Forwarding events from Zenoss to other system

[Antonio Formato]

Antonio Formato [http://community.zenoss.org/people/Format] created the discussion

"Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64499#64499

--------------------------------------------------------------
Hi,
is it possible to forward events from Zenoss to other system like Splunk?
I'd like to use Zenoss but I have to trace events on Splunk too.
In other words when Zenoss receives a SNMP trap, it should forward it to another server.

Thank you all for support.
Regards
Antonio
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64499#64499]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64501#64501

--------------------------------------------------------------
This is a paid Enterprise feature that isn't in the free Core. You could try making event commands to regenerate SNMP traps, but they'll be cludgy and take lots of resources. I don't know if Core 4 will be better able to be hacked to do with with the new trigger system - it's in alpha now, so months from release, and things may change.

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64501#64501]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jplouis]

jplouis [http://community.zenoss.org/people/jplouis] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64511#64511

--------------------------------------------------------------
Out of the box Core 4 has event commands, email notification and snmp traps as actions for triggers.  Should be easier to add new actions but don't know if any have been written that are added via zenpack.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64511#64511]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[themactech]

themactech [http://community.zenoss.org/people/themactech] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64507#64507

--------------------------------------------------------------
I've done this with scripts.  The event manager allows you to have scripts triggered by events.  In my case I would encode every event in an email, sent it, receive it at the other end, decode it and recreate the event on the remote machine.  All of this can be done in core.

One would have to look at Splunk's ability to generate events or data via script but I would be very surprised if it could not be done.

Manuel
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64507#64507]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Antonio Formato]

Antonio Formato [http://community.zenoss.org/people/Format] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64510#64510

--------------------------------------------------------------
What about computational resources?
How can I trigger every events?

Thank you in advance.

Antonio
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64510#64510]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[themactech]

themactech [http://community.zenoss.org/people/themactech] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64527#64527

--------------------------------------------------------------
Which version of Zenoss are you using?  I have done this in 3.1 but it should be the same in 3.2.x

Manuel
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64527#64527]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Antonio Formato]

Antonio Formato [http://community.zenoss.org/people/Format] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64514#64514

--------------------------------------------------------------
I'm using 3.2.1
Thank you
Antonio

Post by Antonio Formato
Zenoss Community
Re: Forwarding events from Zenoss to other system
created by themactech in zenoss-users - View the full discussion
Which version of Zenoss are you using?  I have done this in 3.1 but it should be the same in 3.2.x
Manuel
Reply to this message by replying to this email -or- go to the message on Zenoss Community
Start a new discussion in zenoss-users by email or at Zenoss Community

--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64514#64514]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[themactech]

themactech [http://community.zenoss.org/people/themactech] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64535#64535

--------------------------------------------------------------
Go to the 'Event' tab, choose 'Event Manager', select the 'Commands' tab on the left side.

Type the name of your command, click 'Add', then select the newly created command.

Set it to enabled, then in the command box, type the path to your script and the tags to pass to it.

In my case I had:

/usr/local/zenoss/zenoss/libexec/./MyScript.sh '${dev/id}' '${evt/eventKey}' '${evt/component}' '${evt/severity}' '${evt/eventClass}' '${evt/summary}'

The Zenoss docs have the list of tags you can include.

Note that if you also want to pass that info during a clear event so your script handles the logic of a clear event, you need to paste the same string into the 'Clear Command' box.

Then you write MyScript.sh to trigger what you need on the other system.

Manuel
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64535#64535]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Antonio Formato]

Antonio Formato [http://community.zenoss.org/people/Format] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64536#64536

--------------------------------------------------------------
I'm trying this configuration.
I created an email alert on every new event, Zenoss sends an alerting email to an inbox.
A Splunk instance reads this mail and it indexes this infomations.

Is it a right approach?

Thank you
Regards
Antonio
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64536#64536]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[themactech]

themactech [http://community.zenoss.org/people/themactech] created the discussion

"Re: Forwarding events from Zenoss to other system"

To view the discussion, visit: http://community.zenoss.org/message/64541#64541

--------------------------------------------------------------
I don't know enough of Splunk to pitch in.  You should be able to push data into splunk whatever way is best, since any event tag can be passed to your script.

Manuel
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64541#64541]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]