Automatically remove severity "info" events

[Martin Thøgersen]

Martin ThÞgersen [http://community.zenoss.org/people/Martin] created the discussion

"Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/67819#67819

--------------------------------------------------------------
Hi

I am all new to using Zenoss (version 3.2.1), how do I remove the severity "info" events that I recieve from my cisco equipment. Can I make some kind off rule that puts info events directly into history, or simply drops the "info"-events, and if so, how do I do it ?

-Martin
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/67819#67819]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Voorhees]

Voorhees [http://community.zenoss.org/people/Voorhees] created the discussion

"Re: Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/67823#67823

--------------------------------------------------------------
Hey Matin - to acheive that you can setup an event transformation for the event with the transform being this:

evt._action = 'history'

or

evt._action = "drop"
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/67823#67823]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Martin Thøgersen]

Martin ThÞgersen [http://community.zenoss.org/people/Martin] created the discussion

"Re: Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/67831#67831

--------------------------------------------------------------
Thanks, I am however a totally newbe to Zenoss (only few days experience) where/how do I setup an event transformation ?

-Martin
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/67831#67831]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Voorhees]

Voorhees [http://community.zenoss.org/people/Voorhees] created the discussion

"Re: Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/67834#67834

--------------------------------------------------------------
No worries - I believe this example here is what you want to do - but change the event class key name to the one that is in the details of your event in the event viewer (you will see what i mean when you get there).

http://www.sysadminwiki.net/site/doku.php/monitoring/zenoss/event_transformations_in_zenoss http://www.sysadminwiki.net/site/doku.php/monitoring/zenoss/event_transformations_in_zenoss

Cheers

Voor
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/67834#67834]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Martin Thøgersen]

Martin ThÞgersen [http://community.zenoss.org/people/Martin] created the discussion

"Re: Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/67837#67837

--------------------------------------------------------------
Thanks again, and I found the example.. However the event I see has no event class key, which I need acording to the example.

| agent | zenperfsnmp |
| clearid |
|
| component | GigabitEthernet0/51 |
| count | 515 |
| dedupid | 193.43.216.37|GigabitEthernet0/51|/Perf/Snmp|ifHCOutOctets_ifHCOutOctets|Minor Baandbredde forbrug|2 |
| device | 193.43.216.37 |
| DeviceClass | /Network/Switch |
| DeviceGroups | | |
| DevicePriority | 3 |
| eventClass | /Perf/Snmp |
| eventClassKey |
|
| eventClassMapping |
|
| eventGroup |
|
| eventKey | ifHCOutOctets_ifHCOutOctets|Minor Baandbredde forbrug |
| eventState | 0 |
| evid | c601a3e9-6504-46f6-b6c4-f48505875b19 |
| facility | unknown |
| firstTime | 2012/08/13 14:06:59.000 |
| ipAddress | 193.43.216.37 |
| lastTime | 2012/08/15 08:57:01.000 |
| Location |
|
| manager | monitor01.lx.tv.sk.waoo.org |
| message | threshold of Minor Baandbredde forbrug exceeded: current value 54741108.29 |
| monitor | localhost |
| ntevid | 0 |
| ownerid |
|
| priority | -1 |
| prodState | 1000 |
| severity | 2 |
| stateChange | 2012/08/15 08:57:01.000 |
| summary | threshold of Minor Baandbredde forbrug exceeded: current value 54741108.29 |
| suppid |
|
| Systems | | |

Is there some other way, I can come arround this and remap this event to history ?

Thanks again
Martin
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/67837#67837]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Voorhees]

Voorhees [http://community.zenoss.org/people/Voorhees] created the discussion

"Re: Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/67839#67839

--------------------------------------------------------------
In that case you can make your transform feild the following:

    if evt.message.find("threshold of Minor Baandbredde forbrug exceeded") >= 0:
       evt._action = "history"

I am also curious is using ifHCOutOctets_ifHCOutOctets|Minor Baandbredde forbrug  or   ifHCOutOctets_ifHCOutOctets as the event class ID would work. Not sure on that one tho.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/67839#67839]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Martin Thøgersen]

Martin ThÞgersen [http://community.zenoss.org/people/Martin] created the discussion

"Re: Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/67857#67857

--------------------------------------------------------------
Thanks again, but since I do not have the eventclasskey name, do I just then follow the example you send, give it some kind of name, and then fill in the transformation like this ?

||
| Status  | |     |
      ||
| | Events | | 0 | 0 | 0 | 0 | 0 |
|| Total Event Count | 0 |
|


||
|   EventClassInst  | |     |
      ||
| | Event Class Key | Info_alarms |
| Sequence | 7 |
| %1,2% Rule |
| %1,6%
|
| %1,6% Regex |
| %1,6%
|
| %1,6% Example |
| %1,6%
|
| %1,6% Transform |
| %1,6% if evt.message.find("threshold of Minor Baandbredde forbrug exceeded") >= 0:  evt._action = "history" |
| %1,6% Explanation |
| %1,6%
|
| %1,6% Resolution |
| %1,6%
|
|
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/67857#67857]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Martin Thøgersen]

Martin ThÞgersen [http://community.zenoss.org/people/Martin] created the discussion

"Re: Automatically remove severity "info" events"

To view the discussion, visit: http://community.zenoss.org/message/68071#68071

--------------------------------------------------------------
hmmm, I can make this transform on our old ver. 2.5.2 Zenoss, making a transform on an event with no eventclasskey. but on our newer version 3.2.1 I cannot make a transform unless I have an eventclass mapping, and I cannnot make an eventclass mapping on my event since it has no event class key...

anyone knows how to come around this problem
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/68071#68071]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]