transform to split event message

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69339#69339

--------------------------------------------------------------
hello,
       i have a script which parses weblogic logs at 5 minute intervals, extracts the lines with error codes and for each line , sends the following to zenoss:-

timestamp
error code
error message

            i am sending the message separated by new line (\n)... at zenoss i am trying to apply a transform to split the event message according to \n and then create separate events for each line... however the split does not seem to work ... i am doing something like - linelist=evt.message.split('\n') - and this should populate the list linelist with the lines in event message as items... but that is not happening. Any pointers ?

regards

Sadat
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69339#69339]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jshardlow]

jshardlow [http://community.zenoss.org/people/jshardlow] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69351#69351

--------------------------------------------------------------
To get each line, I think it'd be something like:

linelist=evt.message.split('\n')
line1=linelist[0]
line2=linelist[1]
line3=linelist[2]


Though the split may not be seeing '\n' as a line break. So you could try adding an escape character to treat the \n properly:

linelist=evt.message.split('\\n')
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69351#69351]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69366#69366

--------------------------------------------------------------
hi,

1./  '\n' is being used  correctly by split... no need to use escape character

2./ what i want is to create a new event for each line in original message...

linelist=evt.summary.split('\n')
for line in linelist:
  evt.message = line
  evt.severity = 2

          the above code though takes only first line from the original message ( doen not go through with the loop)... how can i create those different events from the original event ?

regards

Sadat
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69366#69366]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jshardlow]

jshardlow [http://community.zenoss.org/people/jshardlow] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69367#69367

--------------------------------------------------------------

txt="one/ntwo/nthree"
linelist=txt.split('/n')

...   print "LINE " + line
...
LINE one
LINE two
LINE three
As you may have figured out what your code snippet is doing is repeatedly manipulating the current event. Unfortunately I don't know how to create a new event in Python inside a transform. I've been having a look round, and the only thing I've found concerns creating an event from outside of Zenoss: http://community.zenoss.org/docs/DOC-2476 http://community.zenoss.org/docs/DOC-2476

You may be able to get some ideas from that link. Sorry I can't be of more help.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69367#69367]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69368#69368

--------------------------------------------------------------
hi,
   thanks  so much for the right direction... now i am doing something like

import subprocess
d=evt.device
ip=evt.ipAddress
linelist=evt.message.split('\n')
for line in linelist:
subprocess.call(['/opt/zenoss/bin/zensendevent','-d d','-i ip','-p weblogic','-c /Cmd/Weblogic','-s Critical','"line"'])


   and the transform does not apply... where/how can i debug this ?

regards

Sadat
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69368#69368]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jshardlow]

jshardlow [http://community.zenoss.org/people/jshardlow] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69369#69369

--------------------------------------------------------------
You might see something in zenhub.log if you change the zenhub log level to DEBUG.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69369#69369]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69370#69370

--------------------------------------------------------------
yes the zenhub log, in debug mode ,does report details about the event like message , severity etc. but it dies not give any information whatsoever about the transform nor does it log any thing from the transform...

regards

Sadat
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69370#69370]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[dpetzel]

dpetzel [http://community.zenoss.org/people/dpetzel] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69391#69391

--------------------------------------------------------------
zenhub.log will give you the details yor after. Its a little tough to pick them out, and its been a little bit since I looked at it, but it says something about "before transform" and "after transform" (thats not the exact wording). The debug log will show you what happened to the message after each transform
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69391#69391]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69422#69422

--------------------------------------------------------------
sorry but i do not see any messages whatsoever related to the transform in zenhub.log after enabling debug mode as well... also i am using both log.debug and print statements in transform for debugging purpose and i can't see those as well in the log...

regards

Sadat
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69422#69422]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69494#69494

--------------------------------------------------------------
hi,
    got a pointer... i am getting the following in zenhub.log for a new event

2012-10-24 16:23:59,659 INFO zen.ZenHub: Worker reports 2012-10-24 16:23:59,659 DEBUG zen.Events: ===============  incoming event  ===============

as can be seen it has INFO severity inspite of zenhub log severity being set at debug... this is confirmed from additional logging in the log... any pointers ?

regards

Sadat
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69494#69494]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jshardlow]

jshardlow [http://community.zenoss.org/people/jshardlow] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69497#69497

--------------------------------------------------------------
Setting zenhub log level at debug means that it will show any messages of level debug and above. eg. info, warning, error, critical.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69497#69497]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69501#69501

--------------------------------------------------------------
that is fine , but there is no trace of any kind of debug info related to the transform whatsoever in the log... which is very surprising...

regards

Sadat
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69501#69501]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sadat khan]

sadat khan [http://community.zenoss.org/people/sadat.ali.khan] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69608#69608

--------------------------------------------------------------
what i want to do is run a system command from a transform... i am using the sys.Popen() command to run the system command... but what is happening is it is spawning many processes and does not exit... the same behaviour is not displayed by the same functionality in a script. any pointers as to why the transform is behaving differently from a normal python script ?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69608#69608]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Chaz Vidal]

Chaz Vidal [http://community.zenoss.org/people/chazzvid] created the discussion

"Re: transform to split event message"

To view the discussion, visit: http://community.zenoss.org/message/69772#69772

--------------------------------------------------------------
Just a thought, maybe a transform is not the best place to run your external event scripts? 

Should it be better as an event trigger? 
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69772#69772]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]