event mapping and transformation

[Robert Bell]

Robert Bell [http://community.zenoss.org/people/wasguru] created the discussion

"event mapping and transformation"

To view the discussion, visit: http://community.zenoss.org/message/61836#61836

--------------------------------------------------------------
I've been reading up on event mapping & transformation. Most of the information seems to be a few years old.  Someis helpful but there have been alot of changed too it looks like so I have a few questions

Is there some reccomended reading on this that is specific to 3.2?

now my specific situation. . .

I have JMX monitors for several ActiveMQ servers, in active/passive configurations so when I read QueueSize from JMX, one will return a connection failure and one will return a value. This is OK and I dont want any alerts unless both brokers are down.

My thought was to make /Status/JMX/Connection Info instead of Error then change the severity only if both are getting the message "error connecting to server"

Try as I might I can not get /Status/JMX/Connection to be anything other than error.  The JMX datasource is set to Info. I can not map /Status/JMX/Connection to my own class say, /App/ActiveMQ. It only wants to map /Unknown

Lastly, none of the examples I have seen mention checking the status of another device as a part of the transform.

Any advice would be appreciated

Thanks!
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/61836#61836]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: event mapping and transformation"

To view the discussion, visit: http://community.zenoss.org/message/61849#61849

--------------------------------------------------------------
You cannot map events from any event class but /Unknown. You do need to use Transforms. While my only experiance with this sort of transform is grabbing useful snippets posted on the Forums, I can give you an example that checks if a device is down before sending the events through at the original severity.


# Change any non-ping, non-clear events from devices that have outstanding
# ping down events to Severity Info.
#
# This transform is sensitive to the event cache timeout. If the ping down
# event comes in less than "timeout" seconds before the subsequent events, the
# subsequent events will not be suppressed. You can find the event cache
# timeout setting on the Event Manager page in the web interface.
if getattr(evt, 'severity', 0) > 0 \
   and getattr(evt, 'eventClass', '/Unknown') != '/Status/Ping' \
   and device and device.getPingStatus() > 0:
   evt.severity = 2


Note that there it's checking the current device, but I would guess you could do a search in dmd for the other device. There are other examples out there, but if you don't find them, let me know and I'll look some more in my records.

--
James Pulver
Information Technology Area Supervisor
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/61849#61849]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Robert Bell]

Robert Bell [http://community.zenoss.org/people/wasguru] created the discussion

"Re: event mapping and transformation"

To view the discussion, visit: http://community.zenoss.org/message/62021#62021

--------------------------------------------------------------
So I've been working on this for a few days and I thought I'd share what I came up with. Initially I was getting all the events and searching the class and message to see if the other device had any events. What I eventually decided on was something like this:
em = dmd.Events.getEventManager()
em.cleanCache()
em.getDeviceStatus()


By default it returns the number of open events of that are Warning - Critical. I could not find any docuentation for getDeviceStatus but the source is all you really need (line 1064):  http://dev.zenoss.com/trac/browser/branches/zenoss-3.0.x/Products/ZenEvents/EventManagerBase.py http://dev.zenoss.com/trac/browser/branches/zenoss-3.0.x/Products/ZenEvents/EventManagerBase.py

I'm using this for all sorts of usefull things now, for example. If you have several JMX datasources pointed at Tomcat and tomcat goes down you'll get one event for each JMX datasource (heap memory, non-heap memory, files etc) so to supress duplicate events just:
if em.getDeviceStatus(evt.device) > 0:
        evt.severity = 2 #set to info
        evt._action = "history" #don't show in event console

One caveat, if you have unrelated events on the same device you need to do some additional validation before you supress it.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/62021#62021]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Shane Scott]

Shane Scott [http://community.zenoss.org/people/hackman238] created the discussion

"Re: event mapping and transformation"

To view the discussion, visit: http://community.zenoss.org/message/71551#71551

--------------------------------------------------------------
Speaking of this, I recieved this today from a customer....
Loading Image... Loading Image...
Best,
--Shane Scott (Hackman238)
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/71551#71551]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]