Peter Perreault
2013-09-16 22:01:05 UTC
Peter Perreault [http://community.zenoss.org/people/eightcount] created the discussion
"More fun with event supression"
To view the discussion, visit: http://community.zenoss.org/message/74665#74665
--------------------------------------------------------------
I'm running Zenoss Core 4.2. I'm looking for a high level, "yes that is possible" or "forget it bud" kind of answer.
I'm attempting to mimic event suppression and device dependency operation I currently have implemented in WhatsUp Gold. Essentially, I monitor remote devices via LAN to LAN IPSec tunnel. I use a script to verify that the IPSec tunnel is "up." Essentially it is an snmp getnext operation on the ikeTunRemoteValue OID (1.3.6.1.4.1.9.9.171.1.2.3.1.7) of my firewall and I match the results against my known IPSec peer IP addresses. (I'll attached the script (VB) for anyone interested). The idea being that when the tunnel is "down", i.e. the peer IP is not found, alerts will be supressed.
I know event supression is somewhat of a hot topic, as the threads in the forum testify to. And that Core 4.x has implemented some layer 3 solutions with traceroute. Unfortunately those won't work in all situations for me. I'm not strong in Zenoss-foo so I'm not sure if it is worth chasing down a monitor that replicates the script I have now and kluge together a transform to suppress alerts when the IPSec tunnel is down.
Using ping to monitor the IPSec peer may be another method although it may result in more false positives.
Any thoughts? Any chance Zenoss can do this?
Thanks for your input.
--------------------------------------------------------------
Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74665#74665]
Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
"More fun with event supression"
To view the discussion, visit: http://community.zenoss.org/message/74665#74665
--------------------------------------------------------------
I'm running Zenoss Core 4.2. I'm looking for a high level, "yes that is possible" or "forget it bud" kind of answer.
I'm attempting to mimic event suppression and device dependency operation I currently have implemented in WhatsUp Gold. Essentially, I monitor remote devices via LAN to LAN IPSec tunnel. I use a script to verify that the IPSec tunnel is "up." Essentially it is an snmp getnext operation on the ikeTunRemoteValue OID (1.3.6.1.4.1.9.9.171.1.2.3.1.7) of my firewall and I match the results against my known IPSec peer IP addresses. (I'll attached the script (VB) for anyone interested). The idea being that when the tunnel is "down", i.e. the peer IP is not found, alerts will be supressed.
I know event supression is somewhat of a hot topic, as the threads in the forum testify to. And that Core 4.x has implemented some layer 3 solutions with traceroute. Unfortunately those won't work in all situations for me. I'm not strong in Zenoss-foo so I'm not sure if it is worth chasing down a monitor that replicates the script I have now and kluge together a transform to suppress alerts when the IPSec tunnel is down.
Using ping to monitor the IPSec peer may be another method although it may result in more false positives.
Any thoughts? Any chance Zenoss can do this?
Thanks for your input.
--------------------------------------------------------------
Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74665#74665]
Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]