"evid" field in zenoss_zep

[Mouhammed Soueidane]

Mouhammed Soueidane [http://community.zenoss.org/people/raziology] created the discussion

""evid" field in zenoss_zep"

To view the discussion, visit: http://community.zenoss.org/message/70530#70530

--------------------------------------------------------------
Hi everyone,
I'm trying to write a migration script that would query the new "zenoss_zep"  database and feed the generated results to Splunk.I used to do this easily with the old "events" database, where the column "evid" happens to be my unique identifier for an event. I can't seem to find the "evid" column in the "event_archive" table ( maps to the old "history" table). All I can find is a column called UUID which contains "gibberish" characters such as "\0 ÑXrŠ6 â(\"ƒ¬D:"
Interestingly, in Zenoss' UI, when I double click an event, I can clearly see its evid which I'm sure that it's being dynamically generated from the existing data in the database.

Can anyone tell me how do I get the old evid back?

I appreciate your help.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70530#70530]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Philip Warren]

Philip Warren [http://community.zenoss.org/people/pwarren] created the discussion

"Re: "evid" field in zenoss_zep"

To view the discussion, visit: http://community.zenoss.org/message/70515#70515

--------------------------------------------------------------
The 'uuid' column is where you want to look, however as you have noticed it is not stored in the same manner as before. The previous 'evid' column was stored as a 36-byte string, and today the UUID is stored in its more compact binary representation - a 16 byte binary.

To convert to the format you are used to, there is a new function added to the 'zenoss_zep' schema called BINARY_UUID_TO_STR which you can call when querying rows from the database. For example, run:

SELECT BINARY_UUID_TO_STR(uuid) AS evid, summary FROM event_summary;

An alternative solution (preferred because the schema may change as necessary) would be to use the ZepFacade to query events from zeneventserver. Look at the ZepFacade.createEventFilter() and ZepFacade.getEventSummariesGenerator() methods as a way to select events and page over the results. If you are looking to send events to another source, you may want to use the 'update_time' filter option to save the state of the event extract as this column changes with any modifications in the database for an event.

Hope this information helps.

-- Philip
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70515#70515]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Mouhammed Soueidane]

Mouhammed Soueidane [http://community.zenoss.org/people/raziology] created the discussion

"Re: "evid" field in zenoss_zep"

To view the discussion, visit: http://community.zenoss.org/message/70537#70537

--------------------------------------------------------------
Many thanks man. This was EXACTLY what I needed. I really appreciate your help, and I hope that you have an idea about the "Device Down" problem that I was having in our earlier discussion.

Thanks again.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70537#70537]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]