How to set an event to auto-delete

[jgillis]

jgillis [http://community.zenoss.org/people/jgillis] created the discussion

"How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64084#64084

--------------------------------------------------------------
Hi all,

I've got some events in Zenoss from syslog that are basically noise, and they're filling up the Zenoss SQL database and thus my disks.
How can I set Zenoss up to automatically ignore/acknowledge/purge these events?

Thanks!
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64084#64084]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64093#64093

--------------------------------------------------------------
If they're in /Unknown, map them to /Ignore. Otherwise, use an event transform per:
https://zcaportal.org/wiki/bin/view/ZCA/ZCAFAQ#What_re_45mapping_options_are_there_for_events_in_Event_Transforms_63 https://zcaportal.org/wiki/bin/view/ZCA/ZCAFAQ#What_re_45mapping_options_are_there_for_events_in_Event_Transforms_63

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64093#64093]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jgillis]

jgillis [http://community.zenoss.org/people/jgillis] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64085#64085

--------------------------------------------------------------
Okay, I wasn't sure if that would actually do what I wanted, or just label them as unimportant.

I'm going through my event log and "closing" all the events that have stacked up and filled the DB, but my disk usage is not decreasing. Do I have to do anything else to make these events actually get deleted from the DB completely?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64085#64085]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64094#64094

--------------------------------------------------------------
MySQL databases disk use *never* goes down. There's no way to reclaim the disk space save exporting the table, dropping it entirely and importing back in the backup...

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64094#64094]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jgillis]

jgillis [http://community.zenoss.org/people/jgillis] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64087#64087

--------------------------------------------------------------
Okay, I've run into a problem with jmp242's suggestion. When attempting to map a certain event to the Ignore class, I get the error:
1 event does not have an event class key. Created 0 event mappings.

The event in question is from syslog, and apparently is not getting an event class set when Zenoss receives it.
I've tried manually making a mapping in /Ignore that regex matches these syslog events, but it not having any effect.
The manual mapping has an Event Class set, which I cannot un-set.

How can I work around this issue?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64087#64087]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64130#64130

--------------------------------------------------------------
Use an event transform whenever a mapping fails. You'll need to match the event somehow using a transform (somewhere where it's ending up in mappings, or just in /Events) and then set it to drop...

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64130#64130]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jgillis]

jgillis [http://community.zenoss.org/people/jgillis] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64159#64159

--------------------------------------------------------------
Okay, that makes sense. I've never really worked with transforms in Zenoss yet, and all the docs I can find show examples of what they look like, but none explain where/how to enter them into the UI.
How would I add a transform to the /Unknown event class?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64159#64159]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64134#64134

--------------------------------------------------------------
You go to Events, -> Event Classes -> Unknown... Click on the gear in the lower left, Transform. This is only going to affect events that come into /Unknown of course.
--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64134#64134]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jgillis]

jgillis [http://community.zenoss.org/people/jgillis] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64165#64165

--------------------------------------------------------------
Ah, thanks very much. I haven't had need to dig into Transforms and some of the cooler stuff in Zenoss yet.

I have a transform in that's matching my syslog events and allowing me to set ClassKeys and such. However, I notice that if I set up a class mapping based on the post-transform event, it never seems to match. Does using a transform like this sidestep/override Class Mappings?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64165#64165]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64171#64171

--------------------------------------------------------------
The Event mappings happen before the transforms, so the event is already mapped to /Unknown, and then the transform does something. It can move it to a different Event Class (like a mapping does), or drop it or edit the details  - really anything.

Have you heard of Jane Curry's event management paper?
http://www.skills-1st.co.uk/papers/jane/zenoss_event_management_paper.pdf http://www.skills-1st.co.uk/papers/jane/zenoss_event_management_paper.pdf

This explains in great detail the event lifecycle (prior to Core 4 Alpha). Core 4 changes things, but it's going to be in alpha (Then Beta and RC) for a while and I hope the ZCA can get the paper updated during that time.

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64171#64171]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jgillis]

jgillis [http://community.zenoss.org/people/jgillis] created the discussion

"Re: How to set an event to auto-delete"

To view the discussion, visit: http://community.zenoss.org/message/64227#64227

--------------------------------------------------------------
I have not seen that paper, I'll be sure to dig into it for future questions.

Thanks for all your help!
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64227#64227]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]