Discussion:
Event Transform Cisco LinkUp/Down
philipp
2012-03-14 14:22:39 UTC
Permalink
philipp [http://community.zenoss.org/people/philipp] created the discussion

"Event Transform Cisco LinkUp/Down"

To view the discussion, visit: http://community.zenoss.org/message/65192#65192

--------------------------------------------------------------
I'm confused regarding the event attributes of snmp traps, especially cisco linkup/down.

The event arises with the following trap details:

Event Details
| 1.3.6.1.2.1.1.3.0 | 111492364 |
| community | xxxxxxxxxx |
| ifDescr | FastEthernet0/0 |
| ifDescr.4 | FastEthernet0/0 |
| ifIndex | 4 |
| ifIndex.4 | 4 |
| ifType | 6 |
| ifType.4 | 6 |
| locIfReason | Link up |
| locIfReason.4 | Link up |
| oid | 1.3.6.1.6.3.1.1.5.4 |

What I need is the ifDescr, ifIndex and locIfReason attributes. I use the event transform by David Mahler (http://community.zenoss.org/docs/DOC-532), which uses the same attributes. But the event transform parser denies to "save" the script.

I used zendmd to search for any attributes in the event, but I cannot find them.
...     print key + "\t\t" + str(value)
 
count                     1
lastTime                2012/03/14 13:59:50.000
firstTime               2012/03/14 13:59:50.000
severity                3
evid                      931bd29c-cc51-438c-b7b8-6d2bb9ac0ef2
_action              status
component
summary              snmp trap linkDown
_baseurl                /zport/dmd/ZenEventManager
_clearClasses           []
eventKey
device               192.168.100.117
_zem                 ZenEventManager
eventClass              /Unknown
_fields              ['eventState', 'severity', 'device', 'component', 'eventClass', 'summary', 'firstTime', 'lastTime', 'count', 'eventState', 'severity', 'evid']
eventPermission         True
eventState              0


Where are the attributes? :)
Where can I find a logfile for the parser which checks my transform script?

Regards, Philipp
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/65192#65192]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
Loading...