Event Transform -- help! so many emails...

[Doug C]

Doug C [http://community.zenoss.org/people/thedukeness] created the discussion

"Event Transform -- help! so many emails..."

To view the discussion, visit: http://community.zenoss.org/message/72234#72234

--------------------------------------------------------------
I'm trying to use event transform to limit the notifications I receive.  I have a couple sites where one of them has an unreliable VPN connection and the other one has power outage issues.  When they start getting flakey I get buried in notifications.  Here's what I've put in place by searching for documentation and tips.  However while I don't get any errors from Zenoss, it doesn't seem to actually work.  The duplicates still get through.  Possibly because I'm using 4.2 and these syntax was from earlier Zenoss?

# When device is ping down, drop other alerts from same device
if getattr(evt, 'severity', 0) > 0 \
    and getattr(evt, 'eventClass', '/Unknown') != '/Status/Ping' \
    and device and device.getPingStatus() > 0:
    evt.eventState = 2


# If site1 gateway is ping down, drop alerts from site1 devices
if  device and 'site1' in device.getLocationName() and device.id != 'gw-site1.example.com':
    gateway = device.findDevice('gw-site1.example.com')
    if gateway.getPingStatus() > 0:
        evt.eventState = 2


# If esxi1 host is ping down, drop alerts from esxi1 guests
if str(evt.DeviceGroups).find("esxi1")>=0 and device.id != 'esxi1-site1.example.com':
    vm_host = device.findDevice('esxi1-site1.example.com')
    if vm_host.getPingStatus() > 0:
        evt.eventState = 2
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72234#72234]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: Event Transform -- help! so many emails..."

To view the discussion, visit: http://community.zenoss.org/message/72239#72239

--------------------------------------------------------------
I think it depends on whether the ping state actually shows as down when the event comes through. Remember that there's up to a 1 minute period where an intermediary device can be down but Zenoss hasn't polled it yet so doesn't know that's why it can't talk to the target devices...

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72239#72239]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[nilie]

nilie [http://community.zenoss.org/people/nilie] created the discussion

"Re: Event Transform -- help! so many emails..."

To view the discussion, visit: http://community.zenoss.org/message/72245#72245

--------------------------------------------------------------
One of the (very few IMO) shotcomings of Zenoss is that there is no way to tell for sure that it will ping the site gateway before the rest of the devices from that site so although your transform is correct, it is based on an incorrect assumption. Same thing for ESXi guests behind their host. You've stumbled upon one of the sore points of Zenoss, Layer2/Layer3 dependencies.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72245#72245]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Doug C]

Doug C [http://community.zenoss.org/people/thedukeness] created the discussion

"Re: Event Transform -- help! so many emails..."

To view the discussion, visit: http://community.zenoss.org/message/72253#72253

--------------------------------------------------------------
I see what you guys mean.  How about something like this, I found a post with code that looks like it tries to delete the duplicate events.  If I set a notification delay to 10 minutes, maybe this can clean them out before the email is triggered.  I'm going to test it out and see if it helps.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72253#72253]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Doug C]

Doug C [http://community.zenoss.org/people/thedukeness] created the discussion

"Re: Event Transform -- help! so many emails..."

To view the discussion, visit: http://community.zenoss.org/message/72255#72255

--------------------------------------------------------------
nope doesn't work.  Looks like dmd.ZenEventManager.getEventList() no longer exists
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72255#72255]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]