Zenoss Core 4.2.3 Interface Utilization Transform Help Needed

[dlitwin]

dlitwin [http://community.zenoss.org/people/dlitwin] created the discussion

"Zenoss Core 4.2.3 Interface Utilization Transform Help Needed"

To view the discussion, visit: http://community.zenoss.org/message/72174#72174

--------------------------------------------------------------
Trying to get the interface utilization transform working in Zenoss 4.  I want my values to be displayed as a % not as the raw value.  Currently I am using the following transform under /perf/interface:

# Use in Perf/Interface
#Transform interface usage into readable format
import re

fs_id = device.prepId(evt.component)
for f in device.os.interfaces():
    if f.id != fs_id: continue

    # Extract the percent and utilization from the summary
    m = re.search("threshold of [^:]+: current value ([\d\.]+)", evt.message)
    if not m: continue
    currentusage = (float(m.group(1))) * 8
    p = (currentusage / f.speed) * 100
    evtKey = evt.eventKey

    # Whether Input or Output Traffic
    if evtKey == "ifInOctets_ifInOctets|high utilization":
        evtNewKey = "Input"
    elif evtKey == "ifOutOctets_ifOutOctets|high utilization":
        evtNewKey = "Output"


    # Check the speed to determine the appropriate conversion
    # Gbps utilization
    if currentusage > 1000000000:
        Usage = currentusage / 1000000000
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f Gbps) or %3.2f%% is being used." %  (Usage, p)

    # Mbps utilization
    elif currentusage > 1000000:
        Usage = currentusage / 1000000
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f Mbps) or %3.2f%%  is being used." %  (Usage, p)

    # Kbps utilization
    elif currentusage > 1000:
        Usage = currentusage / 1000
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f Kbps) or %3.2f%%  is being used." %  (Usage, p)

    # bps  utilization
    elif currentusage < 1000:
        Usage = currentusage
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f bps) or %3.2f%%  is being used." %  (Usage, p)
    break

Sometimes I get the correct value displayed as a %.  Other times it doesn't work.

An error I just received was:

|
| Resource: | sw (http://cabzen.duluth.k12.mn.us:8080/zport/dmd/goto?guid=c5c0d6aa-1fa9-418a-b374-951701549240) |
| Component: | Adaptive Security Appliance 'outside' interface (http://cabzen.duluth.k12.mn.us:8080/zport/dmd/goto?guid=566738a1-688d-4724-8154-90069f839883) |
| Event Class: | /Perf/Interface (http://cabzen.duluth.k12.mn.us:8080/zport/dmd/Events/Perf/Interface) |
| Status: | Cleared |
| Message: | threshold of high utilization exceeded: current value 182349837.013333 |
|
|
Event Management... |
|
| agent | zenperfsnmp |
| component | Adaptive Security Appliance 'outside' interface (http://cabzen.duluth.k12.mn.us:8080/zport/dmd/goto?guid=566738a1-688d-4724-8154-90069f839883) |
| dedupid | sw|Adaptive Security Appliance _outside_ interface|/Perf/Interface|ifHCOutOctets_ifHCOutOctets|high utilization|3 |
| eventClass | /Perf/Interface (http://cabzen.duluth.k12.mn.us:8080/zport/dmd/Events/Perf/Interface) |
| eventClassKey |
|
| eventClassMapping |
|
| eventGroup |
|
| eventKey | ifHCOutOctets_ifHCOutOctets|high utilization |
| eventState | Cleared |
| evid | 0050568e-44ef-8156-11e2-8050d3c68d46 |
| facility |
|
| message | threshold of high utilization exceeded: current value 182349837.013333 |
| ntevid |
|
| priority |
|
| severity | 3 |
| summary | threshold of high utilization exceeded: current value 182349837.013333 |
|
|
Device State... |
|
Event Data... |
|
| clearid | 0050568e-44ef-8156-11e2-8051869e1771 |
| count | 1 |
| firstTime | 2013-02-26 14:12:19 |
| lastTime | 2013-02-26 14:12:19 |
| owner |
|
| stateChange | 2013-02-26 14:17:21 |
|
|
Event Details... |
|
| current | 182349837.013 |
| how | exceeded |
| manager | [*ZENOSS SERVER]* |
| max | 93750000.0 |
| zenoss.device.device_class | /Network/Router/Firewall |
| zenoss.device.ip_address | 10.1.0.4 |
| zenoss.device.location | /HOCHS |
| zenoss.device.priority | 3 |
| zenoss.device.production_state | 1000 |
|

I am thinking the error lies somewhere with the eventkey name?  Any help would be appreciated.  Thanks.

Dannon
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72174#72174]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sahul hameed]

sahul hameed [http://community.zenoss.org/people/sahul906] created the discussion

"Re: Zenoss Core 4.2.3 Interface Utilization Transform Help Needed"

To view the discussion, visit: http://community.zenoss.org/message/72259#72259

--------------------------------------------------------------
Hi,

I am using zenoss 4.2.3 for monitoring Cisco and HP L2 switches. I want to configure a trigger when the port utilization crosses 75% and escalate it when it reaches 85%. I am using the monitoring template (/Device) only.  please Help me out.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72259#72259]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[dlitwin]

dlitwin [http://community.zenoss.org/people/dlitwin] created the discussion

"Re: Zenoss Core 4.2.3 Interface Utilization Transform Help Needed"

To view the discussion, visit: http://community.zenoss.org/message/72342#72342

--------------------------------------------------------------
Sahul -

sorry I can't help you on this one.  The transform I used was created by someone else.  I don't have enough skill to be of any help.  Maybe post the question again in its own forum post.

Dannon
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72342#72342]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[dlitwin]

dlitwin [http://community.zenoss.org/people/dlitwin] created the discussion

"Re: Zenoss Core 4.2.3 Interface Utilization Transform Help Needed"

To view the discussion, visit: http://community.zenoss.org/message/72341#72341

--------------------------------------------------------------
I figured the problem out myself:

I modified:
   # Whether Input or Output Traffic
    if evtKey == "ifInOctets_ifInOctets|high utilization":
        evtNewKey = "Input"
    elif evtKey == "ifOutOctets_ifOutOctets|high utilization":
        evtNewKey = "Output"


to be:


    # Whether Input or Output Traffic
    if evtKey == "ifInOctets_ifInOctets|high utilization" or evtKey == "ifHCInOctets_ifHCInOctets|high utilization":
        evtNewKey = "Input"
    elif evtKey == "ifOutOctets_ifOutOctets|high utilization" or evtKey == "ifHCOutOctets_ifHCOutOctets|high utilization":
        evtNewKey = "Output"

Now I catch those eventkeys and I get back a proper percent % instead of the raw number.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72341#72341]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[sahul hameed]

sahul hameed [http://community.zenoss.org/people/sahul906] created the discussion

"Re: Zenoss Core 4.2.3 Interface Utilization Transform Help Needed"

To view the discussion, visit: http://community.zenoss.org/message/72403#72403

--------------------------------------------------------------
Hi,
Thanks for your reply for my post.

I am also getting the raw values for my interface utilization even after making changes as your said in this post. I am using the below transform in my zenoss 4.2.3 :

# Use in Perf/Interface
#Transform interface usage into readable format
import re

fs_id = device.prepId(evt.component)
for f in device.os.interfaces():
    if f.id != fs_id: continue

    # Extract the percent and utilization from the summary
    m = re.search("threshold of [^:]+: current value ([\d\.]+)", evt.message)
    if not m: continue
    currentusage = (float(m.group(1))) * 8
    p = (currentusage / f.speed) * 100
    evtKey = evt.eventKey

*# Whether Input or Output Traffic*
*    if evtKey == "ifInOctets_ifInOctets|high utilization" or evtKey == "ifHCInOctets_ifHCInOctets|high utilization":*
*        evtNewKey = "Input"*
*    elif evtKey == "ifOutOctets_ifOutOctets|high utilization" or evtKey == "ifHCOutOctets_ifHCOutOctets|high utilization":*
*        evtNewKey = "Output"*

    # Check the speed to determine the appropriate conversion
    # Gbps utilization
    if currentusage > 1000000000:
        Usage = currentusage / 1000000000
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f Gbps) or %3.2f%% is being used." %  (Usage, p)

    # Mbps utilization
    elif currentusage > 1000000:
        Usage = currentusage / 1000000
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f Mbps) or %3.2f%%  is being used." %  (Usage, p)

    # Kbps utilization
    elif currentusage > 1000:
        Usage = currentusage / 1000
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f Kbps) or %3.2f%%  is being used." %  (Usage, p)

    # bps  utilization
    elif currentusage < 1000:
        Usage = currentusage
        evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f bps) or %3.2f%%  is being used." %  (Usage, p)
    break

I am getting the event as :

*threshold of high utilization exceeded: current value 73658869788774.890625*
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72403#72403]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[dlitwin]

dlitwin [http://community.zenoss.org/people/dlitwin] created the discussion

"Re: Zenoss Core 4.2.3 Interface Utilization Transform Help Needed"

To view the discussion, visit: http://community.zenoss.org/message/72417#72417

--------------------------------------------------------------
I'd double check that there aren't any CR/LF or other things showing up in the transforms.  When I usually find some script on this site, I will copy into Notepad first, edit if needed to remove extra blank spaces, and then past that into the transform box.

When I have just copy/paste right from the website into zenoss transform window, I get errors.  Probably something not visible but getting picked up on the unix side.

Maybe remodel the device in question and clear out any events realted to this.

Dannon
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72417#72417]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]