Events Mapping

[Mouhammed Soueidane]

Mouhammed Soueidane [http://community.zenoss.org/people/raziology] created the discussion

"Events Mapping"

To view the discussion, visit: http://community.zenoss.org/message/74885#74885

--------------------------------------------------------------
Hi everyone,
I'm having a hard time with events mapping on Zenoss. I already went through section 6 of Jane Curry's excellent document:
http://community.zenoss.org/docs/DOC-3538 http://community.zenoss.org/docs/DOC-3538 .

*What I did was the following:*

1- Created an event mapping with an ID=mapping
2- In the "Rule" section, I added the following: evt.summary=="test"
3- In the transform section I added the following: evt.summary="Event Successfully Mapped"
4- I clicked on Save
5- I went to the Sequence configuration, and made sure to configure the Class Mapping to have sequence = 0
6- I went to the "Events Console", and chose to ADD a new event
7- I made sure that my event Summary is equal to "test"
8- Made sure that the EventClassKey is equal to "mapping"

The new event is being added and I can clearly see it in the events console. Though the summary of the event remains as initially input "test".


*Expected Result:*
What I expect is that the summary of the event becomes "Event Successfully Mapped" which indicates that the mapping was successful.

Am I missing anything?*
*


Zenoss Version used: 4.2.4 (Also tried it on version 4.2.0)
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74885#74885]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[rolfs]

rolfs [http://community.zenoss.org/people/rolfs] created the discussion

"Re: Events Mapping"

To view the discussion, visit: http://community.zenoss.org/message/74886#74886

--------------------------------------------------------------
I think I would have done this:


ID=what you want to call it
Event Class Key= what your eventkey will be, probably empty in your test case.
rule: *test*
example: test

transform:
if evt.summary.find('test') >= 0:
   evt.summary="Event Successfully Mapped"
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74886#74886]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Mouhammed Soueidane]

Mouhammed Soueidane [http://community.zenoss.org/people/raziology] created the discussion

"Re: Events Mapping"

To view the discussion, visit: http://community.zenoss.org/message/74887#74887

--------------------------------------------------------------
The first type of matching that happens for an event is based on the "EventClassKey", so I don't think that it should be empty in my case.
Another thing is that the rule cannot be *test*. I think that should be my REGEX.

As for the transform, I think that performing the same logic of finding the "test" pattern again in the transform is redudant. I do think that in this case, the transform should only be used to change the events' fields.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74887#74887]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jcurry]

jcurry [http://community.zenoss.org/people/jcurry] created the discussion

"Re: Events Mapping"

To view the discussion, visit: http://community.zenoss.org/message/74889#74889

--------------------------------------------------------------
So - your eventClassKey is mapping as well as the name?  Typically, the eventClassKey would be set to some other field of the event - often it is the component field though it doesn't have to be.  So I, personally, would not have a mapping name or eventClassKey of "mapping" - I would find that confusing.

You don't say what event class you are mapping to??  You need to start with an event class - either a product-supplied one or create your own.  Once you have a class, then create the mapping.  The function of a mapping is to determine whether your event is going to be of this class, or not.

Rather than creating your own mapping next, the easiest way is to generate a test event.  Not sure whether you have actually been specifying an event class of /Unknown?  Don't - leave that event class field blank - that is what the mapping is all about.  Your event should come through as /Unknown anyway.  Once you see your event, use the class mapping icon in the Event Console (the one that looks like a data tree) and map it to your /Skills event class.  This AUTOMATICALLY creates a mapping for you and copies the event summary field into the mapping example field - which may come in handy later.

Now you can work on that mapping.  You could add a rule of evt.summary == "test" and you could add a transform as you have done.

Another tip is to always close previous test events before generating a new test event - otherwise it adds to the repeat count of an earlier event and may cause confusion.

When you get bored with using the GUI to generate events, you may find swapping to a command window and using zensendevent is faster.

Cheers,
Jane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74889#74889]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Mouhammed Soueidane]

Mouhammed Soueidane [http://community.zenoss.org/people/raziology] created the discussion

"Re: Events Mapping"

To view the discussion, visit: http://community.zenoss.org/message/74894#74894

--------------------------------------------------------------
Thanks a ton for the quick reply Jane. I finally got it working. The problem was that I was explicitly sending the eventClass as part of the event that I was creating. The following was the event I was sending through zensendevent:

<?xml version="1.0" encoding="UTF-8"?>
<ZenossEvents>
   <ZenossEvent>
       <SourceComponent>
             <device>testDevice</device>
              </SourceComponent>
               <summary>test</summary>
               <eventClassKey>mapping</eventClassKey>
      <eventClass>/Unknown</eventClass>
               <component>RJ-45</component>
               <severity>5</severity>
   </ZenossEvent>
</ZenossEvents>


After reading your comment, I omitted the <eventClass>, so by event now looks like this:

<ZenossEvents>
   <ZenossEvent>
       <SourceComponent>
             <device>testDevice</device>
    </SourceComponent>
      <summary>test</summary>
      <eventClassKey>mapping</eventClassKey>
      <component>RJ-45</component>
      <severity>5</severity>
   </ZenossEvent>
</ZenossEvents>

This has successfully mapped my event to the /TestClass I have created, and changed the summary to "Event Successfully Mapped".

Your reply was an eye-opener indeed =)

But then again, don't you think that this is a bug on Zenoss? Should I open a new issue on Jira?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74894#74894]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jcurry]

jcurry [http://community.zenoss.org/people/jcurry] created the discussion

"Re: Events Mapping"

To view the discussion, visit: http://community.zenoss.org/message/74895#74895

--------------------------------------------------------------
The /Unknown "class" is a special case that catches everything that doesn't map to anything else.  The documentation may not be over-bright about it but I don't really think it's a bug.

Glad you got going :)

Cheers,
Jane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74895#74895]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Mouhammed Soueidane]

Mouhammed Soueidane [http://community.zenoss.org/people/raziology] created the discussion

"Re: Events Mapping"

To view the discussion, visit: http://community.zenoss.org/message/74896#74896

--------------------------------------------------------------
Alright Jane,

Thanks again. Your help was more than valuable :D

Best Regards,
- Mouhammed Soueidane -
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74896#74896]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]