'component': '', 'community':
> 'HP9k', 'summary': 'snmp trap snmp_coldStart', 'manager':
> 'localhost', 'eventGroup': 'trap', 'agent': 'zentrap', 'device':
> '10.7.101.22', 'lastTime': 1251011158.688993, 'monitor': 'localhost'}
> 2009-08-23 03:05:58 DEBUG zen.ZenTrap: Total of 1 queued events
>
> Event details (from zendmd):
> prodState = 1000
> firstTime = 2009/08/16 03:06:06.000
> facility = unknown
> eventClassKey = snmp_coldStart
> agent = zentrap
> dedupid = Phone System - Standby||||3|snmp trap snmp_coldStart
> manager = localhost
> _baseurl = /zport/dmd/ZenEventManager
> Location =
> ownerid =
> stateChange = 2009/08/23 03:09:59.000
> eventClass = /Unknown
> message = snmp trap snmp_coldStart
> _logs = []
> DevicePriority = 3
> severity = 3
> monitor = localhost
> priority = -1
> _clearClasses = []
> DeviceClass = /Telecom
> eventState = 0
> evid = 416af17e-1d65-48fd-9a94-7e79745caa28
> eventClassMapping =
> component =
> clearid =
> DeviceGroups = |/Telecom
> eventGroup = trap
> ntevid = 0
> _details = (('community', 'HP9k'), ('oid',
> '1.3.6.1.4.1.119.2.3.76.2.0'))
> device = Phone System - Standby
> _fields = ['dedupid', 'evid', 'device', 'component', 'eventClass',
> 'eventKey', 'summary', 'message', 'severity', 'eventState',
> 'eventClassKey', 'eventGroup', 'stateChange', 'firstTime',
> 'lastTime', 'count', 'prodState', 'suppid', 'manager', 'agent',
> 'DeviceClass', 'Location', 'Systems', 'DeviceGroups', 'ipAddress',
> 'facility', 'priority', 'ntevid', 'ownerid', 'clearid',
> 'DevicePriority', 'eventClassMapping', 'monitor']
> suppid =
> count = 2
> _zem = ZenEventManager
> _action = status
> summary = snmp trap snmp_coldStart
> eventKey =
> eventPermission = True
> lastTime = 2009/08/23 03:05:58.000
> ipAddress = 10.7.101.22
> Systems = |
This may be related to what happens when a device's production state
is changed. For example, at the end of the "Routine Diagnostics"
window when the "Phone System - Standby" device's production state is
changed from -1 (Decommissioned) to 1000 (Production) it also sets all
ACTIVE (in the status table) events for this device to prodState 1000.
This is done so that any events that have not been cleared at the end
of the maintenance window can be alerted upon.
In this particular case I would recommend that you map snmp_coldStart
events to the clear severity since this trap gets sent when an SNMP
agent is started and is usually a good thing.
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
