How to pull Datasource from nagios style script and zencommand?

[David Sloboda]

David Sloboda [http://community.zenoss.org/people/david_sloboda] created the discussion

"How to pull Datasource from nagios style script and zencommand?"

To view the discussion, visit: http://community.zenoss.org/message/63773#63773

--------------------------------------------------------------
Zenoss 3.2.1 on RHEL5

I have a nagios-style command in libexec that works great.  Command output is in the format:
    Datasource|Datapoint=integer
and the threshold detects on Datapoint.  So far, so good.

[***@bby1ems05 ~]$ /opt/zenoss/libexec/lsload-query-command.py
ERROR: kel-lx62 has low free swap, only [2232M] |result=2
[***@bby1ems05 ~]$

The challenge I have is that this particular command can produce useful detail in Datasource.
I would like to put that detail into the evt.message
It would help staff who get the alert and who are not Zenoss administrators.

[***@bby1ems05 libexec]$ ./lsload-query-command.py
ERROR: kel-lx19 has low free swap, only [7792M]ERROR: kel-lx25 has low free swap, only [4M]ERROR: kel-lx52 has low free swap, only [0M] |result=2
[***@bby1ems05 libexec]$

I've searched the forum and these posts, and Jane Curry's event management paper
http://community.zenoss.org/docs/DOC-2514 http://community.zenoss.org/docs/DOC-2514
http://community.zenoss.org/docs/DOC-3909 http://community.zenoss.org/docs/DOC-3909
http://community.zenoss.org/thread/15493 http://community.zenoss.org/thread/15493

I suspect Datasource is thrown away.  I would like to confirm that somehow.

If that part of the output is thrown away, does anyone have any suggestions on how to find that data using an event transform? 

Thanks,
David Sloboda
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/63773#63773]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jcurry]

jcurry [http://community.zenoss.org/people/jcurry] created the discussion

"Re: How to pull Datasource from nagios style script and zencommand?"

To view the discussion, visit: http://community.zenoss.org/message/63872#63872

--------------------------------------------------------------
If the exit status of your script is anything other than 0 (OK), then the text from the datasource is all provided in the event's summary field.  If you wanted to then extract parts of that, you could use an event transform to do stuff.
Cheers,
Jane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/63872#63872]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[David Sloboda]

David Sloboda [http://community.zenoss.org/people/david_sloboda] created the discussion

"Re: How to pull Datasource from nagios style script and zencommand?"

To view the discussion, visit: http://community.zenoss.org/message/63864#63864

--------------------------------------------------------------
Thanks for the reply.

When you say "the exit status of your script is anything other than 0"
I assume "exit status" is the same thing as the "result" variable I am (successfully) using for the threshold
as in
[***@bby1ems05 libexec]$ ./lsload-query-command.py
   ERROR: kel-lx79 has low free swap, only [0M] |result=2
[***@bby1ems05 libexec]$

I've got it to produce what I want by forcing a sub command in the event transform for the Event Class as follows:

import re
# see http://community.zenoss.org/docs/DOC-2554
match = re.search('threshold of number-two exceeded', evt.message)
if match:
    evt.summary="At least one LSF execution host has very low free swap"
    cmd = "ssh -q adminhost /path/to/python/Zenoss/lsload-query.py -t 1"
    import os
    status = str(os.popen(cmd).read())
    evt.message =  status + "\n" + evt.message + "\n"


I will experiment more with evt.summary and see if I can get what I am looking for without the sub command.

Thank you,
David
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/63864#63864]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jcurry]

jcurry [http://community.zenoss.org/people/jcurry] created the discussion

"Re: How to pull Datasource from nagios style script and zencommand?"

To view the discussion, visit: http://community.zenoss.org/message/63874#63874

--------------------------------------------------------------
No - exit status is not the same as your result variable.  Here is my little test command:

#!/bin/sh

# Nagios return codes
STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3
#
exitstatus=$STATE_OK

# Nagios format echos information and status followed by pipe |
#  followed by <var name>=<value> tuples
# Note that Zenoss datapoints must match these var names exactly
#
echo "This is a test - status OK | timevar=1s sizevar=2B percentvar=10% countervar=123c"
exit $exitstatus

If $exitStatus is anything other than 0 then you get an event whose summary is
This is a test - status OK
ie everything upto the pipe symbol.  In addition, you get the timevar, sizevar, percentvar and countervar datapoints.

Cheers,
Jane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/63874#63874]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]