EventClassMapping not working as expected 3.2.1

[James Newman]

James Newman [http://community.zenoss.org/people/JimForTheWin] created the discussion

"EventClassMapping not working as expected 3.2.1"

To view the discussion, visit: http://community.zenoss.org/message/72679#72679

--------------------------------------------------------------
Currently, I have a single rule in /App/Blah/  That is effectively a giant python script with a list of if statements and an actions (severity changes etc.)

I'm led to believe by Jane_Curry that the intended way of using EventClassMappings is having multiple mappings, each with unique IDs and the same EventClassKey (all my custom applications are using the same eventClassKey).

These rules should then run in order of their sequence.

However, when I split out my 'giant python if statements from hell', in to separate mappins,  they don't work.  Putting all the mappings back into a single giant mapping works perfectly.

Anyone have ideas in where I might be going wrong?

Example:

In an individual mapping:

| %1,2% Rule |
| %1,6% 'Push DISABLED due to' in evt.summary |
| %1,6% Regex |
| %1,6%
|
| %1,6% Example |
| %1,6%
|
| %1,6% Transform |
| %1,6% evt.severity = 2 |
| %1,6% Explanation |
| %1,6%
|
| %1,6% Resolution |


Doesn't work.

However in my single giant mapping:

| %1,2% Rule |
| %1,6%
|
| %1,6% Regex |
| %1,6%
|
| %1,6% Example |
| %1,6%
|
| %1,6% Transform |
| %1,6% <snip>
if 'Push DISABLED due to' in evt.summary:
    evt.summary = 2 
<snip> |
| %1,6% Explanation |
| %1,6%
|
| %1,6% Resolution |
|

Works perfectly.

What gives?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72679#72679]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[James Newman]

James Newman [http://community.zenoss.org/people/JimForTheWin] created the discussion

"Re: EventClassMapping not working as expected 3.2.1"

To view the discussion, visit: http://community.zenoss.org/message/72680#72680

--------------------------------------------------------------
Possibility:  Will events that match and are manipulated by rule one, still have rule 2 checked against them?

For me, rule 0 matches about 90% of my events (adds documentation links to the event for the NOC).
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72680#72680]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jcurry]

jcurry [http://community.zenoss.org/people/jcurry] created the discussion

"Re: EventClassMapping not working as expected 3.2.1"

To view the discussion, visit: http://community.zenoss.org/message/72670#72670

--------------------------------------------------------------
The event mapping process checks the eventClassKey and, for any that match, it checks mappings starting with the lowest sequence number.  As soon as a match is found, any associated class and/or mapping transform is executed.  Event processing then stops.  Once a match is found, that's it.

For Zenoss 3.x, most of this processing is done by zenhub so is there anything indicative in zenhub.log?  With Zenoss 4, it is zeneventd that does this processing work so that is the log to check.

Cheers,
Jane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72670#72670]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]